{ "Event": { "published": true, "date": "2026-09-06", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-09-06", "timestamp": 1788739382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "9cee39fe-e138-4a41-b496-9cd12d3b0f0d", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33568e5e-a9fd-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788704037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788704037, "uuid": "a2587288-f030-4266-bc71-1b9cb0316f60", "comment": "Malware payload (Mirai)", "value": "f9e3d1f0054359af08aeb347503b7490", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788704037, "uuid": "8dc238da-f1b4-483e-bd05-b1c8f63297f3", "comment": "Malware payload (Mirai)", "value": "005b92682ff4e21cd81ea7a62dec1768ceed06a08f9b862698295bf4b5f2e9db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788704037, "uuid": "07ff2afe-f2ad-4dbe-9fda-8383b2d58297", "comment": "Malware payload (Mirai)", "value": "43171b5a332351e506c4113618fb3bc94acc6130", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788704037, "uuid": "9113c3de-f59f-4d0b-bc99-e48390c214ed", "comment": "Malware payload (Mirai)", "value": "7257054aff3a06d25fd5564d50140facb37259a26bfaed81a09f066a584f87dafdfa198404d8e952ab24102bfcef0f0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788704037, "uuid": "657f301a-a7f3-4260-b96c-285b8cc5c55e", "value": "T1B0B32B44FD51876BC3C227F6F78E479D3B355A6857DB33116A386DB42BC1B882E29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788704037, "uuid": "8c39a53f-6399-491c-b90a-f37b69a82deb", "value": "3072:63dOhtEtYlkHlPdfXYIGh/U2gWvEYLck8DwZ+dOOqRSm1VLP7m6ciQH3MhE5r6A:yXYIGh/UFWsYLck8kZ+dOOESm11zm6ct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788704037, "uuid": "ddbd6bcf-8b19-4980-9690-c6a6e71d6c85", "value": 113723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788704037, "uuid": "5c77ef6e-262d-4524-a343-485d0683fe06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788704037, "uuid": "ae4e0b6a-fca1-4ce6-8465-76c5e468c4ea", "value": "telnet", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a5035ea-aa2d-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1788724665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724665, "uuid": "2d629f80-3629-407b-a9cc-4661a9bb6c49", "comment": "Malware payload (SalatStealer)", "value": "1fffc6bffec393271a37de759561ffde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724665, "uuid": "33772e29-0c72-47fb-96c8-eeb1bdb74d12", "comment": "Malware payload (SalatStealer)", "value": "0210f19ad6b72c8860d9e88b31c546a39a47939ded2bf91c65738b7ffdcf913c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724665, "uuid": "59767db4-5e2d-4224-a50b-66cdff8d010d", "comment": "Malware payload (SalatStealer)", "value": "21aecffb290c94bcd919081bcf34b0a9b869d505", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724665, "uuid": "b44f3ace-5825-4cba-856c-6e3155824dcc", "comment": "Malware payload (SalatStealer)", "value": "fd2e75bdd5caefc5cb1644f535c5b488e18812f1376ad35b7c6f1d38722d59e46e8f66b273b51cfa89d8521c6ef8c516", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724665, "uuid": "cd7efe4e-dd83-4803-9015-9be421c236c4", "value": "T150F53360A06B4307E7E4263657BE9675B2A937C7A0E0205E1945C3B8336B7BE13F81D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724665, "uuid": "b7997c3c-9b0e-45d1-8dcf-cf71e049873c", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724665, "uuid": "645a721c-9e4c-4f7c-ac94-61d50883a1d8", "value": "49152:sYSlpS9paP7+atEGPSIPDLCTHs4CHOwS/lJ6DxYq2t8nrmcAUe+34mP6XhJbpnKv:s7pUQeIwpC8l+Yp0rmcViX3MCAbUK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788724665, "uuid": "4d6ea5f3-e6c0-4b35-8e4e-37df210c3b66", "value": 3593216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788724665, "uuid": "5e448246-7ddd-4aeb-b400-fc059e3a960a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724665, "uuid": "290e5167-79cc-49f3-b733-5dc6b82e4443", "value": "RknNObhod.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f866f6f-a9d9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788688542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788688542, "uuid": "c2ec4f03-591d-44c8-ad4a-47ebc8c6cf37", "comment": "Malware payload", "value": "cf5b23ccd3d6039e6d9c7af00924928e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788688542, "uuid": "05af6e76-b789-42e2-abd0-bffe992298b7", "comment": "Malware payload", "value": "03c7b831558a2ce54d61b99af27b05220ae18a69cef5023844582e9065f1dd46", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788688542, "uuid": "fa851fe5-5ec2-4958-8ede-7b7dae4db289", "comment": "Malware payload", "value": "0988d4a91c736f80bc616a7003bb4a5c75ef7929", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788688542, "uuid": "a3313b14-2fa4-48e7-b839-4acb8c398994", "comment": "Malware payload", "value": "9b6ebd17dac2cb733b3ca0f2381902d9c27282a8ce46058174518dcdafa20c7a6d16f3be70d018618f29c06c461a269b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788688542, "uuid": "bc9706e3-fd8a-47e1-8814-7c7425c6d981", "value": "T182C27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACC618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788688542, "uuid": "262de7d8-f80c-46be-9ada-5acb83736c3b", "value": "768:08vCB+25j6es8Rh9FYpMSUpi+20qUpi+20YQX:08l25JXd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788688542, "uuid": "c8baa050-dda0-4a0d-8650-5fbd668a42c4", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788688542, "uuid": "024eccf8-7e82-4d4e-baa2-a21d95b32fcd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788688542, "uuid": "57e563bb-fba7-4425-ab14-42e13d9526b9", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98ea3565-aa46-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788735561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788735561, "uuid": "7a88992d-d76b-4852-b533-f60766d8e23a", "comment": "Malware payload", "value": "ba6e6307f89fa58ee8decc698d40062a", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788735561, "uuid": "208681f1-c6e2-4399-b3ed-e43c521d682f", "comment": "Malware payload", "value": "052f0caff530a67f9a17df5795806d9b01a551f309e434cd4eb92fba8e024051", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788735561, "uuid": "38c3d6d0-efd5-4238-8955-1abadb747eca", "comment": "Malware payload", "value": "d1edd21ab466c2d1ae4f0dc67432d1e839261a87", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788735561, "uuid": "c96fcd78-49b1-46f7-814b-5ba288167309", "comment": "Malware payload", "value": "afe84a3e7d88658ca524eefb32b4adff5c7a518748f6050f8aaf8fb273a64c95b6aba93d336bbd40e7b89ed79783d951", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788735561, "uuid": "afc71ab3-88ed-4c7b-9ba3-a05d35a529c9", "value": "T12E65F196FBD7EE61E38E0E3881732D4787E6D4251173E30A488B7AE44C9B72D5812397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788735561, "uuid": "c14a830c-7f35-4b08-a49f-dd96ca821144", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788735561, "uuid": "5db139dc-579a-4f93-9de2-296cb10517f1", "value": "24576:Xa+ZW0rXdUTT1y4eljhTIAqKfySMfk5/uWVKEzyC/1WoNJhvk:X/WMXdUxGvMkcE3/EoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788735561, "uuid": "c40fb73a-0c1c-490d-92f8-4613294542fe", "value": 1513472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788735561, "uuid": "e20e51d2-4c49-48cf-9e8b-c0286b64e94e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788735561, "uuid": "0c532843-86aa-47bd-b16d-6c74c99aa15f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0dee0d-a9c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1788677853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677853, "uuid": "8ee79e2c-31eb-45d3-b6ef-60ef712b1dfb", "comment": "Malware payload (SalatStealer)", "value": "1b3d053cbe1a1a4ea39653b85275692f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677853, "uuid": "5e317405-53c5-44ab-9cb3-c497c0f93da5", "comment": "Malware payload (SalatStealer)", "value": "05992bfebd646ab918b2e31f4cad23f0e0b7efabd5c1fae2ae40c8b48753f40d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677853, "uuid": "4fce0b59-bbc4-418e-82b6-82c8f1dadd2f", "comment": "Malware payload (SalatStealer)", "value": "6088355c3d6650e3a866011aad4b8a52e3b6658b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677853, "uuid": "450d5b0a-91c3-4bf1-8628-8834442b0a57", "comment": "Malware payload (SalatStealer)", "value": "3b8806dff2d6cca823d8b2686267b9448b918d5446fe621beffb1c369bb89518753669f9d1ab48e82f3195b6d428ded2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677853, "uuid": "716328ed-cc53-447b-b995-87f1613ab4d9", "value": "T11FF5332A88B252F7EA88D4F62FD98795AE21804D7D598707767B340857CF1F222FF244", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677853, "uuid": "ef9d7875-dfa0-4324-b570-4f54e7f0e0cd", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677853, "uuid": "822b2ee5-b720-47b5-9137-abc615da4098", "value": "49152:7LJSJiSXkRF8dGKYK3IoBSXdYsteiKofKVXYIq0qwMApr/jbmWMoi69ZcaOUBB3y:7NQiS0RFm4NX9teDGKVZqbw+jxaOUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788677853, "uuid": "d3b9576b-cac7-41f7-8813-ba303bfe7145", "value": 3594752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788677853, "uuid": "03519d92-72ed-4ff5-9bdb-1124170f3d51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677853, "uuid": "01715c90-9077-4148-92e2-9dc96b992d74", "value": "svhost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80a55d6-a9bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788675886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675886, "uuid": "4823b6e5-8b8c-4e49-b404-f8c191d60432", "comment": "Malware payload (Vidar)", "value": "792afc00955514d2943eec33bf29e52a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675886, "uuid": "c8f58053-8912-4d98-b51b-96b4009f43ba", "comment": "Malware payload (Vidar)", "value": "062fd539241bef0b0c6f5f87fe80b966e86a1e9719840b886edf653c143757d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675886, "uuid": "fd3932e1-76e4-4207-9563-885633b42298", "comment": "Malware payload (Vidar)", "value": "d6f0d168e31dab06479bea5674c037852c4b552a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675886, "uuid": "0004092f-f4d6-4a43-bc71-f593319f6bcb", "comment": "Malware payload (Vidar)", "value": "476fb7b8a241d49f0b36abd3aa510d648b5fa451b7ea1b8cec9cfec1f8b6d14a005120baf46751f652f5d1a82d67eb7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675886, "uuid": "c6151b92-660e-4a62-aebf-df4a5f6697b4", "value": "T1D7283343FC9144A5C47AD67A896A8262F7F4BC080F3077E77E50B6642E77BE0613A718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675886, "uuid": "9615f34a-12a3-42ba-ad44-b5701eb8c0e3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675886, "uuid": "794bb9f7-f1bd-48ab-90a0-7fddeb4c1a89", "value": "1572864:4/QMw+5Ec0HF5m7FGRw6S82IYTCN3WltL6CZq0sFIYjVRRPwu:iQlYEc0HCZoJxN3WXOIqjFHjV7Pv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788675886, "uuid": "e76bd146-14d2-40bc-a51f-fd02350c8ca2", "value": 94802288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788675886, "uuid": "5e0be6e6-3cdd-432d-a0f3-b200d43647a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675886, "uuid": "45a3e42a-8f20-4ab7-b772-7957f2756d0d", "value": "062fd539241bef0b0c6f5f87fe80b966e86a1e9719840b886edf653c143757d4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07513cf8-aa19-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788715989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715989, "uuid": "789b78c8-2867-4e54-84bb-57ba26ef2591", "comment": "Malware payload (Vidar)", "value": "597618cef3022033ea5be02c28d87d38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715989, "uuid": "46ea936d-b03e-4bd6-8011-93fa8dda4f98", "comment": "Malware payload (Vidar)", "value": "06be5f821fe31defac011cdb7291067a561674ad7e8c3d6f25a25e1d7752952e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715989, "uuid": "c36b2d1d-01c2-4adb-9ee7-a36954560046", "comment": "Malware payload (Vidar)", "value": "40de9bee615450e2b6018774725d7238bffff192", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715989, "uuid": "c7f62156-69c2-4485-bc8a-3826091ce531", "comment": "Malware payload (Vidar)", "value": "8ecba73eda16ff80745451c19e4a382d4fc247e48c134dc683931adf242cb0966420446f6ad1f7116641d62577fc8ea3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715989, "uuid": "da2fd678-2d77-4392-a8a6-525ae37a5b0c", "value": "T13C266B43BC8548D9C06AD63A85A68262FAF5BC140B3573E32E517A743F3B7E0563DB18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715989, "uuid": "79d65067-bd30-4c26-b572-5601928b47de", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715989, "uuid": "b0d86535-8632-4c23-af28-af486ec4ab9b", "value": "49152:rGpuWyGJb4w9mxY05a7qeqZw3NfiVSDnyH9tNN5z9CrESSi8L0DnaHOVyj3d9n:rGdhIVSDnyH9tNTz98ES7DnuOUtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788715989, "uuid": "2f9f6b3b-7919-44ee-b7e0-54a32639140d", "value": 4619120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788715989, "uuid": "157119f1-d078-4243-9757-f947faf67dde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715989, "uuid": "c2398a84-51f7-4f19-8fa4-6427624427ca", "value": "06be5f821fe31defac011cdb7291067a561674ad7e8c3d6f25a25e1d7752952e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83c6860-aa2d-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788724903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724903, "uuid": "416b10f9-9056-410d-951d-543d719e82ff", "comment": "Malware payload (AsyncRAT)", "value": "81e3fdbe1f9a1a72a5cda8223cee03ce", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724903, "uuid": "55c6e5b7-d114-4ac1-a7b5-95ed0e8609b5", "comment": "Malware payload (AsyncRAT)", "value": "0862cc6ab1a0bd821b1b00fda8002d56d91f2979613505a88e142133240f8d27", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724903, "uuid": "98abd6a0-ab9d-4c61-976c-df5976188b0f", "comment": "Malware payload (AsyncRAT)", "value": "ba6fd61f8796fcaa8df95dcb0e6ecef144ca3ff1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724903, "uuid": "f2225df4-44fa-4235-be38-96a6ca5a705c", "comment": "Malware payload (AsyncRAT)", "value": "19ed5247ac8f18306e6d86e19f70991a79a2b428c8147ca2b4436a12c5a11c542bd30179af2c22ae793cb4f9edea57b0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724903, "uuid": "59c95a2a-9142-48b1-a375-3ce40eaac4e1", "value": "T112232C003BE9822BF2BE5B789CF251458676F1A33603D64D1CC451DB5623FC69A42AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724903, "uuid": "fc39ec74-8a2b-480d-a66f-b399470d103e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724903, "uuid": "f3e6b523-27e7-4f8e-bcfd-647bf4627ba2", "value": "768:mu/dRTUo0HQbWUnmjSmo2qMmdSPvYiPIMzjbigX3cbSNA6H6qx6JuGBDZyx:mu/dRTUPE2idygrM3bFXsuNA6H6d9dyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788724903, "uuid": "e1a8a7df-096f-4cd9-87ee-9a75bd4789e4", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788724903, "uuid": "0c31dbaa-7081-424b-be57-eb4e8b26c7a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724903, "uuid": "172f6f4f-46c8-4e77-ad10-6b1196e04819", "value": "SteelSeries.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed1e5b33-aa2a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788723676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723676, "uuid": "540482c4-d342-4a3c-a5b6-ff19d0bf7f71", "comment": "Malware payload", "value": "4eeed8ea208a8af0127f5ab68301b760", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723676, "uuid": "a9f7b210-6a49-4fa0-978c-c26de0b2bc53", "comment": "Malware payload", "value": "090c3e1b2949f165b5e3a4fc3afbd2ba1225ee13a9e5143b1729843dee86d057", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723676, "uuid": "155c215a-144c-453d-966d-3e3a7d1635e6", "comment": "Malware payload", "value": "49d022d3942ee2531f7368cc01a2e4ddb7d016e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723676, "uuid": "068e38aa-0fff-4a14-9f7c-4629b0cf9661", "comment": "Malware payload", "value": "ce2fc8e49756b9b2e2bdf2444da2fe60f887b3206022eb0d0b9ccf243e652f64117e39854a29aa0a02e1db211728262a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723676, "uuid": "6b85e243-656d-49c5-a653-d88ca4474a2e", "value": "T15FC48E30B2D54D3BC7DF097E187C0A6DBC7058C78252E9085959B6FA9A01B6097BCBF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723676, "uuid": "47bedb63-9ab4-4303-b0cc-c177423d8de4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723676, "uuid": "1ba9ba7a-e19e-4856-a94b-4bffee08f0ba", "value": "6144:bLlp4KmmxUs7Qmk6+WiX6P9bEcGbQFfELc2wKvS6Xa1lTJNwibWmKSbizhbYL61t:bD4c7QKWfMSGwkWYE5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788723676, "uuid": "798b7ef2-9e3b-4765-9433-63ace1486a6c", "value": 588288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788723676, "uuid": "df356976-51ff-4932-b822-43de9ac5e0d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723676, "uuid": "6389c02a-02d6-4f0b-912b-c6efeafd7fa5", "value": "client_build_3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "239012b5-aa19-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788716037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716037, "uuid": "9260aa1a-b2c5-4fe3-b409-dcc81a19d649", "comment": "Malware payload (Mirai)", "value": "359231b6a88b5479908666c03d55170d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716037, "uuid": "099c31b9-dada-4f2d-904e-c1310efd1d5f", "comment": "Malware payload (Mirai)", "value": "0b75ef53651b44999ec9bd022dc1f93c9ffd0b1b47cdd33ceb9cb5c2117fd74c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716037, "uuid": "882be8a4-49d1-461a-a581-39613fd7f700", "comment": "Malware payload (Mirai)", "value": "49aae17cd813b7a9e57633b001e9587be1027513", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716037, "uuid": "349b8ecd-24ec-4f55-8ca3-acfc05caae4e", "comment": "Malware payload (Mirai)", "value": "120eef373cb7227908627b45e23526e7e6a27d961aab9dfd8e6700fd2640e2bc3e10dda20079da13e67ea875eb75fcf7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716037, "uuid": "8dd68c2f-4bd6-45c6-8984-ac18251a1982", "value": "T1FAA35EDAF401EE7DF80BD5BA04670A0AF970E3A51B930F366397BD57EC351A50826E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716037, "uuid": "cb34ec23-964d-4e18-afcf-6e5296da97c2", "value": "1536:iPplp9csAJjgaKfLZ/lx8LhHwR/rtAufDaiwBwZ75Um494:ixesMsa6/lwq/hz7Z75Um494", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788716037, "uuid": "b961a332-b5d2-4b5b-8551-c4f853842961", "value": 106764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788716037, "uuid": "3aaf34e6-5501-4540-8eb5-48dfb30fc67d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716037, "uuid": "2a5035c1-2c7f-48cb-9875-b08268823261", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2cbea33-aa20-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788719310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719310, "uuid": "df71092f-d880-4175-860d-de9606af2b31", "comment": "Malware payload (Mirai)", "value": "1f87f1b32738658430b932226bb3e2c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719310, "uuid": "b9bbbaeb-09dd-43af-a6ea-1a134c0aed21", "comment": "Malware payload (Mirai)", "value": "0b98136afa6ba669417bd03c99bb34a37bcda97dc491dfde61236a4e08f7b614", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719310, "uuid": "4c937bc5-e870-4aec-a7b7-ac9cb0822d8a", "comment": "Malware payload (Mirai)", "value": "d134f1e38803c88b5e2e5a76f2fb9ea1f83f189b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719310, "uuid": "5c143e6d-2e0c-4ff6-9977-7e17c0e99761", "comment": "Malware payload (Mirai)", "value": "e8fbe188f19c002b0e9c021ecedcdfa46108d45f831f6cd07bc9edb0af01ac1a17c15bcb372df82da7bba4e46d93ebcb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719310, "uuid": "b6842650-f19f-45c7-a764-1713bf9cc3ea", "value": "T165145A05FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719310, "uuid": "5245e090-c995-4267-bb27-5f219a9970b5", "value": "3072:ESZAGIiEgACYrerYqlNSwppHaecY4NXDUaN:HZ15BTYCrYq1QDY6A4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788719310, "uuid": "1cc4f637-003b-4ccd-9ac6-910a55d58a88", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788719310, "uuid": "4951fd4f-a37f-4d1a-bdd8-d5b306d3ba0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719310, "uuid": "7634dfc3-5449-4360-95af-6bcba7bdbad6", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e3af04-aa20-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788719254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719254, "uuid": "10857c8c-0771-4eed-8293-5966f909f9be", "comment": "Malware payload (Mirai)", "value": "299cdcce8a0e93082a9d556c7b23b1ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719254, "uuid": "61086dfe-d5c4-491d-8f07-708a2187269c", "comment": "Malware payload (Mirai)", "value": "0d2d323daed7016259c277018bd66b059e3da73fdd939d79ce7854840629b006", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719254, "uuid": "1b84d603-b6bd-4897-9004-bf10cc07f577", "comment": "Malware payload (Mirai)", "value": "07870abfa3ad69fae6d4d5ddaee26e2c8eae5401", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719254, "uuid": "e5ffdfd8-771e-4cd2-9c97-3b5adf710032", "comment": "Malware payload (Mirai)", "value": "1ddc4956d4add001b6abb71763478ac616c4dc6ff2d6990f598e30a60b5cd6aabfdee73aad09b1e216c672046962518b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719254, "uuid": "1937e94f-76e4-4f47-9f3b-1fe9396e63c4", "value": "T1F2147120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719254, "uuid": "a696367c-964c-4278-a6fc-246d7bb63f09", "value": "3072:IcHZcggt1NJmeDQBwnKUDMaVsb3pjr1lCRGUKG:IcY5JpMByVs9jSdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788719254, "uuid": "25a6a05e-ce84-43cb-8375-c456e0a12fda", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788719254, "uuid": "0c8c9f9a-7dea-4086-981e-e72323f57c92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719254, "uuid": "72726f2f-a903-4ba6-84bb-ca10963aebbc", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6077895e-aa03-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1788706690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788706690, "uuid": "1425a0a2-6209-42a2-9a4f-416f81e3feb6", "comment": "Malware payload (CoinMiner)", "value": "601026270822dd6a5a2e38b0d8b4d18d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788706690, "uuid": "4f628423-48b8-46f8-b029-8d6b65bcb6ab", "comment": "Malware payload (CoinMiner)", "value": "0e35981829117eb1a12523bcc94fa4602afdfad67cb99c28d3e573c5fe830a55", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788706690, "uuid": "387b282b-3108-4491-9bfc-1636923163d0", "comment": "Malware payload (CoinMiner)", "value": "a1746cc916c0ea36ad56ba38927b17cff01f2ba7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788706690, "uuid": "0212e731-7c7a-49dd-9432-a162d8906106", "comment": "Malware payload (CoinMiner)", "value": "0909834752cdf5ad54f63b0e61a40b19c180559e8b10fd48a0a9a666b79e4ea77756d9991a3e6f0f96ef04a0a84f6cb5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788706690, "uuid": "332fc796-29b5-4b33-b7ae-36a1e089a7a1", "value": "T14E3633C97DDA89B0D056C7B8419360BDF23D7BAA8461FC5336CD35019E96E28623F788", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788706690, "uuid": "5713a03a-d2f1-40a6-ac34-2f33fa353034", "value": "949ec789a5933fb6051c9013a550fb57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788706690, "uuid": "3dbb53b1-1331-4039-bbf2-c855811e03cc", "value": "98304:e0+bC6P6SOT6Z/zYRRU4JaAf0kUn6lC158PzaP:V+bC6P6L4/zYRRU4JaAf036lCiz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788706690, "uuid": "f5a3c5fd-4fcf-4ded-8d61-b6057f4f6ff6", "value": 5296640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788706690, "uuid": "e7ed2ff7-43ff-446e-a859-7d10d1c2f765", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788706690, "uuid": "548452ba-11ba-4248-802d-58509118c21c", "value": "0e35981829117eb1a12523bcc94fa4602afdfad67cb99c28d3e573c5fe830a55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d8ca8a-a9f7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788701631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788701631, "uuid": "2dbccc34-c27c-48fc-bcbc-4d318f48a2cc", "comment": "Malware payload", "value": "7e0b9b9e98bb25f811f0d5dcc676fd38", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "trickbox_v1_proxy", "colour": "#4D900C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788701631, "uuid": "2b750a47-ee4d-44a3-9e79-076e1cb64215", "comment": "Malware payload", "value": "0e44fecdbe8883d443b6b1323f871aec426a23b9eb62b3826682348814d55c28", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "trickbox_v1_proxy", "colour": "#4D900C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788701631, "uuid": "06b98ad0-a93e-416d-ac49-73c64d6065e9", "comment": "Malware payload", "value": "507bea94ff9f291d3297f4b64bf97a17dbd76555", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "trickbox_v1_proxy", "colour": "#4D900C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788701631, "uuid": "124df6c1-c08e-4f9b-be5b-3aa93da7095f", "comment": "Malware payload", "value": "109e80703e67d5e54732003ffb1d4ba4e0519b8acc872b279480002b6ad7539c198b000ef502fd8929aeab830df726c8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "trickbox_v1_proxy", "colour": "#4D900C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788701631, "uuid": "4ab91547-70b6-489f-bdcf-5643b4fb5d2c", "value": "T13A24F21107685D2EF02F9774C293AD2BC0F25DB6DF0E960C918EB598BCB9F911305AAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788701631, "uuid": "b961baa1-20a5-41df-bf5c-2fd16c95d394", "value": "1536:qDeTTPknNuTT0Mjpd6Qv34TnBYkhAM9Q3o//Of+dYtqGjPH4Rm5CVFiCnfuIsusI:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788701631, "uuid": "b8c8eb2c-e3ed-411f-8a66-a5e5993cf8b0", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788701631, "uuid": "52df944f-a0aa-4c6f-b79d-c73dc68a73a5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788701631, "uuid": "817d1275-6db5-486d-b980-6c6b3be7ace3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ba70f1-aa4c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788737945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788737945, "uuid": "180c59f0-f2c6-4e90-9270-2a5252f31784", "comment": "Malware payload", "value": "1b91d6c726fa93a3ad6e7bbd75452245", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788737945, "uuid": "0f0c82e9-20ff-49fe-ba4e-209db29787d8", "comment": "Malware payload", "value": "0e52dc105f01854254ee865a31af4b79f701c9437ca7591d979e60ade6d6cf2f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788737945, "uuid": "350defaf-425b-4193-8b9c-8c68efbc077b", "comment": "Malware payload", "value": "70ce994b8d1519c9a6e9f96b012d82a583050b74", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788737945, "uuid": "8081e9a6-50df-4c1d-b50e-83955f61175e", "comment": "Malware payload", "value": "8d4aec7c8f06f5e19501e3d04d58ce75fed32ae29007226536941389334dcebad7c436bdef85695db8e2a435074b07da", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788737945, "uuid": "12d41c69-d951-44ae-94be-9437bec1adf3", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788737945, "uuid": "99c22007-7230-4741-8994-f2cf7db09eae", "value": "3:UtRwgyKwajZg/4kn:SRwgKQZgr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788737945, "uuid": "e9528983-bd1f-447d-bc1e-12f4ea7c6e29", "value": 42, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788737945, "uuid": "3ffccc0a-4fe4-4c89-80c5-1275473fd8b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788737945, "uuid": "241f9d83-b67e-4ba0-8fcc-77eb53035e90", "value": "PrmUx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f35f8e-aa1f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718589, "uuid": "694fdb2f-5e4c-435a-a8bf-836665b0eb33", "comment": "Malware payload (Mirai)", "value": "225f1a46144fd167fdf6fe146c1de499", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718589, "uuid": "5aa32cb3-5750-4530-a0a0-aa575efb70b0", "comment": "Malware payload (Mirai)", "value": "13bf024897c8e18a39fc5a93e670ec3c6431bbf9a82cfbb951e9bce5aecd81d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718589, "uuid": "410f487c-c650-47f6-aaa4-1ac9317d30cf", "comment": "Malware payload (Mirai)", "value": "4ef17a6a9a6a21d744fb521e4d74256d0295819f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718589, "uuid": "c62d57b0-2338-4a8a-a7e8-ee77660ae36b", "comment": "Malware payload (Mirai)", "value": "c3b2d8347e5d62bd174926313c1012afe10dbed2366bf543a7d96816d1fd0cfb7720b3cd36eca46332c8a8fe686f7bbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718589, "uuid": "cb5eca2a-f24d-4e26-bc4a-1edb1b2385c6", "value": "T115345C8B37A18F91D374C93047F74B97AABA219212E286C9D36DDD413E5438C681FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718589, "uuid": "90af67fc-b604-409f-a18b-813f3b7b8965", "value": "6144:cYoz09Yn43BxS+AwnUQ/4BGpDQR1ykeKyo:cRg9Yn4zp1Da9yo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718589, "uuid": "e2d0b7ea-ba24-41b5-b9a8-98ebbefa4344", "value": 230376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718589, "uuid": "baf4db40-716b-4c55-af7b-95b11411f28c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718589, "uuid": "a8c7be19-968d-472f-9263-b4734600ac4d", "value": "wj0s.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f78fd4d4-a9c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1788681174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788681174, "uuid": "e52a803d-7134-45bf-8231-02e74ae8fd4f", "comment": "Malware payload (AgentTesla)", "value": "7c7008316099e4e9e324a3ab86d4a1b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788681174, "uuid": "00aec198-d570-4ae3-95ab-aeba6e2f4b57", "comment": "Malware payload (AgentTesla)", "value": "15a1c2c8a51a9418107310d1e6523d191a91ce443757fc8db930f19aa3d740ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788681174, "uuid": "042081e5-1ef1-48a6-83e0-cc95cecea49e", "comment": "Malware payload (AgentTesla)", "value": "2bf9fd1d06c69698e748aaa018f44c7286a2510c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788681174, "uuid": "8b1b64d4-b94e-45ed-8968-4ca80c725747", "comment": "Malware payload (AgentTesla)", "value": "003b61bd06c3aef768b628b5efec12d991281ad8e0bd0d616e1a7e30b690411f8446c8e6bcaed62063d356fa02490319", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788681174, "uuid": "c9789476-9985-426b-8602-6933bb881330", "value": "T1F9B412A04341E87AA3E6067DC09DEB477AE51487453CB6E98615E4E72C8CBCBE875F0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788681174, "uuid": "0dadf745-39f9-4dc3-ac6f-146c707c9280", "value": "12288:MiqosVlb3VZOGn9L652Lout7BPc/pBuuq:lqlTauY5KoeKul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788681174, "uuid": "fa971add-326b-4d30-b5da-dee0beb42843", "value": 506735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788681174, "uuid": "c58a3788-2781-4549-bc51-eb0b37cb701a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788681174, "uuid": "15cec6da-fbec-4c05-b781-4f61d5d2b201", "value": "Pedido PO6766.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbea8213-aa1e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718547, "uuid": "e5a4f04d-942b-4127-a683-9f8c49f22bbc", "comment": "Malware payload (Mirai)", "value": "16a292bc0ebe3b65bc6ed902c5c32395", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718547, "uuid": "cacba368-8dd7-41c3-8051-2bcee4bf3a0c", "comment": "Malware payload (Mirai)", "value": "15b28c78facb2a2e737e13e9a4ae5e68cc684f80516d1799613da45cb42b53e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718547, "uuid": "c6a375da-346c-43e4-9293-064165f67d38", "comment": "Malware payload (Mirai)", "value": "66ffbfd21e3e5b59e117eb231ca5b4408219470d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718547, "uuid": "130584e3-c211-4ee5-8e33-802ee2ae9d18", "comment": "Malware payload (Mirai)", "value": "70ffb2685f10d8031257ac45345284c75fb912c55f002c231d63bc6c27bff2ac594d355aba9f1acce578c0694d2cfe2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718547, "uuid": "c820e687-5411-4db2-9572-ee7d08479661", "value": "T1A3D33B95F880DE61C6D0297AFB6D5688331317B8C2DE71069D149F682BFB45B4F3EA02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718547, "uuid": "29d36815-c95d-42c3-a5ba-42b9ad8b671a", "value": "3072:rRR1qPOWT/e3PvuBoqe87zcfxRIZvxoK7KV:lHqPOWT/e3Ae87AfxK5xM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718547, "uuid": "6b2a4680-cb70-4d02-b715-4b6aabeef63e", "value": 136740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718547, "uuid": "d8114a19-96b6-40fb-8f0d-6587cdf0abf8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718547, "uuid": "fa9ab22e-370c-4056-89cc-6d033490a75f", "value": "wj0s.arm7-dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ac9bd7-aa2d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788724984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724984, "uuid": "3a40fab9-e30d-4522-898c-b0c91036a453", "comment": "Malware payload", "value": "c0fd6da8fff9769e0e8157e9c786e6f7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724984, "uuid": "f4d9100f-0b37-4dfb-b7ba-eca9329f9a42", "comment": "Malware payload", "value": "15dc0305186d2c1f9f63a147d7a462faaf090878b7b719fb612f6a99ceccf6dd", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724984, "uuid": "0bc06db2-fcca-4faf-b38c-3c2f6ea3e4a6", "comment": "Malware payload", "value": "4c13c69e9ed38cbf7eb3a09efa96af2e861964b8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724984, "uuid": "1535a759-15a9-4b8b-bc60-a96d00e5ab78", "comment": "Malware payload", "value": "0830645e821b3da33178b6588ab034e42b91eac1a786b814170cd1ead2018c8c802822c52541a60e967578553a27ca80", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724984, "uuid": "2c98dff1-2398-4b3a-b1e3-55cd523ef932", "value": "T1E1E6331753D873AB640F63AAA47BB744516FC643CAC30699B9E3A3172D1EF049F38618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724984, "uuid": "77547a2b-6bc9-4b70-b7bf-71dc31f665e6", "value": "393216:rw3fCijcZ7AZ72249UP9JFb1znyYFDvyb3fIIhRB:rw3fCijcSZnP9j1jyAKfIIh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788724984, "uuid": "8428c316-4dbf-425b-866b-9478d08f70df", "value": 14795580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788724984, "uuid": "16fa49bd-4a73-448a-98f3-9b7460befdcc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724984, "uuid": "58a0071d-2601-414c-9087-b299326bc234", "value": "qt_test_s8yhb.exe.upload.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f7c9c13-aa1f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718607, "uuid": "125c4624-3310-4ff6-b7f5-92fb514e4206", "comment": "Malware payload (Mirai)", "value": "c810d0e76da11f1e9c4d9b5efa93253b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718607, "uuid": "b05fb26b-b103-4580-b235-6678d6c5cb24", "comment": "Malware payload (Mirai)", "value": "15f64302169f0e76cc01d59a0ce737c467d27dbb457ea510e69b1db42fb2e0b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718607, "uuid": "4ca8c608-24db-425a-9133-7fc5a5e6a5a9", "comment": "Malware payload (Mirai)", "value": "c95dd8ec51dab051267b268fb0f128b8ae607a10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718607, "uuid": "2ac65e9b-a135-4e79-8fda-32a985e7c7ea", "comment": "Malware payload (Mirai)", "value": "f9ba942d7d7c92d8dd63cde38dee4848dcc3cb662a07e278412c43da5bf0658c2709fb93948e611d1b875e8f03c9b603", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718607, "uuid": "fe299641-0a00-44e0-968e-68a5187494b8", "value": "T1FB34398ADEA40FDBC46FCD70071F835716ED69AA92F463BB817CCD48718E58906E3858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718607, "uuid": "16fde0ce-7b6b-439c-a1c7-99f295409686", "value": "3072:9cBXipgJ8k9+4fMnfv9vKhLTfMn8afj6HVtB1etvT47ha2:9cBypgJ49vKhLTfMJfGHLB+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718607, "uuid": "7e4b0f1d-3666-4143-8909-2e088f591c9e", "value": 230376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718607, "uuid": "fcd8a984-c4f9-4be9-acc3-2dcf8782f586", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718607, "uuid": "1c17b577-bf44-40ad-8f4f-5d0c2df79704", "value": "wj0s.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd38bd3-aa1e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718550, "uuid": "b5cb7570-7f14-4636-9028-a346f22a218b", "comment": "Malware payload (Mirai)", "value": "56ecc0b32961ba4061934c179b0567be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718550, "uuid": "71d4f1d5-50c6-4497-9e76-d46ca96aff9c", "comment": "Malware payload (Mirai)", "value": "176265f23e6c6edeabd418957db040d269a0d339f40dee3b0536c498668bfc41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718550, "uuid": "9263fff2-7df3-4e2c-a27d-6079419e682f", "comment": "Malware payload (Mirai)", "value": "df9cb656486a9009cbca9c65203a18b202fe7518", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718550, "uuid": "aa3d439b-3ee7-4972-888b-396131ef9e8e", "comment": "Malware payload (Mirai)", "value": "52fe76c4c05a05baaa1528bb667480430f2ded16ee4238c0714bf56c3ea5fe29c835681fc40a5742c7c38e5140aa3671", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718550, "uuid": "57dc099e-e975-4a82-acc5-d283894da4af", "value": "T142E35B07E6D3E2B1E5730470231BAB6A5931B6301312C8DEF7702BB5DDB5A45821E7AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718550, "uuid": "3b2b9621-3cdd-4d08-bcbc-a97bcb9d683f", "value": "3072:VGa0V/9qvzvsYNESBzJthw64FWvaI6SQi5t6TAKad07Ul:VGa0V/9qvLsYNEpeJpeaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718550, "uuid": "9274bc74-ba6c-440d-95b7-b8ca33a0cecf", "value": 157004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718550, "uuid": "705aad17-84cf-4c49-a774-d17e4c3bdd53", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718550, "uuid": "c52aeee9-42cd-42f7-bb5f-b18728942a59", "value": "wj0s.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e08c51-aa1f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718557, "uuid": "2e695de8-17db-4c76-9f4d-a1297001640b", "comment": "Malware payload (Mirai)", "value": "851d52ef23189cf0f7f3e32dcc031350", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718557, "uuid": "7446c2bb-8e80-40b6-9656-cb687c3c59d8", "comment": "Malware payload (Mirai)", "value": "178f68795f446c3df552e069b320340a30291a6e567a0b95ad2af71bae8cf6d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718557, "uuid": "1cc5ff8b-fbc9-44f8-9581-412f6bd20865", "comment": "Malware payload (Mirai)", "value": "44d96e835b6b2b4dd682d842457439134dc20c52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718557, "uuid": "d08b742f-d5ab-4521-97dc-911c0a3e316e", "comment": "Malware payload (Mirai)", "value": "05079dc3a499c75edc1234686483c1582a5cc5412bce292869db1c8e30663305b82a74f69f371f5de47ece0b312db66e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718557, "uuid": "e08d15c4-98a5-4b73-bd9f-08932c71b12a", "value": "T144E4BF87F6785DF6C5298B711CFAC238075ED293132B7541BA6D42102A3B66AFE4F720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718557, "uuid": "11f96bfc-ece5-4da3-bd96-aa598ffcda5e", "value": "12288:wy4mQAwW9j6ZzEa187IPmvrYjkC/qRZjpYsIhRGgXemrDj0hPRyeN1gW1W+hHWpo:4zEb7IuofP9hW1W0HWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718557, "uuid": "c0e187ad-2853-4922-a30a-313bee74393f", "value": 707624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718557, "uuid": "44cff919-5e92-4085-904f-535c636f7da7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718557, "uuid": "69ca8322-6cd6-4f4b-8951-80c7af5c0d62", "value": "mirai.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e44c5ff-a9bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1788677588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677588, "uuid": "2555fd36-6d67-4578-a115-42b03c91aa2e", "comment": "Malware payload (SalatStealer)", "value": "71e1be9d01ac218c33906be2e769d2cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677588, "uuid": "5d50c01e-5854-411e-a8a1-2a7cecf55d06", "comment": "Malware payload (SalatStealer)", "value": "17fc7998513f489189f32ea0696e820777280e20893995fac676d66c16f345cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677588, "uuid": "23b1080f-00bc-4952-9487-a8ec4d69b632", "comment": "Malware payload (SalatStealer)", "value": "78d04bcd1a0f4055a75ced86b4517a9907edd5a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677588, "uuid": "f731f157-1cb1-401f-907b-85821cc970ec", "comment": "Malware payload (SalatStealer)", "value": "e9e7cacec85109bc37629d02328ec010500e488a5ce1f6c2954e4449ad813b07f7475df80b6d0b2e4562b52e448c59f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677588, "uuid": "038087fc-3da5-4545-acd2-7597d3a648db", "value": "T1EEF53332CE0D4893F80BE7B735675AF1C7E88A3CB951A82419EF971426E0D8547D26B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677588, "uuid": "9c133ef3-744b-4f6c-8ae5-9cd7f74941ba", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677588, "uuid": "f76b02f6-4389-4799-b49c-88844b75ca72", "value": "98304:briHTKk/u/U+m8xzP/V3DJUp/NZUgQwm:qQUADV3DiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788677588, "uuid": "065a401d-2fbe-4917-81c7-b6a8186cea3d", "value": 3586048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788677588, "uuid": "a75ef395-c500-4d49-9115-32051b187cfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677588, "uuid": "ab27b98b-c0f2-41f1-a288-faf153c8f6cf", "value": "Everything.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f95dde9e-aa1e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718543, "uuid": "bf2c5d55-754a-4bdc-abce-f857c76d7330", "comment": "Malware payload (Mirai)", "value": "24d2c237e05f7a31047baa203dd4d1a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718543, "uuid": "84dfc4e5-2802-45c4-8b4d-1f4de1426d20", "comment": "Malware payload (Mirai)", "value": "18895f288ba63f8b2c741a151deea52fb6ceb1b2f2f4a8fe4ff368350557aa6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718543, "uuid": "38a47cbd-59f3-4e4b-86d3-2d0ce1d579b2", "comment": "Malware payload (Mirai)", "value": "a233fc03943d4a7c85fddae4522e15efd03bfe40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718543, "uuid": "ef6fdda0-44da-4f52-8f31-5e524c21ee85", "comment": "Malware payload (Mirai)", "value": "d0e491b5f7ddf153cbb51159c353557512105ef5626442c78cffb8e8de311100a1ca56b5aa7929e7a72934780a04d6f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718543, "uuid": "1eb3981d-91a9-4f68-8e6e-33dcdf8da043", "value": "T1C46302456B68944BCCDCB0F95B418F09D90A293DBF77E48F364107FCCEEB54AA806A54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718543, "uuid": "144938bc-4dfd-47f9-a422-49eb0930ca99", "value": "1536:L33WFLA/HT8ysjRBlIxa6bhsOr33RI5p3IstGF8SOQ4:ykzDsj5I7VssRitIsoFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718543, "uuid": "4301d4fa-4d91-4dd7-ab0e-106f2806f3d6", "value": 70328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718543, "uuid": "70e58877-a242-41c4-8f37-988f489ff6bd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718543, "uuid": "f5d47533-ea24-4515-a2e6-31d0ee922293", "value": "wj0s.arm64-dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a135d1-aa18-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788715958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715958, "uuid": "eff041f1-c3ad-4521-b56b-c2f183b035f6", "comment": "Malware payload (Vidar)", "value": "d6fc14707bd7e5d8928e2e4bed51c3f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715958, "uuid": "0deb7beb-cc61-466a-9aab-50c2c724805f", "comment": "Malware payload (Vidar)", "value": "193a701137e6b5017025440bde8b447d01dd7f0132d5aa7f23c9c96f79fe442f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715958, "uuid": "476e2bea-ceb2-4e55-ac2f-3018606ff906", "comment": "Malware payload (Vidar)", "value": "710ed1f18a0fa053771e875c6022b00a415eb8f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715958, "uuid": "3a28aabe-5924-4cfb-9773-5078c3217436", "comment": "Malware payload (Vidar)", "value": "c6ee2624bffb01bb270afd2a386cbb9a932a5105018e5c1a1497c7e3c1e463be6e1d74d968646c7c2532041efcbdaada", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715958, "uuid": "b18623fb-6b36-4a17-b9d2-393d89e10fae", "value": "T13F268C07BDE149A4C4AAD73288A602117B39FC1F873633E72E616A367E337D18A75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715958, "uuid": "fb3bc875-3e57-4505-8caa-42271667afc9", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715958, "uuid": "c5502b94-6811-4949-8383-19a24cdf0ebf", "value": "49152:3/WCqgxzy09L5ZkTAjQYihOfJOjmC9sQDFRTAF6RQqjUGznsqLsrY33VqwhWbRsY:3/tXfL5AmosCN6R2Rue0yl1fg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788715958, "uuid": "76d2933e-79c5-49e7-bec1-3f5931bbcb85", "value": 4440560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788715958, "uuid": "360bc831-cb62-4b68-a2f7-d0eb95ece70e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715958, "uuid": "b923ea4e-7b1f-46a6-981c-50b20f73c129", "value": "193a701137e6b5017025440bde8b447d01dd7f0132d5aa7f23c9c96f79fe442f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b17df6f9-aa35-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788728301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788728301, "uuid": "9fcc0b18-7c6a-4aad-aae4-b4944f0a953c", "comment": "Malware payload (Mirai)", "value": "227610692ac10207de5963b17c9bbf3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788728301, "uuid": "3873f82d-e865-44c9-aacd-9b9954976cd1", "comment": "Malware payload (Mirai)", "value": "194f9a024339c321343fe1f96d91335308b7fe4f41bb3bd875cdfc3e8fc149ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788728301, "uuid": "07043c53-5cb1-46df-9757-68caf24bc9ad", "comment": "Malware payload (Mirai)", "value": "4b0e17ad2b2d234610790d9aa2c38d0dee82dbb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788728301, "uuid": "ae9108e3-9a1e-4122-849d-5b87284b90ca", "comment": "Malware payload (Mirai)", "value": "c1e5b67aff607203b2a84ab64f092ed8dfd897b96c1950673d2f6c6ead49e5fbff9f7f62983343f5a587625288864240", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788728301, "uuid": "ccf49bc1-7f69-48ad-ad3c-67c82c460c5c", "value": "T1E0C31B40FD548767C3D227B6F78E439D3B365A64A7DB331169247EB42F81B982E39220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788728301, "uuid": "6a4cd76e-d518-4de4-9dee-c690caa01e85", "value": "3072:BGTfykVEhYlknuxEVc14z4+h2gVAN4L8cKz1wnwE+dRVL6Ndm/rOn+vEmZ9TQ3dN:W+WbhbdXL6dmKVmZ9TQ3dxj5B6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788728301, "uuid": "7386459d-f9d8-4391-889e-d8c20d25f976", "value": 121269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788728301, "uuid": "7e2e1242-7b8e-46b9-9c66-b3c9018d5070", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788728301, "uuid": "7f5540cf-2a5b-40f1-979e-6c692c44846c", "value": "194f9a024339c321343fe1f96d91335308b7fe4f41bb3bd875cdfc3e8fc149ff.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42628ab-aa1e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718534, "uuid": "4061cdc4-8b5c-4ba1-90e9-132f1d7d6ba8", "comment": "Malware payload (Mirai)", "value": "63da89b437a9e4250fcbf893d85642d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718534, "uuid": "59a1a9b7-3876-4bc0-99f9-66dff132e2b7", "comment": "Malware payload (Mirai)", "value": "199e0b0744c2dade72f2846700f4ec5c949f8484e6307fee942f50b459879010", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718534, "uuid": "53276e61-95b0-4858-be8e-645be2c98ec3", "comment": "Malware payload (Mirai)", "value": "6339ff546e63fc06e915ba5296fd373aab0067e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718534, "uuid": "3b383e51-c394-4199-b5ff-0b12a3a4c76c", "comment": "Malware payload (Mirai)", "value": "3bddb8fe4cb0375e3008c36fb9619c5f4cda5a055f64f80914efd9010048531b107ec706cee911c2f0e79ede3933b314", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718534, "uuid": "c18d3372-0828-4797-aa60-6d84f0a13a06", "value": "T1B8E32965F880DF22C6D0297AFB6D568833131BB8C3D97102DD159F742BEB95A0E3E906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718534, "uuid": "76a44c4e-c043-4e8d-a560-6b7e0146f133", "value": "3072:Z7Jm/F0iqU8sOtYyu3uXZqheu5o7bpVCVcGqTSuoK7KV:h8/F0iq/swkuJuiXpVectfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718534, "uuid": "fdbf879d-9962-40f2-9f21-0dbc5ceca8a4", "value": 144928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718534, "uuid": "f5862acd-6f94-4d24-ae03-6cdb12aad431", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718534, "uuid": "eb3da7ec-01f8-49cb-aea7-750f7d5119bf", "value": "wj0s.arm-dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff5811f-aa1f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718581, "uuid": "ace78e7c-ade8-42e9-b30f-cee0059f21bb", "comment": "Malware payload (Mirai)", "value": "a2e57a5bfee4dbadd38b8ad78b88c590", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718581, "uuid": "c1632be2-9d9b-49b6-8e20-362486b67a27", "comment": "Malware payload (Mirai)", "value": "19f14c71d69e6c4453e22c342f9da6b81073f4ae84f2611839cbfdc30fe2defd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718581, "uuid": "b5a5651f-b85f-46ef-8fe9-f07b0232e635", "comment": "Malware payload (Mirai)", "value": "8ec299198c7382bc6c91bf5fb5d3fec2bbf87df4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718581, "uuid": "c6112a6f-4800-4737-8f4e-0f94faeb3c3f", "comment": "Malware payload (Mirai)", "value": "1f4dd67f413a3dd99179dc7eac6a346d9a397a01bb0060108f417a8886ec1395f3c833910c44dd7e9b7e2998477c775f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718581, "uuid": "2cb983d2-c8f2-49f9-a9f7-45babc0d432f", "value": "T1A8F32906A31C0643E1572DF43A3F57E183AF9A4124E8E644354FEE8A9772D32954BECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718581, "uuid": "d652c7df-868e-4893-beca-89f2a7df0197", "value": "3072:r0bdplNImlBN1OlBN1gDa0xd/MtxNA7ciliRVzrV46mSs8l:rrgMtxNA7ciERVvV4zHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718581, "uuid": "9d53040e-5a04-4d37-8c7b-adb1f932db61", "value": 158552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718581, "uuid": "5fc66296-eb84-4459-84d8-7e48f37e323d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718581, "uuid": "a899de54-d414-41b1-8097-38768c42da36", "value": "ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a06cf9fe-aa2e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788725266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725266, "uuid": "4a46f3b6-5379-4fa0-96e8-53047f24bac4", "comment": "Malware payload", "value": "9352bb40822133d79c2622c1101b060d", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725266, "uuid": "70205f27-8978-471a-9146-6edfd80559ed", "comment": "Malware payload", "value": "1ae6cb0cdcf57b0ea68a04c7b83892c00ed6f73594d8f0b5c5742a5fcbf9b009", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725266, "uuid": "af734df7-4ed1-4fc6-9ce0-99e0c0ee849e", "comment": "Malware payload", "value": "7fd0d983b5fdfb21592c621fb34d8fc127cac998", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725266, "uuid": "6c5ddc58-a07a-42b1-8d62-377acd3c02d6", "comment": "Malware payload", "value": "aac30956de0535768ea2f4ceffad81866c099fccd49e77303f5d2efafec6ed1344d60eb57fe7960c33c4cbb4b643bd7b", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725266, "uuid": "7cffe3ab-8256-4360-aee2-f1c9c79f82f1", "value": "T11CB59F1BA6A900FCD0A7C179CE074A17E77174091371AAEF06D08AAA1F27BE15F7E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725266, "uuid": "548e33af-cd26-49b2-88a5-289092c90c11", "value": "77fbfc5b6c1c876f8a1eba43f6966392", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725266, "uuid": "a6e46f2a-048a-4cb0-8b44-e459a982fabb", "value": "49152:8Ja5bpuBl6ew2T57cHQ9LYVCd0uXh9do5HipI:r8Xhw5HU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788725266, "uuid": "f1f4cd55-27fb-4434-b2da-8583a8ebdcb1", "value": 2417152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788725266, "uuid": "066772b7-972e-4447-a648-f767617aad3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725266, "uuid": "528652c0-29ca-4e7e-b8d2-ff83ae37678c", "value": "WinSystemHost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b91f1d-aa37-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788729113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788729113, "uuid": "4f108168-7250-4ccb-a172-b548da0e0c01", "comment": "Malware payload", "value": "33c424cfdedef3ea528b28c5c01fb32d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788729113, "uuid": "d7831b58-a802-441b-914d-a345cd4ba046", "comment": "Malware payload", "value": "1b11ac41a6d5dfb86512055953983daf30e4762adb61576cf55e47c02440dcf3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788729113, "uuid": "9cc962e0-914e-4599-a85f-2d6f2577d3ff", "comment": "Malware payload", "value": "49f91fc47c8e07f02316816232b48ede6ba3b38c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788729113, "uuid": "8c421e06-e55e-4c68-b71d-f2586b3ce9da", "comment": "Malware payload", "value": "f6d69add0b030eb80417f7e1d640a70b309697cf6b84c78734da32be9bdca7ddf98b701263d41823c332a44fcbbb507f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788729113, "uuid": "8ee59220-be95-467b-a51b-626a30c3ddca", "value": "T158C27D956A867C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C12FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788729113, "uuid": "40a13462-e907-4fa2-b455-d432ab3b1fe6", "value": "768:B8vCB+25j6es8RN9FYpMSUpi+20qUpi+20YQX:B8l25J7d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788729113, "uuid": "550f0ece-7b08-42a6-a009-4f931a14caae", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788729113, "uuid": "d7afc5bc-7612-487e-8b4f-e4f9cc7be9a1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788729113, "uuid": "228e6d4d-1357-493b-aa44-b18204cef16d", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df89f2f0-a9e4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788693589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693589, "uuid": "1f1daf6a-e90a-443f-9a14-614f95db9fca", "comment": "Malware payload (Vidar)", "value": "6d45d33d3f18dfcca02c03f8524ce730", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693589, "uuid": "3af2869c-3ba0-4691-abb9-b3bc03cca74e", "comment": "Malware payload (Vidar)", "value": "1d499bc065e3a7800ef403a7e28384d9f11db0ef3b261e9c2a508076117e67a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693589, "uuid": "42de6dc5-953e-4f4b-af69-524939fb3136", "comment": "Malware payload (Vidar)", "value": "4ecbede5a6ac8c4f61d94a2ff2ebc8ba66b91128", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693589, "uuid": "52d92c1d-68e1-46cf-908b-63e530b634f0", "comment": "Malware payload (Vidar)", "value": "cd9f4521c69140cdf8ab66d6c55287f80ba040e7dc12446ccccde2d3dfaad275194093c42c5f5b05a900c415990ab12b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693589, "uuid": "28e95a42-4b89-44f3-843b-4f81e33b7aae", "value": "T1BE28330729E950F8C05A8A75CA7B4265BA74BC98DB3473F32E50AA701F76BC27DB5700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693589, "uuid": "1e61c173-dd5f-4fbf-ba16-2052d3b5e85e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693589, "uuid": "3091077e-bb56-4bce-9f99-4a1bf5665a2d", "value": "1572864:NJinI8SXnYor323GqqVlO/Ua3qp0H0BIBJbDq85tqFDCx+T6R9F9e9dOA9RdkYTr:29S3r3Nqu0/UbK4CK+wdi1svLkYTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788693589, "uuid": "6a141671-bc5c-4c77-994c-56e0fbf1fb83", "value": 97845160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788693589, "uuid": "65ed034d-bee6-4970-8aa0-df912110bf03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693589, "uuid": "ec009113-4697-4dec-aea9-091df85f4a37", "value": "1d499bc065e3a7800ef403a7e28384d9f11db0ef3b261e9c2a508076117e67a8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6432d338-aa00-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788705408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705408, "uuid": "6f0283fe-668d-4f70-a52b-42184355da64", "comment": "Malware payload (AsyncRAT)", "value": "740a8ce378729a1d785f431f27cb5105", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705408, "uuid": "fd0006c2-4460-4a5a-b08c-ab5b56f5bd6f", "comment": "Malware payload (AsyncRAT)", "value": "1d73c7393399079a0e5b5c074a4064db42e3fe6d02a20ad38ccaed7433bc11a1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705408, "uuid": "83e547e8-506a-41b3-bec4-760aa88a7e9e", "comment": "Malware payload (AsyncRAT)", "value": "e7dc291dd3664e62ade82e5b09800c5099a83b28", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705408, "uuid": "da3cfb55-7113-4369-9094-65602eb66239", "comment": "Malware payload (AsyncRAT)", "value": "ea3b6cbefc771a8dd2a5e38942c8af58a2b187abd676fe8209c751c0d71675cf3838562aa0aaffb0b4894f2cac766bf3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705408, "uuid": "b700ad0a-f416-493f-bd40-d3dac6fa4934", "value": "T16DC23C0873E8C576D2FE06BA883385009775D55B9D13D75A6FC890AE2E23BCD8B14BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705408, "uuid": "2d1bd6e9-4e99-4af3-9b23-dfaedbc7cffe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705408, "uuid": "bcaa640e-e60e-43a7-a5cc-485ec4ad59bb", "value": "384:nBnoBYD2VxV+hbWy6OsVa/KFHbp0yH9qbuUscCbQxnCJfJBndnjJrKm7T+:nBnoB+g1VDHt0wIb1BBiBnam7T+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788705408, "uuid": "1047de62-4dfd-44dc-91f4-31cd3a55b778", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788705408, "uuid": "639f64ba-79f7-4816-89bb-700e8a349ef6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705408, "uuid": "73db0a81-a364-4489-a09a-20fb76a19c7b", "value": "AU88APP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d179602f-a9d4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788686693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788686693, "uuid": "b7a3a2bb-7247-4495-8547-e21f20edfd47", "comment": "Malware payload", "value": "a7ec1450944e45525124cd409021dd42", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788686693, "uuid": "f46f89ce-1e69-4138-b2b1-a27188aafb74", "comment": "Malware payload", "value": "1f697bff003f307c02bfa3b6ab53bd2632da609504e5fd2d5e4bd780f4743e49", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788686693, "uuid": "dae076ae-f06e-4309-bbf3-7e0b8592c08e", "comment": "Malware payload", "value": "2e6605672140a292ec475e441b156300a2d6a717", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788686693, "uuid": "24e7ed48-da2a-422f-bbe7-50cb11988230", "comment": "Malware payload", "value": "d51c9620633ee7785e3f453fba4ab40b1f6f7d0b69413748819fa15c505474535a8b0b89117e94523e2db8323d08279d", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788686693, "uuid": "1329fd72-0d91-4dfd-a6eb-eef30e2dfa01", "value": "T1D7183396FE25DC80C144C0BF65CD147659081FF829F8509A4C7DA8C4B8EBAC5FAE90BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788686693, "uuid": "ef374348-a375-4b03-8f26-b680bac87397", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788686693, "uuid": "13f6da0d-f37c-4b72-b7d2-5d75b2265219", "value": "1572864:GDgi8msE+HU7yPlQrrAqKaiADkg1entaL5AFpeuPcz:G0ikUuJqKUD6s1AjeIcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788686693, "uuid": "c18460a3-f2d8-45c7-987c-67fe99f7f3c2", "value": 92603596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788686693, "uuid": "37697344-ebf5-43b6-b4fb-a6b310d113ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788686693, "uuid": "7250c797-0b91-4783-a859-5bfa8a79a1dc", "value": "FHUOR 2 SAVE LOADER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243b2b05-aa19-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788716038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716038, "uuid": "aebf153e-1262-49cd-83e2-bf48b4c6934c", "comment": "Malware payload (Mirai)", "value": "9f584d810028511b3cd40661225319d3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716038, "uuid": "ae764098-f4f0-4ba6-a42d-5ed0388c3c30", "comment": "Malware payload (Mirai)", "value": "1f80879b9e749b3d5978cc1aab4dc2946765d0932a4a2b59d5574e31e8b7c349", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716038, "uuid": "abe150f5-f591-43e4-ba7d-9620bcb3706a", "comment": "Malware payload (Mirai)", "value": "1fa2b764d0791f7783099505731b8d69f8d5d189", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716038, "uuid": "c6fd54ce-73ef-4546-bd18-75c7283fe5ce", "comment": "Malware payload (Mirai)", "value": "1b6a3cf72ea24f2530b97ac5964fbbf6cf5e6f3a22f049e90886d2e35795a080bc0a21c27fdbd5913276a5b8735d0381", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716038, "uuid": "2d6d05f3-5e04-4379-a3f5-8f6c86e93291", "value": "T1C0357D2AF2B3B0BCD157C03043AFDBA2A835F47911212D7B36C496352D66DA01B69F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716038, "uuid": "27ed272d-e3f4-410f-8fcd-4b68e5def4dc", "value": "12288:RjfVTI/QQQYlme9M0HO5UkQlTneaRDeDsmyYbwApsCb5k:RjdTI/QQwe9M0HO5UZlbeaED5p1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788716038, "uuid": "40f980a4-31ec-47aa-b9e4-483ca1170c66", "value": 1070064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788716038, "uuid": "00500374-e930-4dfa-b65c-7c7597398419", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716038, "uuid": "e3ff4570-4243-419d-878d-f02f04e0559b", "value": "dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39d6759-a9eb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788696522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788696522, "uuid": "208ab4aa-0e82-491a-97f4-7f63cb279f1c", "comment": "Malware payload", "value": "d222afe664f660629026dbbec6cb80b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788696522, "uuid": "a82b1e92-9611-4bce-b3e9-b101ad4fa9ad", "comment": "Malware payload", "value": "1fe5e1dc3fee57d1ab3001ce6e9d2a83817a424a407026c2349cf6e7b1a194cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788696522, "uuid": "ddab5235-d457-4e13-b2c5-87e0f3fe87ad", "comment": "Malware payload", "value": "6980be3c367db6ec482d35814656788a3c0aade1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788696522, "uuid": "4740f1da-e5e6-45ae-b087-ea173a11d8cc", "comment": "Malware payload", "value": "d37e4a50c816528f3445a0945fd2c47d66480397c97b2298b985015defda8ce5c1d98eaa6be849eb72d01bbcd136f0a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788696522, "uuid": "74e94212-ec67-4779-b9fa-2e2cfb4855a0", "value": "T1C1D64A07EDA585E8C0A995348A769253BB31BC485B3133D72F60F7342F76BD06ABA344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788696522, "uuid": "357ba2df-46e1-4f60-9fbb-1ebc377013dc", "value": "98304:vNGIsfMbVOjzZvr/FoJ8+h4GSxISQyIH4e6H+HW/w7sWsRQfBp+KE9:vDbVQzZmSxISQyIYe6XY7sNC7Y9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788696522, "uuid": "89df2910-7c78-4271-8567-883a7f678949", "value": 12861624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788696522, "uuid": "1d602c58-f993-4dd2-9b96-74020df0eb12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788696522, "uuid": "4b8f5a6d-f6fc-4c57-98d9-cf7f4e978e28", "value": "1fe5e1dc3fee57d1ab3001ce6e9d2a83817a424a407026c2349cf6e7b1a194cb.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5096fe97-a9e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (MythStealer)", "timestamp": 1788692490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788692490, "uuid": "a260abe7-5b6a-49eb-8acc-4267c06c1625", "comment": "Malware payload (MythStealer)", "value": "239cc125f9fea33e08c9d1a741c8c650", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "fabric-mod", "colour": "#F363B9", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "MythStealer", "colour": "#562656", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788692490, "uuid": "52f20d40-5909-418b-b07f-040f506f2151", "comment": "Malware payload (MythStealer)", "value": "2003869ed68eaa053f63bf6a5093050f52d520da877c017a4f62658000bba2a3", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "fabric-mod", "colour": "#F363B9", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "MythStealer", "colour": "#562656", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788692490, "uuid": "c31b0550-498a-4707-8036-dca7230be47e", "comment": "Malware payload (MythStealer)", "value": "23818d2611fb74cab5baf824a45c274ec0b9a168", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "fabric-mod", "colour": "#F363B9", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "MythStealer", "colour": "#562656", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788692490, "uuid": "4a6c9ba6-d707-4ed5-b776-1e568fc429bc", "comment": "Malware payload (MythStealer)", "value": "c764309dd28ebb867731427177f97b9c3af497758cd9144bdff9f60cc9274d6b57d5e1e97c8129e515bea323159bac8a", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "fabric-mod", "colour": "#F363B9", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "MythStealer", "colour": "#562656", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788692490, "uuid": "51463c7c-b92c-44e2-bcf6-7a55149b8384", "value": "T111A2AE0FED817D38E0D25330964D9753FF3A78C4BAE9555821BA14271C0AE993FA938E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788692490, "uuid": "adedcf47-2587-4a6e-a373-5cd24f38915e", "value": "384:9YkTXWr1+p9QkgOp+rv/n85/yl7fbs7QPspanOafHYF+WkDkif:9YkjE1+cpr3nEyxHsMOa/YF+xkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788692490, "uuid": "c0c31b58-7e19-4e52-a6be-1718b61e72f9", "value": 21813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788692490, "uuid": "84160e8a-faf3-4e48-92a8-eff0dcc35c05", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788692490, "uuid": "f06340f1-8199-4100-a11e-7543c3d650a6", "value": "MythStealer.jar_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54526356-aa2d-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1788724709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724709, "uuid": "422c60da-bb52-41d2-8c96-fd207d37ea64", "comment": "Malware payload (SalatStealer)", "value": "b6291601663c7a8d748b1119985dd3aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724709, "uuid": "0fbec379-d827-4f5c-9af2-f42ba2b240a0", "comment": "Malware payload (SalatStealer)", "value": "2070e2483590dd3b6ccbe4339d29c095edbbc4cadd6b57dac3ec006ff76c7bbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724709, "uuid": "7636a9cc-2439-4491-93cf-8469db60a9c5", "comment": "Malware payload (SalatStealer)", "value": "4856b8991ee233bbbb68b87d664f9d89a2a3727f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724709, "uuid": "f93d4d34-6301-4692-af2d-7e3ca5f70648", "comment": "Malware payload (SalatStealer)", "value": "e26b5039ceb99df1b5b7426319a0bf66c10eaf8abfbccd76003e0f6ea0a89cc7ecac74f713648124429b0e0feb31e27e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724709, "uuid": "607bffb2-f74e-487d-ab4e-0870de8599c2", "value": "T1B5C65C11FACB54F6F9036831416BB27F23315D048B28DB9BEB583B6BF877691186A305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724709, "uuid": "80183e67-ea40-432f-ad16-17f48397575b", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724709, "uuid": "3db8476a-67f2-475a-a671-0d795adea243", "value": "98304:sGsqTIVri2C3jGdD4/Lobr4i3HVd7EqO/:hTx3jUDsirTeqO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788724709, "uuid": "7d3a4342-bc2d-44ad-a070-b157b390e0a2", "value": 12570112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788724709, "uuid": "92cbc5f9-3e88-49b0-8c13-6fab3a8264fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724709, "uuid": "1bbc41c5-d1af-4109-bcb2-33b2a447d050", "value": "RknNObhod.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ca9d3e-aa1c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788717428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788717428, "uuid": "9fac9512-6857-46be-84e4-7e66b332db1e", "comment": "Malware payload (Mirai)", "value": "0785ca098cf1cb1ed44945fddd7ce4ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788717428, "uuid": "a2e3447f-c4e6-4d2f-ab07-5325a7b8dc91", "comment": "Malware payload (Mirai)", "value": "213cfd0224543c31cd23627450226bb750bd069079b2b10e51ff341e7130eaac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788717428, "uuid": "21038bbc-89ed-4a35-9195-9d69bf67fba2", "comment": "Malware payload (Mirai)", "value": "2a62a386850af8d886bac9e1c6b80f653aac31ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788717428, "uuid": "3d21a966-406e-4044-ae6f-2a3bbfcb5b7b", "comment": "Malware payload (Mirai)", "value": "dae14a98879bb245010a70c91008f4ab447e1b7b7a2be63173dd66144ecb129b9162a9d3070e77fc6bb1b6f287b74e2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788717428, "uuid": "8ff3ba70-97d7-4bf9-a1d6-e04a435838a0", "value": "T134A35C2279721D2BC1D4A47961F70335F2BB879A217C8A1A7E710D8DBF796403253BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788717428, "uuid": "ca3b8cba-7fbb-4587-92d8-2494c3126d49", "value": "1536:/0tAvEXi19R9wW1BxgaSWR1vI+tbqLSrNM5+b1S1rcttdds5EWAv3D:ctCPgfQA+UL0N8ipcOW+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788717428, "uuid": "8569ae7b-686c-4c8a-83dc-893cd0111f0a", "value": 100108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788717428, "uuid": "0674d3c2-6d9b-4c0c-9051-4a4252df0c70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788717428, "uuid": "acc033b8-88ad-4112-9319-95cbae33076a", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5570621-a9e9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788695719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788695719, "uuid": "b594f06c-3b18-4610-a17e-3f66841bffd7", "comment": "Malware payload", "value": "8f5c3c30e9c85708fd2f90f801b49f1f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788695719, "uuid": "6e347681-e45b-4d2a-b1cb-e09eaac97a7d", "comment": "Malware payload", "value": "23d92f4795b49ee7a914aed7097b24514bf69ce0359c5a0985fa644ebb10c552", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788695719, "uuid": "c81754c8-7225-4bea-a198-5fa16c6aff7b", "comment": "Malware payload", "value": "80e9028be42c85fcdccebb25b742df5081e5aae6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788695719, "uuid": "c0aca74f-9036-4e73-95a3-c3a8ee0ec57e", "comment": "Malware payload", "value": "4e2debedbb92899c6e7a0ccafcadfda11c2f980ad77a0292d183fd1b6576edc8c36cf732e44203e5f7165974dc645640", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788695719, "uuid": "ed91c48a-a0fb-4279-9a07-4e0286e84f99", "value": "T1C0236D651A857C24AA98C4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5AA9DD10871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788695719, "uuid": "ad2e6306-1ee2-4af7-b3a3-f98061d91a1f", "value": "768:FXRWNGxVb9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:Plx6cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788695719, "uuid": "ab3cd695-112a-45b4-8f7a-6eec74ef2652", "value": 50079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788695719, "uuid": "f23863c0-6051-4c7b-843c-b328789999a1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788695719, "uuid": "c278c52a-7a40-4748-8f84-5c49d3f48704", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8610de6c-a9bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1788677547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677547, "uuid": "f85d91b2-d163-43de-a0fb-8109e729ebbc", "comment": "Malware payload (SalatStealer)", "value": "71edff493c8f6ae831d02f9a0c7ec64d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677547, "uuid": "a736bfd5-f62b-4a2e-bfa8-a49b4234a4ef", "comment": "Malware payload (SalatStealer)", "value": "241be5977da77e8b8b9a27bdb70e056a5e4b21f5fc72ce2934bba4aeebd3cce4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677547, "uuid": "c4bafc97-3309-4dc8-86b6-cac0c0793b5a", "comment": "Malware payload (SalatStealer)", "value": "793245c4196f57690c05b429f6917bf1cd584c92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677547, "uuid": "d86182ee-8355-4a88-89df-3f8d384252cf", "comment": "Malware payload (SalatStealer)", "value": "9f4507265fdd552700fc737b2a489001ca29541d31c9e3f54087d8c4b5e063d60650824ad76c48c1b5477c262a853b94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677547, "uuid": "b95ad831-0e30-485e-912c-c85787b4e871", "value": "T15EF5333AE79652A2EA2DC0F71515FBCF4F58E52356B3AB19691C8888E17933C0D80CDD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677547, "uuid": "fbe2deb2-92c4-46a1-b7d8-4c49a23b381d", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677547, "uuid": "671a6c63-2d52-4dfa-a827-c7ffb60e21b1", "value": "98304:jGaguM/ZErp89nUFQRXSexWRZ4U/VpwG:1guM/GaSFSn8RRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788677547, "uuid": "e60d12d2-70a4-404d-bd5f-bb3bcbbc1a01", "value": 3594752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788677547, "uuid": "04af441c-bc8f-4ccf-9b4d-ce5448d694fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677547, "uuid": "908b6b70-e4f4-4c2e-8b3d-f5f5a694c01b", "value": "Yougames.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8c6294-a9c0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788677961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677961, "uuid": "cbb7b71c-1577-4668-b9f6-f0a5f873dfd6", "comment": "Malware payload", "value": "f7d499f18591ed5d7fe2f33e95030264", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677961, "uuid": "c0b0b98f-e590-4795-95ca-b4f0674f6e0b", "comment": "Malware payload", "value": "2425a3adb4c10c341cc4ffd9f05d04e819975409b3bcc85b92152ccfdeceb79c", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677961, "uuid": "d0f3fb42-7cc7-4dde-9f8a-c2514518c7d3", "comment": "Malware payload", "value": "2bab0eae6a77dae75e47e63ff054b9c44875edbe", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677961, "uuid": "23a2b238-6a37-43ea-884e-67c47c9bb849", "comment": "Malware payload", "value": "0a8c5842105cea68ba70a273d23d3ba0cc52083d9e3c3d983a7c8155eee998596b17eb35a19e757eb072cd3a86ae2f9d", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677961, "uuid": "4e8bd5bb-344f-468f-bd2a-bbd0a7378c42", "value": "T1A3B2B81A15B300315A63C0E9A7D7A74A3171400BAE82CD593FED42849FD7F86AAB37DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677961, "uuid": "65e6e751-e3d3-40b4-a7ac-28cd7f0b222e", "value": "384:GEZIDk5bnEFyC+WG62P4z0jGjp4jd7/gZTfm0EQVk4ikiZi2iVgiNgicNgi6qgiN:GEZwk5bEFyCrwDgVm0EQVkVZgHV9N9cP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788677961, "uuid": "3e66c809-e596-4af0-bbd1-f35c6dd9c581", "value": 24538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788677961, "uuid": "98dd357e-6400-41cb-8427-71849a1d9487", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677961, "uuid": "47ff4b18-1295-4e18-9309-65405225c57c", "value": "index.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f27237f9-aa1e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718531, "uuid": "0e1a46fb-3fa5-4516-a61e-4ec71d76cf3b", "comment": "Malware payload (Mirai)", "value": "5b9e888253d5d99b5e2437021b94c067", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718531, "uuid": "4c56adf4-6d8e-4fb9-a113-c2dad916fdfa", "comment": "Malware payload (Mirai)", "value": "247d2372e44cb1ee617266eceddd8a63e7d0f2788eb181b34937fdf00f24e54d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718531, "uuid": "21cc48e9-e681-43aa-a6d3-062d4db1d379", "comment": "Malware payload (Mirai)", "value": "f13c9191bab3f8c7002d058a03ff85d303093688", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718531, "uuid": "e2ba0d79-ba2c-43e6-af3e-dfcca3366dc6", "comment": "Malware payload (Mirai)", "value": "e39a155cf081b2faa64ec72d904678b0c6ff847788cf602d50021726ba72cb7c81159d05f9ab3de64c1aa56992b0c908", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718531, "uuid": "eb8e5058-8dc8-4be0-bf71-d66c1265dd16", "value": "T19AE3AF71F0A5ACD7D56409F551A1EA3007027CA007B3A2E8B4D9F3EC8B9BDD53A5EA70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718531, "uuid": "461a0837-1162-47c8-a09b-642177cfed78", "value": "1536:Y6Lh1/IrwsdT1VX1/rzXEb3tHuM2boQoV8TFnhhBaRimRO/BxfCGAr+7axAvOPpY:YFrVdrbEbkIVSBaRiS0fAr7iuyThYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718531, "uuid": "49f669a1-5507-443a-b672-f82d858fd310", "value": 152448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718531, "uuid": "fd91b002-2bb2-4717-b060-a23fe000aada", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718531, "uuid": "b0e42765-e185-4c17-ad97-3debf0a59090", "value": "wj0s.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f21d96a2-aa28-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788722826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788722826, "uuid": "4afb9d8d-3506-496e-9f27-23a571506a88", "comment": "Malware payload", "value": "39ac03c6a8ee2108debbfcf391268c2e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788722826, "uuid": "cdf10c55-a4d6-459a-9c71-08130428c980", "comment": "Malware payload", "value": "25667ae1985d40a41e1e02fa1e1eb0067b9f4013b0701db84fea48f4538adae5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788722826, "uuid": "f106944c-1347-4bdc-bf91-9c749f9e8f2e", "comment": "Malware payload", "value": "973423d6bc0ee5eeaaf407783d812f1b2eb0c870", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788722826, "uuid": "14c78ecc-98bb-4184-8b8f-8603117b9235", "comment": "Malware payload", "value": "2b34b550387919f5d3c8c36bef085e4635029b2f7b5dacce82268a44aecfc24b6e4097ef4228d104fa1375df18db7ab0", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788722826, "uuid": "48de293b-1c24-40c2-a8f0-f8130d2a4299", "value": "T1D796123189C93861C073967549E60A92A3FD97771342C23E1AB0E414FDEFAD7DA06CB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788722826, "uuid": "374aca09-dbcc-4607-ba38-2e82d24c8968", "value": "196608:YbjTnGExVCuncvYoUqaqtRthRAw3AelZ8EWwpmIwc:qGExVCElqVt77AwQIZ8Edwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788722826, "uuid": "9f020a44-003d-45e1-9222-b6736a2e8cfd", "value": 8622696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788722826, "uuid": "6854366b-3010-4cfd-a8ef-015349db098d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788722826, "uuid": "f2470e5b-5a49-43f4-9ce7-e2f2a3a67e3c", "value": "NordVPN_\u0411\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0439.vpn.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3310069-aa20-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788719257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719257, "uuid": "2e8aed6b-5b9b-4bcf-87b9-fbb00ee13cfb", "comment": "Malware payload (Mirai)", "value": "132cb2e0e51228a7cd4ce07015232641", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719257, "uuid": "28ec6acc-c241-42b5-b694-d17cb1b5787d", "comment": "Malware payload (Mirai)", "value": "25a74d78e304588b6a371ba1a7302868a1c03e323906406b4b48e240c41ccab6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719257, "uuid": "e37c48cc-6beb-43ad-b5bd-bcfb08c4de68", "comment": "Malware payload (Mirai)", "value": "f4ed6ac69aae15a95b08dc5cc2ff8862d4b6aa98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719257, "uuid": "30801542-0d0b-4507-a0c9-eeca4ddf4f94", "comment": "Malware payload (Mirai)", "value": "95d73954829764c5117626911cb20a2c42990fd032aaf4d1b8e882d8864b02a9dca8540e7c42cefad6a135c1baeca2e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719257, "uuid": "5e4f8c7e-00b9-447a-9877-ee27b7a4fa0c", "value": "T153D3CF32E0086DA0DD2117B43476597C0340DEB40AD59243EFBEE5AE28B7DA57DEEB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719257, "uuid": "725fdd14-0f92-44aa-b037-3dac158d7e15", "value": "3072:jNOFV2mOAc6NBmjOd1CVOHVv3WDxGGRhaUNhkv0Z76:xOFgpOEoVv3MXL5NhGO76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788719257, "uuid": "cac19907-cd00-4be0-9c40-4d58108fd92c", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788719257, "uuid": "579bb651-0537-4563-be58-e862eefe77bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719257, "uuid": "a813118d-a32d-4ed5-b373-4a71dfe88509", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "136db970-aa40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788732760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788732760, "uuid": "a4b23471-8fbd-4c74-84a7-e7893014037d", "comment": "Malware payload", "value": "31260b1a40034638ae06f9faf6b88554", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788732760, "uuid": "edc3427b-d39c-4582-9613-91f89352a9df", "comment": "Malware payload", "value": "25f6dbcaefccc99c7878ade79fd66e8714760133f74cb282b19170f67b07cab6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788732760, "uuid": "972af687-5a91-47b2-930e-764a65ee9efa", "comment": "Malware payload", "value": "ac60535cbcc50f3aa004a41b68bd2066326172ea", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788732760, "uuid": "02f0c769-ea0c-4c43-b116-669cc7380345", "comment": "Malware payload", "value": "855c3683311848ef5e4503f286b8330fc31d14002837d92ef092a5baa3864ef69e455c30bf7744423f5aa9de15defc61", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788732760, "uuid": "0c52a319-bb72-4f37-b3fa-ec04484c0a22", "value": "T195F09E052BE184F7C21436E84F1FD06B441653AF31E35F901A06266F4D9A0EF7161461", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788732760, "uuid": "1b6fbe7f-8e7b-4a83-bed7-de7cfdf9de2c", "value": "12:JaCBZooEFcQ0Do1LKBesx5IjFc1H5N1opebsJEXAMJEXna8nFFH+J:JaCfooEFcQ0cpRjFkH31opebsJEXAMJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788732760, "uuid": "40d2de52-6a0c-4f55-9993-175435d005de", "value": 495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788732760, "uuid": "045d0ed6-e498-438a-9894-3a48d6892423", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788732760, "uuid": "e906d1c0-f935-42a5-aba8-9a10dfe609bc", "value": "launch.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ab96e3-a9be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1788676904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788676904, "uuid": "420054a3-c02f-4582-9024-12c18f9c909d", "comment": "Malware payload (Gafgyt)", "value": "12a15cb1cf820e92194a83065bdf8d61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788676904, "uuid": "cee9d7db-ea46-49c2-a961-8fc1f3fb206f", "comment": "Malware payload (Gafgyt)", "value": "26f2d0bdea514f00b43c373a0f26d440b9c19d18b4e98f807537f5ecae8213b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788676904, "uuid": "9ef44e2e-8e57-49e0-9a81-c11c011f38ac", "comment": "Malware payload (Gafgyt)", "value": "c9f2f8c1dd6400a55fec803b7cc31ae7fbdc6245", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788676904, "uuid": "eee6bd49-5f7d-4d52-9f9e-59566df1ec83", "comment": "Malware payload (Gafgyt)", "value": "aefa8bcbcc17267bbfa5a713dd260570e23a10d5caec669a1abd2739a1b4f46bcbcaab1d02045e486e34b15ea8408df9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788676904, "uuid": "daf2fb0a-4432-4d5b-8fd3-34c4349f75b7", "value": "T194C32B44FD548767C2D227B7FB8E439D3B355A6497D73321A9347EB42B81B882E39220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788676904, "uuid": "35ccb8b6-52eb-4d0d-8d83-aa29b16bdcd5", "value": "3072:8w688EjYlk2U3dyDLXr93rfymiLDKmZ9TQ3dL1j5B6A:IdDzZ3Lym8KmZ9TQ3dxj5B6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788676904, "uuid": "e73b120c-7098-442c-9700-39dad866cc93", "value": 121130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788676904, "uuid": "090a3e04-013a-4b58-a42d-3617bda0c75d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788676904, "uuid": "2d5a5b42-cf5d-4af8-8f9c-a3fe20759161", "value": "telnetd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6283dcb-a9c4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788679802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788679802, "uuid": "5d627e98-6efb-48bf-85ba-663e4138abb6", "comment": "Malware payload", "value": "03380d0f56ec92a384ac3193695fc58a", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788679802, "uuid": "0407d4ef-ec9e-400d-baba-ce97784ee406", "comment": "Malware payload", "value": "27d26f4c47407d759066c2590155c34a2dd1f956b1217c85824fa646d1ab462b", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788679802, "uuid": "4ab9b8be-6999-46b4-a117-78e4cd555564", "comment": "Malware payload", "value": "c1a6e9c86dbc29c983cfe993dd9f87925f31d4df", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788679802, "uuid": "11e2e235-fe3d-47bf-a522-cde172a6cf74", "comment": "Malware payload", "value": "a99daa60cf8f6dce453e82162352297b6ed9b545b21b506f8e2e5967cfc66b6a0228226895fcc1c3745cea67338cf75a", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788679802, "uuid": "377b1e82-a096-40dc-884c-2e2d9c86be3c", "value": "T12E6523DA2703C1A3C13BCC35D91E28F6B06F189589668B3F3558A2FE47802574DA75EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788679802, "uuid": "31653db3-c5b4-48c0-a07f-949fd5bfcba5", "value": "24576:u+jRF4Ig4PJC9tYRK0+GBvg59h/aVkEQt63eAhTcG:u279g40vYRK+WZ/aVkEQIeANd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788679802, "uuid": "9565b3b9-996e-48a7-9cbc-5fe6db05894f", "value": 1465534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788679802, "uuid": "652dfafc-a4f7-44ab-afb4-92edd7a2765f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788679802, "uuid": "14c02d35-b590-4edc-a17e-ee923ee0a5f4", "value": "Actualicese_210_AG_2025.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc9b12f-aa1e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718524, "uuid": "58b85b20-2259-4cc9-984b-7e00575dca00", "comment": "Malware payload (Mirai)", "value": "f9b11109dff43679ec449288e327adbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718524, "uuid": "2cd02dd7-835e-4fb9-925c-758e898e80e9", "comment": "Malware payload (Mirai)", "value": "280aae753e6d5251c88cb62dd54ad5eb00bb66a230dec543ee5f652a96019030", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718524, "uuid": "7eeb129d-d6f8-45e1-aca1-5938e96818ac", "comment": "Malware payload (Mirai)", "value": "165c20fdb65dfd17fb0d922925f773883d5ac9e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718524, "uuid": "a22e9783-c483-42e6-9f83-3d2b761a8d37", "comment": "Malware payload (Mirai)", "value": "a0dd441a2f9529287e82f6d43ca398e53470f519716d631873e6e5cbc8130af61e565509ce3c6a2f66117eb3abbfed93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718524, "uuid": "a90b5591-117d-4b8d-ab0b-0e15645d8835", "value": "T10D4302A5D2254C63F62B78F058A653C177F02E493DD4CEAF1D9245922BA36622C34ACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718524, "uuid": "7fc0c6d2-4356-42ae-ac61-c997700c4a46", "value": "1536:4+inMXOwRDKNCurirF2NU85wESPda4FJQjbZ4u+qgw09v:45nMxDKNTrGUNBwESPYNjd4u+qgwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718524, "uuid": "9ffeb2b7-3cdc-4ab7-b906-917ce88bba6d", "value": 59676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718524, "uuid": "63619f8f-15f1-4113-bdd7-73d33e0ecc75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718524, "uuid": "05dc84c0-20e8-43eb-a786-a22f7f06e7e3", "value": "ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e7a2d7d-a9f6-11f1-bd95-42010a9c0009", "comment": "Malware payload (SVCStealer)", "timestamp": 1788700996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788700996, "uuid": "b1082dc9-3446-45d1-a35d-204c4ca9df53", "comment": "Malware payload (SVCStealer)", "value": "5f9804ef3d9241028d88ea2b590c3a71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788700996, "uuid": "ddbe9c07-21c7-433e-9d88-66f1f754d545", "comment": "Malware payload (SVCStealer)", "value": "2870b115f689a226c79cc1428ed2c1cb8b118850bfa21401a397de22ad9250e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788700996, "uuid": "0c75a815-6a00-4620-9543-13e4ab67939e", "comment": "Malware payload (SVCStealer)", "value": "5b53de0e4e3a97090ab3db03783de337728b7fe6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788700996, "uuid": "21b5258c-934d-4aa4-befe-94a59f518451", "comment": "Malware payload (SVCStealer)", "value": "2d5c2e0de0baee918a48104bf702ed613289f55afb5c0bda3afe1a6736f157cf5ce4fb6bb7bb7f048dd9ac9f2f1f1e3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788700996, "uuid": "46d49633-865c-4fbf-a4d2-ec68a2f3be5e", "value": "T16FB59E4AA3B801FDE0BBC274C9565A07D7B2B8061674D79F13D4479A2F23B716E2E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788700996, "uuid": "2c82b17e-a9bd-4d9f-9b82-0ddebb07293b", "value": "7e867cc786c49e69b30c43a151a15953", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788700996, "uuid": "c11ea3ca-3ee6-4558-a99c-fda40fd93a65", "value": "49152:xIiB34IOPHO0XKDNEyR2Z3Au/PJvTs6Z:O0SyRa/54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788700996, "uuid": "21ea4fb8-f082-4a52-9665-cb69146e050b", "value": 2417664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788700996, "uuid": "f349f163-0912-4b02-9548-e5c9aa7db558", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788700996, "uuid": "ee647cf9-2c28-44fe-a3cc-044e0083caef", "value": "2870b115f689a226c79cc1428ed2c1cb8b118850bfa21401a397de22ad9250e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "792a8074-aa2e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Amadey)", "timestamp": 1788725200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725200, "uuid": "120705a1-d5fe-4eb8-a0b7-7af0a574bd64", "comment": "Malware payload (Amadey)", "value": "f05dada33b1b43b4281c2ea748b9c1ae", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725200, "uuid": "7c36f531-bee3-4d8d-9393-eab314e41ec2", "comment": "Malware payload (Amadey)", "value": "28e985edba59127261da83fe963b0a3674d9007840acd8db505fec6ac455c987", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725200, "uuid": "0774808e-42b2-425a-9b1c-c473d61480d8", "comment": "Malware payload (Amadey)", "value": "40b4764b8c799fc0bc859fc912233e4cd10c20e6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725200, "uuid": "637601f0-9b18-40ac-919c-16d3edc1e630", "comment": "Malware payload (Amadey)", "value": "b3000632e35aae5590cf0a70db0e546b1a15c785cf2e66163f364299ee013b82fcc38724ee565a0946e1b55d9bd8040c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725200, "uuid": "a06d607b-19d7-4e08-94db-d55f5341876f", "value": "T1DAF31286907D923CE17868B5A1EEDE02F974FFD0ECBD8489F196714904B96B8C6F7110", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725200, "uuid": "cac94951-fdb4-45d3-8024-5ae9db2565af", "value": "381b40dd6bff24580b4c540462e4f76e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725200, "uuid": "687b5027-b73e-431f-9a65-dd8a914a8e24", "value": "3072:O+aL26Ogi52ztMX/kipPTq/jLfuDX+gUy1i4woUDQut/T0j8z4OFOtc80w5o8Y8Z:O+arOgi5Q6X/u/nfuDX+Uo4woUDQut/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788725200, "uuid": "4592a76e-ec7c-4af1-b35b-0c165ed8d883", "value": 169984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788725200, "uuid": "bffce396-3e48-49c1-a486-0dc42320de15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725200, "uuid": "e818b478-2162-404f-8056-843a437aceb3", "value": "taskmanager.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661b6f96-aa2b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788723879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723879, "uuid": "4d7ddd18-97b7-4757-991b-37671f0ff861", "comment": "Malware payload", "value": "da0121cafa6d11f8ef9fb4d933a9ed5e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723879, "uuid": "7e99699b-5b46-42fc-9594-e0469d1773b0", "comment": "Malware payload", "value": "2b1b6a5d908ea2dba3198952abe830235c4b910423f57a156e66b9c5eeacefb0", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723879, "uuid": "1690d7c2-b3c6-4ce7-82fb-90ae84713cd3", "comment": "Malware payload", "value": "a2f883ccd9b7ac30a85bfe6ccaaaa79a1501e90e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723879, "uuid": "be88277f-c87f-4196-9f0c-f57d65118549", "comment": "Malware payload", "value": "cbdaacd8ab3bc1ebfb64934de1d6da60ed39b08acf6a833862c81f8554e2765a69db38a13026e6c8445aabacaf4a3280", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723879, "uuid": "4068380b-8007-4ad2-aec0-e4281a4ba895", "value": "T1A2816C6C35F18549F4033D7D8CCD9251B3EB20242094866E4DB6F872129E4EF76904F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723879, "uuid": "4cf47ec0-4d3e-46a9-bc44-df11ffcb5492", "value": "96:HpU88oO4NucgEJVvVDeYit8Z7+TrTU55bMG:J3g4gcgEJdZiaFGT2Zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788723879, "uuid": "9b8750a4-72c6-4e27-a297-019db62576ba", "value": 3914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788723879, "uuid": "3af6b1a8-681c-42ca-a798-ba0889929c3d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723879, "uuid": "f284d379-0e2b-46af-ae42-0245c282a89d", "value": "dropper.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30bf07cd-a9d5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788686853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788686853, "uuid": "6aff55fd-2fe3-465b-8070-222ce0df5528", "comment": "Malware payload", "value": "507d98f9f6fee4f38809d4652412e6d4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788686853, "uuid": "b769b523-04ac-4d4f-9b44-ed45110f80a4", "comment": "Malware payload", "value": "2b404ca23f631bf6f194aa1521a12be84de1edf00b06f8eea8a25844134ca254", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788686853, "uuid": "b2c75c5a-a5c0-4db0-8f5f-0527f4788149", "comment": "Malware payload", "value": "8ffdc691d25411518cb748b8dc638bd9065e7f84", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788686853, "uuid": "1ef4e3d0-17c2-47d2-9af2-b8a4e3e8bfde", "comment": "Malware payload", "value": "0af225954764f85d9491a142cf66dab5be8df5e30b66cd8eeafd651122fbf3c1eaa53cc70c69a14e2b1ef7ef8cd23d8d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788686853, "uuid": "c601811c-8e06-466c-9ad6-cb5a244c7b3f", "value": "T157236C6516857C14AA99C4365C7E2F0CBDAD43E6314492EE7FCE3CF28C4A6ADA20871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788686853, "uuid": "aff4d8b6-3ddb-4ae4-a241-bef663a36634", "value": "768:xr9NyXsZztCO9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:JHusZ+cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788686853, "uuid": "042b9259-34dc-401d-969d-ce1a35fffbb6", "value": 50071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788686853, "uuid": "773d34fb-6eb5-45bf-b274-d9d6d628f3e6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788686853, "uuid": "4ce43385-b41a-4bc4-8683-bfc429a9f475", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b92cdc2a-a9c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788678063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788678063, "uuid": "a764d462-4618-44fd-b305-3664f343923f", "comment": "Malware payload (Mirai)", "value": "9b0c20800aff6ba7cabb6b3c8fe47495", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788678063, "uuid": "bb3aabf9-35c6-4d78-b5c1-baabf460cd25", "comment": "Malware payload (Mirai)", "value": "2e6ba777a8e1db77b97e020d99021257326216e265edaaef409fe81c5db04881", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788678063, "uuid": "3cc6b177-5e1f-46e1-84e4-988eff53255c", "comment": "Malware payload (Mirai)", "value": "df5dac4e0d251c5d022a2b88cb5f4ddaa13b548e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788678063, "uuid": "8aa70ec7-c669-420a-93bd-0f0ad1298a38", "comment": "Malware payload (Mirai)", "value": "6525868f3b7bc2981e5ba62f49eb8a725d9d3c75fa940f1be822fe619566d94216b6198d73246989b010c3cd7446512b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788678063, "uuid": "19bec604-4e3e-463b-9252-dd6074ca32fd", "value": "T171836D82B7465F92CB2517744DF38518FDE52AA21AE3C563F3326A0107BA0F1B92DEC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788678063, "uuid": "73ed44dc-9871-4415-aa25-e5d1b9261cfa", "value": "1536:+jYLzj58mFYyVu5EqQ/p0Smr+GNenKGBNmguP6Ofcux/JuOoNysMRw1qgdLouC+k:5bge5Ru+GEHvn8sMRw1qgd89iF2Mdj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788678063, "uuid": "33bf2b67-3317-4413-9154-5e5ab4b4dd12", "value": 84304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788678063, "uuid": "ceb66391-b572-42b0-85bd-6004e902aaed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788678063, "uuid": "b809e986-0c03-4fb6-a965-8b7de47eb6d6", "value": "2sdqu9iu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ebfc63-a9ec-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1788696717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788696717, "uuid": "29e8171e-9c0c-4d39-a2a0-76388696d61b", "comment": "Malware payload (ValleyRAT)", "value": "8ae8eb50d4a8d3929ff979725a968ddf", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788696717, "uuid": "967d9070-4401-4dbb-b0c9-2d9354a0d0fc", "comment": "Malware payload (ValleyRAT)", "value": "2f095a584b0acfff4c6b6bffca43ab552f76d821113cf8226ce371a9e02a6879", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788696717, "uuid": "cd8ea6f2-da12-4556-8785-c04359d2f748", "comment": "Malware payload (ValleyRAT)", "value": "977fa402396e068a28dae495ded321989e4999d7", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788696717, "uuid": "0e480a1e-c9db-4cf9-803f-95c97e1933ba", "comment": "Malware payload (ValleyRAT)", "value": "fa78a6850e5d30c7c26e64856dfb806db57e2a6e619e77e727562576a1d4729eb064d186e5d78b0f9e715afd8b800811", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788696717, "uuid": "5ff77247-898a-4d11-8654-df343714ad19", "value": "T109D73331798BC636D5BE9072D678EB5A94B57EE2073140CBA3E47DAB0E708C24275F12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788696717, "uuid": "42133673-10e3-4be7-ac3b-eaca65219c7e", "value": "786432:aKXYelq845ZCoGhF5hOfb4m1ukZPmwo4bpDAgzp6Y0wTA26dYBUm5bTvEsWUxqX:a+mNUhubdZPm14ByAbTEsWUxqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788696717, "uuid": "f3719709-d41f-434c-90fe-f73fc4651cbc", "value": 60675072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788696717, "uuid": "a7e19e68-34a7-4ebd-8b41-6a22c2ba38ca", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788696717, "uuid": "247737e8-7efe-46f4-a060-6750bfe3ad5a", "value": "TGmellqSetups_64.7.1.5.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1d58c1-aa2b-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788724047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724047, "uuid": "25284ba0-dd94-4660-9bd5-a3fdeff31c51", "comment": "Malware payload (RemcosRAT)", "value": "a85ef8c4e6fd94970ba9de9a96d71367", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724047, "uuid": "96e82809-d141-480d-bce9-4a15f2c339cf", "comment": "Malware payload (RemcosRAT)", "value": "2fb694cdfaad46ea8d5937291a33b33eae0083921151afb6362a252cec512837", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724047, "uuid": "196ee1f1-02a8-4354-9868-c6daf97c5c67", "comment": "Malware payload (RemcosRAT)", "value": "711831c780034f3d6f3e05c60d7d8d797a5b98e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724047, "uuid": "2387f6f9-73f8-478e-b3bd-0e0f48a52523", "comment": "Malware payload (RemcosRAT)", "value": "42d8d8c2e3e50da5a19bcd7bb75bfc1ff66dfc8dff81288e5fb4683a47d66ff09235bc8f35960cd5ae0c0a4d9b0747fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724047, "uuid": "84ab9fa8-6221-46b9-89c2-0757dcf7a29b", "value": "T11DE46D59A39402F8D0B7C135C982953BE7B2BC065571472F03D70E9B2F276A16F3AB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724047, "uuid": "b6de2b80-2a1a-4ece-ad20-abef9219f693", "value": "91e69cff27767212388496ea08379c84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724047, "uuid": "37b64f4a-c255-42ff-bd2e-23e0ef545591", "value": "12288:NIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:C5GXkH4nnwitNfuq9wgs3y3V5vgNyo3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788724047, "uuid": "0369e80f-910e-4c68-ac0f-c3d047d05740", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788724047, "uuid": "35a8f331-7282-4b21-a658-4bf6b122de96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724047, "uuid": "faf4b9fd-3083-40c8-9447-72824507daa3", "value": "hello_khoe_khong.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c609697a-a9c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788680232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680232, "uuid": "a98d6af7-3782-4e40-9afe-b645a70e8224", "comment": "Malware payload (Mirai)", "value": "d060f021d2387148b493b06fb044dd7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680232, "uuid": "074ba1e3-d68c-4233-8907-d849f1a22d50", "comment": "Malware payload (Mirai)", "value": "302e1af8eb3930214b5bc1c15bb02d8ce360cc4ad49fc1615564c3288b3a6ccf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680232, "uuid": "743f7c05-c67e-4611-bae7-ea3632fb2707", "comment": "Malware payload (Mirai)", "value": "5f5cd44c0e66d15a28c061a5815e5f2ae4f265f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680232, "uuid": "6af229ef-1d74-489b-bf9d-a9c0eaaf6046", "comment": "Malware payload (Mirai)", "value": "6ca61dc5209cca10e8615e48fdba294003c7c479723ad7caec4bbda6bd0ea698e497ed4154e62d36251095e00c5067a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680232, "uuid": "2238adb2-a6aa-43a7-bd33-88968d6314c5", "value": "T139B31B40FD548767C3D227BAF78E439D37355B6497DB3331AA346EB42B85B882E29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680232, "uuid": "70f8dcd0-bdde-4486-bd16-30c72ba9ee6b", "value": "3072:EI688EjYlk3U30G4K0YwiOhfWmQ4qT7Im6ciQH3MhE5r6A:1g4x1X5WmQ2m6ciQH36E5r6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788680232, "uuid": "5ff123e0-04e4-46ba-a5a3-ed24ffc97534", "value": 113584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788680232, "uuid": "1b166374-ff40-4e83-b5c1-fb898c462b8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680232, "uuid": "6c9b7063-063b-4e84-8cb9-82c53917d2db", "value": "telnet", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "165a5c6e-aa1f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718592, "uuid": "c689a58a-17ff-4fdb-bd0a-19663fe7ead6", "comment": "Malware payload (Mirai)", "value": "d84be243d69b7722ea64ac179c8bf30d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718592, "uuid": "1e2f751f-ab06-49cf-ad38-f6bba8bb0bb1", "comment": "Malware payload (Mirai)", "value": "310163159ae03a228ed4d83d7a8e75a3825f80aa5845ae36ed13dccb7a15ff25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718592, "uuid": "cc8497c1-abc1-4e7f-91ff-83ec48c0e0f8", "comment": "Malware payload (Mirai)", "value": "09a57c7024bcafe8f28934e207bb8c46da1fa0d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718592, "uuid": "cee9af4a-eb3c-4fd1-af2f-e9f87709f413", "comment": "Malware payload (Mirai)", "value": "639e3d326d2c61dedc99e8e8f7e914558c52ccf39649dbd12501c2d88f0cc888dc3f02d23b4782edf0385453c4c84447", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718592, "uuid": "f672fd54-bbc8-4b8e-b7a9-e312032fb382", "value": "T144046CACE51EED51DEC6E2BDDE451FA3703738A08321C0F7290052BDE5DFAD98496922", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718592, "uuid": "3f03438e-bc89-46f2-891b-985ade30c4ad", "value": "3072:QCEXdvMckdmTvf0JMTrH10KPO6DYB/rkrGSoenVdKhRK78Y8C7:svMckdwtb1VPO6/rGVGVdKm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718592, "uuid": "d08559b8-f901-4765-bf1b-920bf8557ba7", "value": 178000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718592, "uuid": "3638da23-c46b-4a33-9b6a-29c7b6d18fde", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718592, "uuid": "d6f881b0-b92a-4624-82f3-dc10fd356948", "value": "wj0s.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc23bf0d-a9f9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788702603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788702603, "uuid": "9dc62a6d-2a22-48a9-91a2-6c89bd029ab4", "comment": "Malware payload", "value": "588663451743683f011f35d6417ea302", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788702603, "uuid": "e4d3d497-f3f6-4284-8302-a4efb4a3d339", "comment": "Malware payload", "value": "312ce95ac0cc0f1dc66896e6d4a317b92de6531ea8fbe56438467adeb5f15ab2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788702603, "uuid": "43ac785f-ff19-49b7-ab69-1304eb4adbc3", "comment": "Malware payload", "value": "52d7395911604f203c4eaf15389875410fcc324e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788702603, "uuid": "e1bcf8ab-0918-4ecc-8e45-dd7ab4367fe0", "comment": "Malware payload", "value": "1b7d2026e510dc2c82dc638a2bac70a0fbb93620fa54ecc2903037560b86622600217c8a606320f78dc32a5ff9ba67fa", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788702603, "uuid": "4f7c1429-00c0-4f2c-9e07-f7c789443083", "value": "T142C27D966A867C44BDC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788702603, "uuid": "306efe09-1dd1-41a8-aefa-89441bc3ada8", "value": "768:T8vCB+25j6es8Rv9FYpMSUpi+20qUpi+20YQX:T8l25J5d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788702603, "uuid": "fa40836b-53ab-4c92-8d8a-31a4522d8271", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788702603, "uuid": "5730f61a-8d54-4b2c-97d4-92eaa2f73bcc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788702603, "uuid": "a14f01f2-345e-4002-848f-0b2807e77b2f", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfb22ad9-aa20-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788719305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719305, "uuid": "e4310fb1-9283-4ca2-ae28-ef775759b82a", "comment": "Malware payload (Mirai)", "value": "004e113bb3a1b631ef420c0c892a212f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719305, "uuid": "7a235267-e507-4f06-a5aa-3d0f9b87e43e", "comment": "Malware payload (Mirai)", "value": "315d0bcd7a5adb872fc49dc16c6720fe930f55eff1877e9a4cc9366b4bf7328b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719305, "uuid": "000dfb24-a73c-49e0-84cb-478d0120f1a7", "comment": "Malware payload (Mirai)", "value": "3d60851b0c66a0023abf3e0cd5617da47e1b7394", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719305, "uuid": "c2ee35bd-b546-45c4-8505-5ab77658a01c", "comment": "Malware payload (Mirai)", "value": "04b61b0fd6d37207848aff43e2aaf771141ade377689a6a7b86b4d300a2f0769671bd5ab9c77533098b8faddef1210ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719305, "uuid": "4878e935-3057-4470-8812-f5f95e3d7e49", "value": "T108C35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719305, "uuid": "9237a093-8fbb-4073-8db8-b19ab26975c4", "value": "3072:3atpsoRNjmj1VGCr75MoS9SrPwVrx5tiyLw:VoRNjmj1VGFVrRiys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788719305, "uuid": "edffa7a5-0163-4a39-88fe-d633fe9de02b", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788719305, "uuid": "5745a60c-53ba-4d48-b136-37689e8eaa07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719305, "uuid": "c9ffe8ed-6dea-4336-8367-5301e4b6d04d", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd8400ec-aa16-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788715060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715060, "uuid": "c5b21682-1f82-4e59-ad3e-8b5150a893da", "comment": "Malware payload", "value": "21033a0de1904f0615c0008bf739b4d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715060, "uuid": "a7f1cbfa-4137-49db-bab0-2e4744ad1a7c", "comment": "Malware payload", "value": "32afd08aeb21181150acfecf75576c818fe7e5b29e59b87a32bbaf04de61c87a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715060, "uuid": "563a2e41-bdc9-4cc6-9896-48e9aea7f90e", "comment": "Malware payload", "value": "cf1cb4e1e5736e3febb215044d376289a39cf683", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715060, "uuid": "1196d766-cd06-4eba-8a66-8e4e826da647", "comment": "Malware payload", "value": "3a62e94820cacc413d6ed250a1a371a030ec3342d64886d08e8eb8134522aaec8e9eaec36f53f7228626dfe21a0c08c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715060, "uuid": "10d9d092-7fdd-4887-b800-af374423e42a", "value": "T10954B60F5E229F7DF269873447BB4E24D79963D613D1D684D1ACD1012E2039EA82FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715060, "uuid": "6b1c2e0f-44ac-4d71-94c5-cac774e851f3", "value": "6144:om8uhpHLdOyLBdEU1gzAJX5q7fRMzjyHeDnqt:X8PCiRMKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788715060, "uuid": "e483a4d1-f098-4d74-a0fb-e8e1241a9275", "value": 286556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788715060, "uuid": "9f82f1a8-3587-4ce4-8d32-640c72cd2bd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715060, "uuid": "9461db7c-c533-4918-9fd0-a97a404fc657", "value": "32afd08aeb21181150acfecf75576c818fe7e5b29e59b87a32bbaf04de61c87a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e4bd07e-aa00-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788705317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705317, "uuid": "e6d820ff-8916-4027-a20d-82a2fb91fb57", "comment": "Malware payload (Mirai)", "value": "6f3adbd88386a145ba9af750b083b820", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705317, "uuid": "37987e5b-e062-4b66-941f-ebbfc8d1e47a", "comment": "Malware payload (Mirai)", "value": "32dcfd588d0602147330508b7f35e5f4424abf20a4459150c56a08e5ebb1693c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705317, "uuid": "f4c4ebbd-a0de-44dc-b61a-4aefc8e61607", "comment": "Malware payload (Mirai)", "value": "995ab6d88c81edb7d5b8aa527bdf76134a1adb85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705317, "uuid": "ccfe2471-8efe-4dce-8660-ed21b6477425", "comment": "Malware payload (Mirai)", "value": "a6b6c29139ab3706add59aa2bd5b966f54ee8fd137cdf039d35e05123ae64f795d8da5ae040ab10390e89fcec6b4abfe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705317, "uuid": "0e2b7f2b-c0d0-41f9-a844-2ee10793dd36", "value": "T17CC32B40FD508767C2D327B6F78E479D3B355A64A7DB3311A9347EB42B81B982E39220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705317, "uuid": "6264dddb-26de-457a-9e6f-2ec2f77d870f", "value": "3072:PndOhtEtYlkKeWPbaXo47hLo2gp14L8NNTgmyiP+0xRHmorfn2mZ9TQ3dL1j5B6A:eMXo47hLolp14L8NNTfyiP+0rHmKf2m0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788705317, "uuid": "f759efd7-33a8-442c-957d-b153666f6619", "value": 121269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788705317, "uuid": "696f83eb-5327-4fa7-a5aa-cca0900e240f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705317, "uuid": "c00f97db-1eb2-45a0-95c6-5e0c4ab049ea", "value": "telnetd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6842c14-aa00-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1788705653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705653, "uuid": "d74f6f5f-c60b-4dd9-9e4d-31c6e63a1910", "comment": "Malware payload (AgentTesla)", "value": "60335e20ee2aa7b27deb7193e25e66f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705653, "uuid": "de1140ab-453f-4971-abc0-a9064fc61f52", "comment": "Malware payload (AgentTesla)", "value": "33b457491ec6411a6c2eb123d4a8c34aac64080014f55338b144675dcb3281bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705653, "uuid": "5e83f959-ec0e-44b3-9d17-7818dba1a355", "comment": "Malware payload (AgentTesla)", "value": "df9a592bfbb9b550d0d9611dd5746a86a66bd248", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705653, "uuid": "71e7bd77-97f0-427a-8552-ed4f0fd68521", "comment": "Malware payload (AgentTesla)", "value": "db4ce7469c0f6bca05775d3e3e0e9c970957d108c9a84af28b5b65e0aac96e82e1f3b70b65dea923984fc360097682de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705653, "uuid": "f5def84b-d248-433d-855d-5fa1f450a703", "value": "T10915F86A7B828F09E065697DCCCD3322D7A51FF32323630B3B086714178A5DA9D1A7D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705653, "uuid": "368359c8-bc62-425f-a9b5-28cb078bf573", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705653, "uuid": "856b612d-6420-4a40-a8c4-5739281b9c7c", "value": "12288:XI0W/Qiwur1GT6R91MPnQN6zN3h+5b15FGYFznVlY:X1sw81hHOFhEnnzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788705653, "uuid": "d75a9e82-5e91-4c2a-9ed8-7d94409cd457", "value": 896480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788705653, "uuid": "c2239975-bf73-41c6-861e-c37d49c61bcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705653, "uuid": "d0bacfd6-4238-4443-a28e-e3441b4ff9c2", "value": "123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c9f8fd-aa40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788732798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788732798, "uuid": "62bfb34e-770b-450c-bd2f-f50d27875eb7", "comment": "Malware payload", "value": "707ad262d7981698b302502559ea7c7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788732798, "uuid": "97711b33-6d13-43ca-bd57-bdbc26fb3932", "comment": "Malware payload", "value": "363576a90042aa9b9bd6c8fef815f38b75bbf25dc251e8219820dff96f54c645", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788732798, "uuid": "a033a509-56bd-43c9-a4ac-e943429fab55", "comment": "Malware payload", "value": "7caf4affcef597144ef3f8853bab7bcb703d30c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788732798, "uuid": "567566e5-4162-43e6-b8ae-7b5110068613", "comment": "Malware payload", "value": "5614ba567675aeb5779be7b25f60665077ede9963e60d8e8fee67ae15b23c44e9003fabd00eae0066f78f98996c956aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788732798, "uuid": "65f296c9-ebe3-4387-a3ea-4c9352e31f69", "value": "T193D522DAB8FA2A74D477C3B68F42F4BDB06A77814B348E87369D2A100D536446D39339", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788732798, "uuid": "9f8817c9-84ae-4b82-8782-5717e8c9a3fa", "value": "fe230628262faec735b6f015758b7519", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788732798, "uuid": "8ca6a5ce-7d46-4122-a42f-64df83662b4b", "value": "49152:fn2+tBF92dag6HeB4DEagS0jEOoWgXVcbwR33CDZ/yVgSG/YUVdTSvj:f2+fFvgVYEFUWgFcbQ36aLMD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788732798, "uuid": "1f271fac-1bef-4044-8712-d9598f5e859f", "value": 2952704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788732798, "uuid": "11e7b61d-bacd-4c15-aace-5636efc8602e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788732798, "uuid": "32a4ea58-5bad-4ca2-9335-2b9ad4875f24", "value": "363576a90042aa9b9bd6c8fef815f38b75bbf25dc251e8219820dff96f54c645.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a61bde7-aa1f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718598, "uuid": "46f9a5f8-4221-4685-a613-b2bb6dc7caaa", "comment": "Malware payload (Mirai)", "value": "867970fa24b8a7b7b44da72b31cc5f28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718598, "uuid": "5aa0a66c-d35b-411f-ab5b-121443822239", "comment": "Malware payload (Mirai)", "value": "364749ae2f0664551792e8919e32fb5d5bc41409309a228d924cdb60b930da7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718598, "uuid": "f5882e93-efbb-42dc-9060-57e9ccc6a046", "comment": "Malware payload (Mirai)", "value": "f40fda15b15489052303ade3d1f583927ef8dfed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718598, "uuid": "8b472675-ac7e-4716-9047-ce249855371c", "comment": "Malware payload (Mirai)", "value": "53106ca3bcd16f8fc4e41c5f6bc965c58d49c9a6f934a8e86eff732e2b4e700872cdca525dbfd992356af98724e097e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718598, "uuid": "7ead058d-6f02-466b-941e-0f3f16005668", "value": "T18EE36B32B98450FDC8F5D6748B5F9232B732BC8553217A9E17906E752E66E203B0EBD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718598, "uuid": "f12b29a8-be5d-4398-bd80-c0781a6fdb1d", "value": "3072:ZFziyAXqsW+MVbyBKZRW9jth1uM7DpVbID37Hi:rKqkMJZHOtLF3pVbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718598, "uuid": "80c8272e-b0cd-4815-bb02-c06beff9409b", "value": 153552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718598, "uuid": "52bc891e-fbd2-4809-a30a-999beb9292af", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718598, "uuid": "605bd4a1-5e8e-4782-a3bf-ee681b983664", "value": "wj0s.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3398357f-a9d7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788687717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788687717, "uuid": "f66605fe-eedc-4db0-b164-ac878a4c45d3", "comment": "Malware payload", "value": "8b0e7480b54b07737e27523b2d8ac453", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Heracles", "colour": "#5A9737", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788687717, "uuid": "7f077996-65be-4343-8715-33159735193b", "comment": "Malware payload", "value": "36664592529f7a6ad5c3704b8d1a673f0a0e7d5898c14ce77cb858f2d813ff25", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Heracles", "colour": "#5A9737", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788687717, "uuid": "6c32a312-93ea-4bc3-8202-faf6b30d4b2c", "comment": "Malware payload", "value": "274759d4b743e3c423273c231e04bbc3be78695d", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Heracles", "colour": "#5A9737", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788687717, "uuid": "2e118dcd-159f-4543-810c-9d575c2b56a6", "comment": "Malware payload", "value": "0bf03da713e970c4990d0e98aa0ea15813cfb62495fbcba1c517782c93c7a2f4c0038cc0c90f319ff80e807e5d16dbfd", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Heracles", "colour": "#5A9737", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788687717, "uuid": "113138e4-1ab4-4f66-a3a9-6a19aacd4dd9", "value": "T1CCC1A507ABE9592BE47F073138B3131623F0F8166FA3875B1CC41428AD567809DBABE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788687717, "uuid": "5c1fc04e-25da-4e97-b49c-e0595c8031a9", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788687717, "uuid": "d6179f49-7c65-4012-828a-646f557f8ca4", "value": "96:eu+PQRq2bk/vRblmsTt7cbH7aadBZV5I0ldmyPm1WSJaKa:h+PQfkXysx7VadtzHmj15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788687717, "uuid": "c9d9fe65-3b7a-4a8d-9a52-c80af3b6707e", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788687717, "uuid": "0cbc69db-c3c4-483a-afa1-397eff498799", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788687717, "uuid": "80af81ae-15a1-4a05-af7d-d0eb5fcf1a85", "value": "0outx1i4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3100a797-a9f8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788701886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788701886, "uuid": "01210fce-8393-472a-aa64-a11c6430d862", "comment": "Malware payload", "value": "8e4d220d2b5bcfdb3482e960eaa59429", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788701886, "uuid": "d37f18ed-7ff0-41a9-b39d-b63602831caa", "comment": "Malware payload", "value": "36cdc541a3c415bbc2bd277230cc3e998920ab4b13f877c28d9b0c7091148439", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788701886, "uuid": "4030f53e-d52a-4d99-b8ce-8467c23f92c7", "comment": "Malware payload", "value": "7fed62d6266a10a936d4437efd9ac361d3b428f9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788701886, "uuid": "e852f3f4-5cb7-46d5-9b0e-d176a4a0a4ec", "comment": "Malware payload", "value": "d73aaecdf5b31a27b8367cd98a874e69a0783134f9564aaeb6e9c5268783d8cd9e45723f544b4b875ca1713ab7b371c9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788701886, "uuid": "7bee61a3-ed3f-43e1-8418-71e40514026c", "value": "T1C2235C512A857C14AA98C8371D7F2F0CB9A943E6320452DE7FCF3CF68C4AADDA10961D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788701886, "uuid": "e8e66502-682d-49a0-99c6-a33b69a3ce5b", "value": "768:/QFWzZx5d9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:Ykz0cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788701886, "uuid": "6a4b70ef-5ea0-4ef4-897d-4eb35eae5ad4", "value": 50035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788701886, "uuid": "48cbdfeb-0d77-4a4a-9967-b1113ae6d36d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788701886, "uuid": "b1ba3451-062b-4a1c-9d64-25a3b07e3ba0", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff324e80-aa1e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718553, "uuid": "197b73d0-9ee5-41a4-a725-b6eb833763d3", "comment": "Malware payload (Mirai)", "value": "ba4044ebc1b8119c3e4bdf9d2741f1ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718553, "uuid": "076b017b-1875-4d67-8bee-d396374ad451", "comment": "Malware payload (Mirai)", "value": "36dc0c314464f4a28e0b404f8d10fda7a674df45cb56bf342cc42ab7e1790972", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718553, "uuid": "70358d5c-4604-4e74-8af1-02a540b01515", "comment": "Malware payload (Mirai)", "value": "c4808ac3a9140078e7541c82ecceec6b1333faed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718553, "uuid": "6c7a6837-c90d-40fd-a426-b103be63c729", "comment": "Malware payload (Mirai)", "value": "c609228069a83b92c2f2a66cf7b0a84016aac094ee1f70339aec5e13caefdb815d1daf8ab619d63165e680ab5eb80d84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718553, "uuid": "1e1f2225-c418-4310-aa4f-7a874c3d24ef", "value": "T1FCA3029FBD742546C5BE9D79E8C6068AE88EF50167622A4C8977AD0A0B50C8F32DC17C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718553, "uuid": "9f90e3e1-2b51-42e0-b90c-bd9365f116e4", "value": "1536:sHs0Zd5TuI7nrr8E6+jdaTiS7rQTFN1bTtDxt5SUzGXRf/ccir63PNv4F:2sgr5bnrxaTiSoRN1bTtNt5S53JiiFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718553, "uuid": "79e8a021-2ec7-4647-97c1-60eb1a0857fe", "value": 98008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718553, "uuid": "907480bc-c27c-4e9d-86ff-73069f2692eb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718553, "uuid": "5f30509e-e8db-4b3b-bccd-2496a02aa842", "value": "wj0s.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236aefd1-aa1f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718614, "uuid": "e37dd245-0de1-4d53-bc30-b709ff8f578e", "comment": "Malware payload (Mirai)", "value": "53e3c845d0c1f0f5e0db58b5f11e0342", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718614, "uuid": "8d952b16-7a97-45ee-bcbf-97e73588c022", "comment": "Malware payload (Mirai)", "value": "37db324435df13d5b6e9d522ea9dda7e9c766dd77c0c1d668c55322f4a33845d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718614, "uuid": "66b41546-388c-4d89-a39c-e9e5eb85c4b3", "comment": "Malware payload (Mirai)", "value": "72ec9d0bb488265831f7e46673a58dfe117c4cbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718614, "uuid": "e6bf9d0f-6dce-4ba9-9a93-043fec658475", "comment": "Malware payload (Mirai)", "value": "46f40a9d632807067ad01595e2d477bb4a4dbbe6577986be9e25c26122f785528f0e25b1dfddc83ff659f02b7273f882", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718614, "uuid": "29647055-f425-4381-903a-da5d36cd825b", "value": "T191145A9777108F91D37486300BF34B676BAA26C516E2C985E2ACDE403E6538C6C5FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718614, "uuid": "22b09e6b-54c3-413b-9152-b715d9525981", "value": "3072:3pIEOwFWSTv5Uor8ECIASC9db3LA0Qb5BzBcmvRroaq9vjANhrj4/e:32EMSdraiGC59/jvRUaqVALt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718614, "uuid": "1ccf6423-fe03-489a-9c1e-7560bd99a317", "value": 196152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718614, "uuid": "65dd2be0-8f8f-43d3-b647-df5087769daa", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718614, "uuid": "504079ab-41a1-47c8-9b42-2c2d902873b5", "value": "wj0s.mips-dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b8ac7b-aa41-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788733462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788733462, "uuid": "a79fd191-bfeb-4d6f-aae8-eb1a5bbbaadf", "comment": "Malware payload", "value": "ae195298087be617ee0f265c3e611e92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788733462, "uuid": "04c787a2-7f13-49ac-991a-7f28ea3a9080", "comment": "Malware payload", "value": "394db160badc3198c94aa6c7fea01e68d6908864e1b35084538079b4f19e3a6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788733462, "uuid": "649c3145-27c7-44bc-a5f3-435ef5dc4a9b", "comment": "Malware payload", "value": "5323a026789b632726541bf2ed49e1550062804f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788733462, "uuid": "bf8559fd-7471-4661-a304-3838428c5084", "comment": "Malware payload", "value": "733e6d3098b470c9c91f6b3699888f9cfde80f3ed62d7d743e0b2ef57fb58518cfa93704bf11d00e52b9173c2363a8fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788733462, "uuid": "e178a14b-04b0-4b96-9199-6219bef6ed36", "value": "T10C67EA46B605C98AE0265274D8878FF4A722ECB1C6B1976733A93F1D7FFA30C4E92454", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788733462, "uuid": "803703dd-6ff6-48d9-ad2a-aac86382dae2", "value": "c329cfdce996b315359260e710fbdc76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788733462, "uuid": "1e1e6892-da6d-4923-823d-740e1b5b42a7", "value": "98304:9ClvSImXQ9EkE6uzJdQ2Orf8wsGF4tVjibVpOMOaci583EGsGFCJNlvj:MlvSIkQu5TcT4PILhAxTCxvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788733462, "uuid": "75c20aa4-b046-424b-a85e-a2843698d219", "value": 31746464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788733462, "uuid": "adb23266-8e56-4753-8e2d-8e96bf3d6f21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788733462, "uuid": "65506e07-d297-481c-9fdd-9df47fedf958", "value": "installer_r2.0.02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb8db340-aa2a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788723701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723701, "uuid": "27578ffd-4eaa-4c70-ad71-e1a505a31932", "comment": "Malware payload", "value": "bcc822bc37d0a506496ab1ee9f74b94b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723701, "uuid": "763ba667-20b0-4804-8a05-8c3e27eb91dd", "comment": "Malware payload", "value": "394e9cc44f80f3defe9dfc4750938f42805f0329ba4d65a205ac9e110731d716", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723701, "uuid": "25b31800-0dd3-4b5d-bc91-e058c0d0c288", "comment": "Malware payload", "value": "77c4325ffd2b4ba4bbfccdb39e7e2ebe66a40daa", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723701, "uuid": "8ba7ac09-0f39-44ce-8b71-016eb0c4e7b7", "comment": "Malware payload", "value": "6fbbc519a9f480256940869597d395192ad11bd082253204bbcc09680ec2bcc60fef5d6a2f36f40499fd484de678b69f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723701, "uuid": "856c823a-93e7-4868-8efe-dde3401f501f", "value": "T1BB268D59BE8E0D2EC8CEB97859970345F326BC5E5610D3EB0900C91E6E633AD5F16F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723701, "uuid": "ae0ab33b-e17b-435b-9308-c3db7df6020b", "value": "98304:AlVQnVQcVQ3VQGVQHVQAVQjVQdVQxVQCVQepxVLdUjsfG/cS0MRUIdofogf3:AFdUjr0+fdot3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788723701, "uuid": "a9197697-9986-465d-b571-4b6505ac35ca", "value": 4754602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788723701, "uuid": "6d323ded-f7ff-47a8-a7f0-22aaf008e36b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723701, "uuid": "47ea8da9-8a86-42f3-bc47-c407e8a55601", "value": "NordVPN_\u0411\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0439.vpn (2).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb3f2872-aa2e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788725311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725311, "uuid": "893d6e88-bee0-482b-8b8f-087c753d46d2", "comment": "Malware payload", "value": "cc8ae43dccc23d134bbaac1096f0d21a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725311, "uuid": "fb39bcff-ed14-46b1-a994-39d8d9f6bdaa", "comment": "Malware payload", "value": "3a297d846199ddff323b30eadb510daedbbd08a9e76949c06df09e1592dd0f02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725311, "uuid": "b55cf74b-9cc3-46f9-b903-9960f294500a", "comment": "Malware payload", "value": "642aecb0b5a7257782dac0e86a082280902add5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725311, "uuid": "b1c3efff-2a93-4c84-b9cd-cc93bb49e184", "comment": "Malware payload", "value": "56a9f06148799b9117d183cc25be29685fcb9e733a2ae3c199f89392ff7751bd14ca6e7c0a293b9b2848169109205a03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725311, "uuid": "e842f840-7a55-4448-9ef3-236788ab179b", "value": "T194C633E2552232B8F5B08B3A41C3D5779B34B5A4DC283AB640C8D8A79FDA4394E1CFD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725311, "uuid": "9e6e27f3-043b-4a43-9caf-26ed2caf4c27", "value": "6b46d14e506e96f6104eaca4ffd6f8c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725311, "uuid": "c048734f-fcd1-41e8-8aab-08517f517e43", "value": "196608:CWU4iZvzOg1EOD2A/6JmpTmc/4iZvzOg1EODHA/6JmpT1JXrxwNc+Hvk3iJFcwA0:VixbEY/6JmpTmFixbEH/6JmpT1d1wNcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788725311, "uuid": "4b9be4d4-1aac-4eef-914c-aea018843277", "value": 11641344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788725311, "uuid": "8e66dac2-f4a0-465c-a47f-3c61f66bcb19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725311, "uuid": "c68964fb-8202-40c5-830b-6c372322f153", "value": "OpenBulletCE_1.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae7cfdbe-a9e4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788693507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693507, "uuid": "03a9a6e0-fded-46a1-91db-0bd4d62ed7c1", "comment": "Malware payload (Vidar)", "value": "fab10eb1cbfa7ca66c200396226a4db8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693507, "uuid": "ee485575-41e2-4661-a3b6-e69732e54647", "comment": "Malware payload (Vidar)", "value": "3a82a336911cd64ecaaef175027d4bf8c3d5243cc426bc204976b7c9f75cf06f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693507, "uuid": "1830b243-9c32-417d-9545-4738c9304055", "comment": "Malware payload (Vidar)", "value": "54d35e3d21d07961e597f612d8921553178b0f51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693507, "uuid": "ac7b3b66-95c9-42e6-903c-6781bff73866", "comment": "Malware payload (Vidar)", "value": "5de203b86f96ecfa37f378a4dcdd3e56056b4c07791cbc5c8974e76e5a2f8582a1327f5abcd4276402f376a33a3ca2e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693507, "uuid": "bcdf2a9e-69a5-4ee8-9b9f-2def75796508", "value": "T16818330B29D590F8C1868A75CA7B5365BA75BC98CB3577E32E40B6702F62BC27CB5700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693507, "uuid": "d81e9a40-52c7-4a42-9285-94ea0cfa44a0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693507, "uuid": "66b1ad27-e2fb-4527-b664-e922353f7d6d", "value": "1572864:NnilTA1QnPEXVPGyXGDHShOEeYgTnoMeiccZ4pwqMgDnBs/YNznR:RF1kEkbDyhOEvGngTG4pwq1CiR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788693507, "uuid": "ead36e4b-4d69-4f25-a2e5-53cde42179ad", "value": 92602280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788693507, "uuid": "43b4e967-bacf-44a4-ac0f-1e0939dad0fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693507, "uuid": "33b885bf-377b-4ba3-b762-ccea339966d1", "value": "3a82a336911cd64ecaaef175027d4bf8c3d5243cc426bc204976b7c9f75cf06f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01002eba-aa1f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718556, "uuid": "3ca72a38-3a9b-4012-a20e-38306e4ee662", "comment": "Malware payload (Mirai)", "value": "669383f6c7f0be104db50e95122cf8ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718556, "uuid": "0ea539ad-cae1-4673-9a6a-af0a0e52827b", "comment": "Malware payload (Mirai)", "value": "3af26ed5454ad0a11a963011d68646354d0cf875da9f3aba7a0a6911cd37e016", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718556, "uuid": "d5cd2d8c-53f0-4dce-9148-7e98852b3dd9", "comment": "Malware payload (Mirai)", "value": "c963b347c2378cff8eba1a2ee9c38a9fde13f245", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718556, "uuid": "f8ec3ef4-f6e5-4d25-9b20-5380741eb853", "comment": "Malware payload (Mirai)", "value": "5b456c19866de65371d6e256569cafd6e59dd8b3c12d2b7389c3108d0990a91482cf4c4e3c5f61b4b47ca039dad811bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718556, "uuid": "2091ac32-8621-4cf6-a47b-e6b65690b129", "value": "T1E4D38D71B058BC96E56409F92130ED340B02BCA0476252EAB4EDF3EC4FB6AD5BD5E760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718556, "uuid": "ce371f08-1bbe-483c-bf93-4a010daa62a9", "value": "3072:COrVFUqEdksstBeGVbIiJgZ/GAOxjvjAyhH:BrVyxuBbInGlAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718556, "uuid": "2e17c6e4-fcc5-4c57-9f53-5ec25edd0730", "value": 132120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718556, "uuid": "a6ac591b-139c-4fe7-bf53-b2591c76a865", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718556, "uuid": "67d4af19-616e-41c5-b6f5-5f4c6b269662", "value": "wj0s.sh4-dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "231449ca-a9bc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788676093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788676093, "uuid": "12786a8f-27a3-4b3b-9a85-4dd83ebfb90a", "comment": "Malware payload", "value": "4e8881384d316ee8ce7fce6340416d0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788676093, "uuid": "6e66a6b7-49bf-43f0-8823-6dfdcbfd20eb", "comment": "Malware payload", "value": "3b3ce93f2d1b3be8f758bf18e9079a120f2c094f8d0d1fad3940d7b0d0e4c4e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788676093, "uuid": "6b3194d2-2df4-4631-a844-75cc78b25c1f", "comment": "Malware payload", "value": "80de2cfea5e6acd9cbce68d7a9385fd786f4e31f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788676093, "uuid": "68443178-ce57-4380-ace4-5eed385487ea", "comment": "Malware payload", "value": "916c12eed46876937379cf10d4237378eee919fd622ec09d3487f40779cb671820f17efaf156bb22b987127dcdd45042", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788676093, "uuid": "cd9d8f5f-0c24-4df2-9c54-a1011d96ab83", "value": "T1BED523C9FDE609B5E472C7B756C3A47EF0287B4589708C9A36CD2B405D57A282C3633A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788676093, "uuid": "cad2bde6-6937-4b7a-a797-82479be2400e", "value": "5a2ed47d8c6c6433dbc831d38c92042b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788676093, "uuid": "b8d8e03f-50d6-465a-80e0-4c868619536d", "value": "49152:BZ36jfWXUSG+1+KWq4Ju1keqPeGIb1Kl8anTMKU9QkH5yKZ2B4FGDjG3:B4WEl++KsJuQ9o08w25yMQ4wDa3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788676093, "uuid": "bc4d7b9e-e70a-429a-b79c-8909907df40a", "value": 2987008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788676093, "uuid": "33925c2c-b17c-49a2-b6f2-b64aca64d493", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788676093, "uuid": "335574db-2812-4ffb-a1ce-38ee2b083f8e", "value": "3b3ce93f2d1b3be8f758bf18e9079a120f2c094f8d0d1fad3940d7b0d0e4c4e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8245f792-a9bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788675823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675823, "uuid": "18bf9526-6623-40b7-a216-e92b6fec3d9b", "comment": "Malware payload (Vidar)", "value": "066e25d2197c2bdd471bb79c1355b84a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675823, "uuid": "32404cd4-1e1b-4289-b5c7-635eb25fefe1", "comment": "Malware payload (Vidar)", "value": "3c047882f1bbf5d8911e4d7103f06cf18b587602c95bf8b4b478b82a3226caea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675823, "uuid": "949bd1fb-3112-4aa2-8449-15075e079cae", "comment": "Malware payload (Vidar)", "value": "08768b0231afbeee3364148d27b38f5a94ad3be0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675823, "uuid": "fc6ac76c-bd2c-4b23-b9e1-9f57e57f766b", "comment": "Malware payload (Vidar)", "value": "33db37939c3a3513488aca2ca3fe01a46cebc630091f178e14ff9ba623ebcbf170deb2fa457fb2520ffdd9a256ca19c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675823, "uuid": "5a866e7a-5cfa-4284-b079-c3ce97860e6b", "value": "T120183303FC8584A9C07AD676C8668292FBB5BC140B3177E77E50B6782E37BD1153AB18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675823, "uuid": "09bcaf99-aef3-478b-8692-6ef1420d964b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675823, "uuid": "a8a9ce79-2c75-4697-bc01-c1626b08b645", "value": "1572864:4SKtuXzsQedQQ/5LMcsLoiSbwrcwUZTjgcg0a+SLi+uPKGmPfFX13Tbt70q:9KtuD1nQRAcCopzwUZTjgLLPmwHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788675823, "uuid": "56074649-63c3-46e5-813d-7f7b42c63aa7", "value": 89559408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788675823, "uuid": "bb1b5cc1-adce-405f-8617-7c85206a6b65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675823, "uuid": "ea8cdd0b-33cd-4eb4-bfe7-3c3e8d319f68", "value": "3c047882f1bbf5d8911e4d7103f06cf18b587602c95bf8b4b478b82a3226caea.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4ff9f62-a9e4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788693491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693491, "uuid": "b82aca6e-cf59-4fef-a188-7ed6a09c614a", "comment": "Malware payload (Vidar)", "value": "5efeb8dbe3a6cf30b869b5b07e5d19eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693491, "uuid": "45d4a7f5-30af-4839-97f0-a0fca8a206a6", "comment": "Malware payload (Vidar)", "value": "3c2d053b27dbe27b7d59610ffca150282c68a93845dfb1618d7b84332765667a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693491, "uuid": "bf309073-db37-4013-9756-3f1a6605cd8d", "comment": "Malware payload (Vidar)", "value": "87d17657fb2e61cffbab17918d69b1d7f37797dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693491, "uuid": "e7923df8-2303-4aa7-9286-0adcd36a708a", "comment": "Malware payload (Vidar)", "value": "4a2a35a193dd5aa28a14ddb69480ae5964d945ec25d8771e963cf3bb619696734c9da477f7358c13b6ac77ef11019d9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693491, "uuid": "4e63ceb6-2bdf-4fca-a7d3-15d3894ad09d", "value": "T19318330768D590A8C49A8B35C67E6662EA75FC88CB3173E32E44B9741F76BD13CB5B00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693491, "uuid": "74e3ac40-798c-4f6c-9011-f2c31fd5a6a2", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693491, "uuid": "e615b687-1bb9-4b3a-acd8-fd4fa86f2afe", "value": "1572864:imCfQ9J7PRW+wulp6MJci5UDVdnRiZuQYSksvOx9OFfkSfdBYvVvDyR14YbxfRhm:9CfQ9J1W+wulUMJr5UDzQZutA+olHfMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788693491, "uuid": "86bb985d-8c42-47ad-a9dd-04d902f939c4", "value": 92582304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788693491, "uuid": "e0331491-6d21-43cd-84e1-2375458c7a36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693491, "uuid": "50bf5092-8f93-4b0b-839e-1899a0a734ea", "value": "3c2d053b27dbe27b7d59610ffca150282c68a93845dfb1618d7b84332765667a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3615f36-a9fb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788703501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788703501, "uuid": "7608fb72-4cfb-4212-a386-9c3459c45d10", "comment": "Malware payload", "value": "05b74bc0d73c7f3e6e63101800c06b2f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788703501, "uuid": "d5b6db62-da6e-4568-8cb8-0ffc30c24cb6", "comment": "Malware payload", "value": "3ca4bd601320b58c7e6c5ee5b348b30e638b881a43451149ff7d0d06c7c7417e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788703501, "uuid": "c424f4d4-d996-4e88-9fc6-030f78450458", "comment": "Malware payload", "value": "03bea708745cf49239ed7661b1d9bdbef629b4c7", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788703501, "uuid": "6c7cecaf-b9d0-48f2-b103-78fa51c0cd5f", "comment": "Malware payload", "value": "3c676cfc0577b9b7f09daa58fcd602c797df2ccffbd7542f2a1866cee35e52df6d041a7be49a4cef162f37a9fd60a78c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788703501, "uuid": "91c9a413-51ff-41e3-813f-bb2fa60fbe1f", "value": "T1F072AF0EEBAC401FF5569438792C433A8664DE70174A7FEA31EE82142E873281F687D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788703501, "uuid": "e39a2568-c63c-4c61-8de9-c421ca6a2916", "value": "384:Cw2BRBi+1tlpKoiGExf/eMW6ahQJg6xy6:CvBRE+XKGExf/eMW6YQW6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788703501, "uuid": "5ce52ab1-a19a-4241-a163-af60434f7db1", "value": 16203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788703501, "uuid": "320900b3-a338-4d8a-a923-64ba43b1d399", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788703501, "uuid": "80afd479-c534-470e-bdbb-f1af85214fe9", "value": "3ca4bd601320b58c7e6c5ee5b348b30e638b881a43451149ff7d0d06c7c7417e.raw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d87e3b-a9db-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788689355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788689355, "uuid": "07ad7c7f-8db4-46e1-bb6e-8e3de1a13649", "comment": "Malware payload", "value": "b0be63058f01f53d97a852be4b493880", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788689355, "uuid": "95f0dee4-9713-4c30-a481-0122b2e1dca0", "comment": "Malware payload", "value": "3e4e2f288e05e626738fd09e76d731a755652ed2d90efe1a290c5f05f51db175", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788689355, "uuid": "f0e3a836-5bb1-4a2b-8112-520919b772a7", "comment": "Malware payload", "value": "a497ad81af95394a369513afce9f7d114e14ccd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788689355, "uuid": "51e618c4-aaba-4759-ac67-aee6844f5683", "comment": "Malware payload", "value": "116d32f869122e833a331ef77dfbf607bc2e2a4620c7dc7fbfaa8a43fdbc95b38c2b31252813ac52737f239b1002d8d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788689355, "uuid": "11c95be0-a0be-4134-81c6-ecf3e18257a2", "value": "T1C4C4F166FB9B06F9D066C1BD89451511E2A2B8523B649BDF07E405AB0F37BC05F3AB30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788689355, "uuid": "c7f52931-8dc0-4b33-b7ce-ad03fceb4f4b", "value": "1d863ec93eff929e76c34a6e5d2ce07d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788689355, "uuid": "e98e4b99-d79c-42db-b9a5-888540672072", "value": "6144:1Ecqlo4zNeqk0fUxDvQ1ckjEz3qgrTvszYHQRbs9VN9fqBWahT4OvZGyJtxl9HaE:fqXF4vX8YHDynvNxjaYNhM88yL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788689355, "uuid": "46fe4478-9a0b-48f4-bab3-4f7540b6f938", "value": 544768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788689355, "uuid": "e313e991-56d4-47ab-ba89-a8fc8517cb23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788689355, "uuid": "6b5fb1d2-9925-4560-bc1a-0bae9367b882", "value": "release.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4173b134-aa39-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788729831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788729831, "uuid": "db6c2798-ef9e-492d-b3f0-8460f8583be1", "comment": "Malware payload", "value": "bb5b172efbc8eca92ef9ffacad53c7a6", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788729831, "uuid": "7d01efb2-0b33-492c-b58c-0df4fb7fd968", "comment": "Malware payload", "value": "3f64b47077def39688ca9d675d05f99449c6e11184227123a03da4e542e7a809", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788729831, "uuid": "4a3dc413-2cdd-4bb6-abeb-904ac9102767", "comment": "Malware payload", "value": "6b16124c4a6852db15ac5d9468be067b61ce049b", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788729831, "uuid": "989c0a09-bb71-480a-83f7-9f4b0288d27f", "comment": "Malware payload", "value": "e94a11dd4dd12e383dbdd515af51a147d2c1fb4697bc87507870c48e8e2e97d42d9d8fb59e0629fdb42e952367cd8572", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788729831, "uuid": "fe1918b3-53f4-46aa-a54e-fecdc4153e54", "value": "T1CBF05C4298A08D29523016146EC0FA055E9AEA479749BD4C76AAA0BD1FC47C1CDCF87C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788729831, "uuid": "547a3dba-e134-4933-8175-4521d9d18d1e", "value": "6:qTIuJzhqIwGiY63fAbplilAl3t11/+SR0AqIbR2AWHwlcXCILV4LKTjawlauF0N9:qTp0JYyg9193R5qsPWDXXLVeuqAEd2QL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788729831, "uuid": "6951c34b-837a-48d0-9cae-c3aa3d1316b8", "value": 446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788729831, "uuid": "b17a63b8-95f3-42bb-9b0f-11e6cfe01cf0", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788729831, "uuid": "89baa463-fe70-49d7-ad19-9d996404bdd4", "value": "goodthingsforbestpersonforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e70933-aa2b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788723926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723926, "uuid": "77a2c958-f019-44f5-8092-0ed23090e16b", "comment": "Malware payload", "value": "81071d8237b879cb867e3ae8c9a9c1a7", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723926, "uuid": "133fb11c-0b61-4cb0-9d16-7389ba0c5756", "comment": "Malware payload", "value": "4078e5813147c155c6c4c58e42b34796733f39c68d4188e3b9595dfb0e3e13b9", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723926, "uuid": "ca44dc3a-2575-4d3a-b07d-94382b609d90", "comment": "Malware payload", "value": "14d842d44a008654283e69fe1757860a4cabca55", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723926, "uuid": "a2a44a0d-6641-4af5-b553-73c760ea0760", "comment": "Malware payload", "value": "5238f911cb73941da3484a4b7ebb3695d04977e10a2fac773e9176fe93a9bec54a436ce045c4fe49c6072837371732b2", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723926, "uuid": "cca91542-d2b6-4bfe-ba12-2056a716ac47", "value": "T101E7010BBD989C2DC587803310628296E721E28DC959DB4F0AB9554ADCE0E6B1F53FDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723926, "uuid": "7bc85418-7e07-471f-8e9b-dedbd7a2d297", "value": "1572864:b/QhMmpsmKuMEDOUVUg2FfBBJkkWrbHcKZhrj5YXtepcVvaRkBB:bYhMzmKqOUCNrJkkWrrcKZLuApcVvae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788723926, "uuid": "00cff7da-78ec-4ffc-bd87-653cae4ef5c2", "value": 69351996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788723926, "uuid": "ab64da08-ab0f-4e73-9996-6c1ffb0fd65f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723926, "uuid": "93c232b3-2fa8-47eb-9bab-84e853d3bf27", "value": "payload.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ffac85-aa2e-11f1-bd95-42010a9c0009", "comment": "Malware payload (BlankGrabber)", "timestamp": 1788725193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725193, "uuid": "125dfb10-62ed-4da5-99da-81f11ce36ab4", "comment": "Malware payload (BlankGrabber)", "value": "17cc76da66e27f9a43ddbcea070918f7", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725193, "uuid": "50b4c050-a5d7-438c-b6ad-3b52245d1dfa", "comment": "Malware payload (BlankGrabber)", "value": "409ccd057be807603e155a2a8579dfd9c7b67c0984db27b5e259fe438ef3fa8c", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725193, "uuid": "b8c40506-a9bd-47ab-a64c-3d55a6dd22b1", "comment": "Malware payload (BlankGrabber)", "value": "2b76e116e1aa0774fd0675572077541585e13318", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725193, "uuid": "813174b8-1efb-4bd1-9906-b76ea9dca270", "comment": "Malware payload (BlankGrabber)", "value": "6a8c0a96bd79a21acdf86ca9793f86f01ce6b70763b1bce826bed6babb8904ba3ec0e4079a7741b81b6e256696babb77", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725193, "uuid": "af15a658-f424-4e9c-a92d-c68fe546bdc0", "value": "T129763325B3F01DF2F9A7297AD882C519D6B1FC550B24CA8B435906BA0F27A604D3FF58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725193, "uuid": "b38ce749-9522-4e8a-bd7b-52be03e39570", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725193, "uuid": "5b983b6a-6508-4e62-8ae3-047c2c6211ba", "value": "98304:wRHDjWM8JEE1rAEamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeROYKJJcGhEI6:wF0QleNTfm/pf+xk4dWROtrbWOjgdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788725193, "uuid": "c2417a36-a6ef-4c37-9453-86e43b8f22bd", "value": 7211232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788725193, "uuid": "346d6af7-f60a-43fd-b85c-e1a43ffb6606", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725193, "uuid": "b441b68d-bc6b-40a9-ad30-146d48eb7612", "value": "builder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7699ed9b-aa2d-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788724766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724766, "uuid": "54029a4c-a7d4-4d88-a9b5-fd2990f8483d", "comment": "Malware payload (AsyncRAT)", "value": "50798da6b70328ed81624d7a9a4dd1db", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724766, "uuid": "8808add6-fccd-433c-8395-54118c4b596f", "comment": "Malware payload (AsyncRAT)", "value": "43316503acbbc5245e96113bd6df3403d770467910feb7d91622c62ae6f02317", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724766, "uuid": "7e8d6aef-3d8c-4617-98cc-58d8b0052cbf", "comment": "Malware payload (AsyncRAT)", "value": "a7d6b8bb5025a77eead516c9f9c8667a4b147e05", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724766, "uuid": "7f1ab722-b8db-40a4-91c6-7a45cdf8854e", "comment": "Malware payload (AsyncRAT)", "value": "e20d34f7b848f5dd6d22e9e130801abc0ea0f33b5781ac4f72e6a92c342b3c8386b0c1691e23e93e6227b418f1cfceb9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724766, "uuid": "e8b11b2c-f80d-4c96-a740-44b56ed1ef54", "value": "T1CA938D007BD8852AF5BEDB38A8B3534507B4AD572802DA9D0DD435AF0A737C49D463BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724766, "uuid": "00955f2c-d37d-4ca2-ac97-bcc3b4b11bec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724766, "uuid": "cff1aff1-a894-46a5-a42a-32886926a49a", "value": "1536:vfxBqtmkAaLF2clJVG/NEbxsJf4HbTfr+8x3wDu3Y6Uk9jg+rr6GbOsKpeQiQKWs:v3q4s6NEbx2f4ADud7r6GiX8QiQ/1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788724766, "uuid": "0ae5dcb4-8127-43db-9f1d-9c7973fed139", "value": 92672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788724766, "uuid": "60199814-308b-455f-9e25-d294a2e7300a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724766, "uuid": "5102fd1c-ed68-428b-be64-54d7029ea3c2", "value": "from_okvip_with_love.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a63e4f-a9c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788680206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680206, "uuid": "171738bc-d7f7-403e-a230-9da451115b25", "comment": "Malware payload (Vidar)", "value": "fddb161de80da1da358ccefd2cf95353", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680206, "uuid": "acbd7a2c-1bab-46b3-9e53-c71e2905b266", "comment": "Malware payload (Vidar)", "value": "44040f1e635a138766212e7b701f60351d0d0b93fe1c4e8288e21e020c5a0844", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680206, "uuid": "d256df57-b572-4689-8a78-5ab9c22f2646", "comment": "Malware payload (Vidar)", "value": "5ff8d8d59629d052654762705878a755dd1de76d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680206, "uuid": "85b13bca-96dc-48b5-af8a-57c5d26e51eb", "comment": "Malware payload (Vidar)", "value": "65fbbd3576c0da2a432d5f80d0deae584a8bb9f0080683c11c367199fdeaafaac0faac416ef4f68b50a82a5d80dc64ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680206, "uuid": "e5565740-3248-4ed6-9bbf-72490c3ab006", "value": "T1E3283307689990B8C49A9735C57E2622BA79FC88CB3173E32E44E9701F76BD13CB5B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680206, "uuid": "8f2c649b-e3e3-4b19-96b8-456baee785a0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680206, "uuid": "afbd35c5-943b-4115-84c1-a5c775117019", "value": "1572864:imCRmnMGeZbm+xyVSeanx7GeWzSQOPIlU2Nun6tbJY5gIn/oCw8DyFvgn:9hmMuy8HxqvSQASU2w69+gInK8OFvgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788680206, "uuid": "81e9eb8b-b52c-4914-acaf-90eb9a20714e", "value": 94679456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788680206, "uuid": "1d76c945-41d6-419d-a6d7-e10c7c4b025e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680206, "uuid": "45ee8f54-9c96-46fd-983f-03c3a17ee8fe", "value": "44040f1e635a138766212e7b701f60351d0d0b93fe1c4e8288e21e020c5a0844.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2683b713-a9d9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788688554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788688554, "uuid": "c162c9a4-8d0d-4b94-9c29-8e08b6fd361c", "comment": "Malware payload (Mirai)", "value": "7ec105649fd4986695460cc3bc0ca059", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788688554, "uuid": "0aceb64d-f5cd-45de-836d-498e2117bcfe", "comment": "Malware payload (Mirai)", "value": "440cff450632f4c3590a9ce70d8022983f11d75be99fd5ff8a92c29d71bec97c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788688554, "uuid": "38912e25-09c5-451c-a8c8-77597323e077", "comment": "Malware payload (Mirai)", "value": "909fb13cd2e2518f8dc2a739cea27079ad457375", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788688554, "uuid": "3683a0a1-bd25-41b0-8c2d-5de690a92947", "comment": "Malware payload (Mirai)", "value": "842b894454e10dcb7228b5a4bff295553bdfb28066370ec3a55d0721de279afbc9d5cc0d0ee0de1b0ef234d047c220f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788688554, "uuid": "462e9ad6-c07a-4b38-b84c-1829edb0c322", "value": "T16FC32A44FD408767C2D227F6F78E439D37366A6497DB3311A9347EB42B81B982E39220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788688554, "uuid": "e0f12b5e-9576-479d-a33a-b2256d4d3aab", "value": "3072:F4A7I8E/YlkflmcGaJ+G9n5aemk66tEmZ9TQ3dL1j5B6A:EWaIcncemIEmZ9TQ3dxj5B6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788688554, "uuid": "65a1f3ca-4304-43f5-9882-5df28be24d94", "value": 121130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788688554, "uuid": "bb19790a-1b34-496d-80f5-72d3d219547b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788688554, "uuid": "ecd7d486-cf5c-444b-96b0-c1c3becad83a", "value": "telnetd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25126cdf-aa19-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788716039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716039, "uuid": "666150b2-c356-4b5d-b4fc-76dcaa672302", "comment": "Malware payload (Mirai)", "value": "ff9e801f8132eee698fa2e6a0831bb43", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716039, "uuid": "f2a47ff2-3444-4852-a8d8-af37fffabcda", "comment": "Malware payload (Mirai)", "value": "445271607b3e018cdcfecb7703a0c14847eeac87a336de91c54faf015caa88f3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716039, "uuid": "b81da297-2830-4671-bba0-84e5b9b4901b", "comment": "Malware payload (Mirai)", "value": "ce0fadc0a8b35f6dbe9484af256795883cd2e530", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716039, "uuid": "3ff830ea-d1fe-45bb-907e-70716a0f794f", "comment": "Malware payload (Mirai)", "value": "f0bbf63cf6347e054374473df2a188a11522f963b507a54d4919debc2561f6835f0f890ee457773f197eacfd56ab99b3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716039, "uuid": "20ee93da-749e-4a7b-9a8f-01512f1ac0e3", "value": "T187635AC5F643D4F5E96705344137EB7BAA32F2B90229EB87E77482327C92642D90678C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716039, "uuid": "ece02074-da4d-43cf-b6fd-2434e059ffe3", "value": "1536:RaZsGDExpTGAtV+/C8eQBW2OnEGcgz3WyL35IUfA5PGFjfnPA:zGYxpTGASC4XTgyyLpIoYPsPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788716039, "uuid": "660e4c63-61f7-40c0-af3b-4cd9b0c60229", "value": 71520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788716039, "uuid": "fc3bfa44-9d2e-4fb6-90df-72fd6c339be8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716039, "uuid": "ef044f98-c8cd-4f2f-991f-58f22bc39ff5", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d90b80-aa1f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718596, "uuid": "c6850722-dc00-4cf8-9f44-8d58f3c98149", "comment": "Malware payload (Mirai)", "value": "85afa7f4fd982c7c70df22f12b7b808d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718596, "uuid": "7a6cdbaf-cdf6-4aa2-93f8-8920708be155", "comment": "Malware payload (Mirai)", "value": "462d3521d4ca4781790f533f9bac02487a9c3234b4656ef532a1fef23ab25725", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718596, "uuid": "8954f70c-ae81-48c9-a0e3-5049d1c0e408", "comment": "Malware payload (Mirai)", "value": "05ce834fb833042ef5e4002dea834f53db20b6af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718596, "uuid": "bd55c80f-156e-497b-8ed7-662c658be030", "comment": "Malware payload (Mirai)", "value": "393d761778bde6afa7e46edf9796fdb415cc80fbc4fef9b50d7456fce416ec47f8127034b5ba6cda795d9ec0306f6d67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718596, "uuid": "4fef7496-36a1-4a5d-83cf-49ac56bdf512", "value": "T134E37D6CEA4EBC42D2C2E7BDA9150FA2713738E4C211C1F32D01569DDDAFAE8CD94526", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718596, "uuid": "49d3e22d-ffb6-46d6-82e5-70bb4faa98cc", "value": "3072:Eo0DgcuLN9r0ActIQhqVWDxmBw7KhRr67/qd:EoXbr0AcqSxmBCKb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718596, "uuid": "a20ff961-3eec-4b83-96cd-0be9b2cd399a", "value": 145504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718596, "uuid": "0c3ef7dd-8f94-449d-96f1-6a7f22707b94", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718596, "uuid": "b786ce66-4f49-4ff5-bac4-eccffd0e880e", "value": "wj0s.arm64-dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "714de8ad-aa48-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788736354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788736354, "uuid": "0d380a92-e88e-4b80-9134-5d36a122ccd0", "comment": "Malware payload (Vidar)", "value": "735de4014969c6106fe08998e9529322", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788736354, "uuid": "dcabed12-0c5c-49cd-b3a0-d958ed66bc70", "comment": "Malware payload (Vidar)", "value": "46dc1914bfd36e66de65da421aba7581711cf761705a0cc8c9affc9f674c710e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788736354, "uuid": "9588a96d-c24f-4a88-be6c-7c8dcca4750c", "comment": "Malware payload (Vidar)", "value": "4fdd7a6c6cf28775e40f6760fc7a31774edb97bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788736354, "uuid": "1d852354-141e-4d1f-8167-6a575bfa6a9a", "comment": "Malware payload (Vidar)", "value": "331057ba8547e6a7198e292f3d9ccd4187a8164921b1bfee7e462bdfce7c52af3b04e035025a39de3b7a679e5965f2f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788736354, "uuid": "12f67515-0298-4d07-aaba-17fbea72ac20", "value": "T1E3867D0BF96001B5C89A9730C9BB12537B79B8489B3273E36D1076746F7A7E0B9B6704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788736354, "uuid": "ceaf55b0-5ea4-4e57-ab07-4914e8accea8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788736354, "uuid": "d0cfbe94-c60e-423b-8c1c-bda82d3551f4", "value": "49152:1DxwUYSBf2JmsDnCsTgklVrgz0LzyJb0zxvbPAY1BR2YsnE2h+NVjewQGJ+/gWEj:1dsCgl5satT1yZqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788736354, "uuid": "195324cf-dac7-4c54-9e09-08ee5d1380b9", "value": 8157568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788736354, "uuid": "cb851b22-e4e5-4db8-905c-982408c400ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788736354, "uuid": "29565dd3-a3e8-412e-b65a-53cd318d8a67", "value": "46dc1914bfd36e66de65da421aba7581711cf761705a0cc8c9affc9f674c710e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "305a7739-a9a7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788667096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788667096, "uuid": "2e0212d7-e5d5-409d-a623-c654102f72e1", "comment": "Malware payload", "value": "b69c50649b80ad521951017bcf8bf601", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788667096, "uuid": "6f1046a0-6f96-436d-ac5d-e1955122e629", "comment": "Malware payload", "value": "473791c0c00404f2205d290911241491c5fba8f6ec8b366775a7c78e1e00a7e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788667096, "uuid": "6b36a49e-e609-418e-a8d8-8519f0d32431", "comment": "Malware payload", "value": "cf94cbae973089d92718416d1edded9696fd9648", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788667096, "uuid": "c39c6098-53a7-43c5-bfc5-9056e255814d", "comment": "Malware payload", "value": "cdf11811efd425a7af8e29cb70db7405b69a98d00d87e761dfbe21a95429fac752f8d86fa30efb1ac99353464053e221", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788667096, "uuid": "e6654acd-7c87-4d76-8552-a701119a553f", "value": "T19FD5239AB9F61574E433C7B28F93E02EB06E77818BA58D5337CC29008D53949AD367B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788667096, "uuid": "c79c4a8b-72fc-4ee3-bf10-3def64dc294c", "value": "fe230628262faec735b6f015758b7519", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788667096, "uuid": "c5e01b17-ac3d-4777-8fff-55a5b4808dcd", "value": "49152:c7E2GIrtGAvg7UbzOkCGCIH7qTmln2Jy5by3GZLZxUQ15xH:czGIr94obzvJ5qiB5/F1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788667096, "uuid": "eab5692e-8f89-4217-aac5-2d8390a89dee", "value": 2961920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788667096, "uuid": "18e9a675-6380-411f-84d8-6889197a4581", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788667096, "uuid": "6271e98d-2ffb-4d31-a3a9-9b0607e91515", "value": "473791c0c00404f2205d290911241491c5fba8f6ec8b366775a7c78e1e00a7e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da36544d-aa16-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788715055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715055, "uuid": "4cf0c6a2-f072-4dc0-a054-5a50457b9a4d", "comment": "Malware payload", "value": "d38c412e9e7fb8a6848b03ebaa55e466", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715055, "uuid": "e827ea22-a1c7-4ea7-9c15-7841239f42ee", "comment": "Malware payload", "value": "47d675be828cebbc3766bcdfb23a1c20de11d1493cbd5908fb50b04efc1ed2e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715055, "uuid": "7c91e9fa-f14d-4491-8303-2f94ade50fe6", "comment": "Malware payload", "value": "97df434997b268f00d748cef2bb8dcf80aa8e128", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715055, "uuid": "6f3cf9ef-15a3-4888-bc32-f4758b8f9804", "comment": "Malware payload", "value": "456439ab58de547a799b4d94328c53cdd14406be1238e2279c3cec2945b28cea45a149225d881d061b77ced3070a8c3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715055, "uuid": "f27f1500-cf62-41d7-9081-fe3d50c013a5", "value": "T1D9F34A86FB93E2F5E69301B0019BE72B5E359D315020D65AFBD03F32AC75202A59F62D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715055, "uuid": "7b34416a-cca0-43ee-bba0-d9f0393fd225", "value": "3072:vBAG7zbTToyQ7MjSO51ZI1co7JVrLVk6qe3TxI1EjT1Lya3rp6Old0+40K:vCQDoyQ7oSj+o7PZk6/139Dld0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788715055, "uuid": "80da180d-7b22-48ee-87a0-744b69c68cc9", "value": 160956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788715055, "uuid": "2a49971d-3f22-42ca-a609-a921641d20da", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715055, "uuid": "626b0e5d-d91a-4cde-9dc9-42608526efec", "value": "47d675be828cebbc3766bcdfb23a1c20de11d1493cbd5908fb50b04efc1ed2e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e99de547-a9eb-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1788696612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788696612, "uuid": "1d4589e5-55df-41f7-839a-b4264d1c772f", "comment": "Malware payload (PhantomStealer)", "value": "db98907f2bba0ee75ce17afad272172d", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-remcos", "colour": "#5D7FF7", "exportable": true, "hide_tag": false }, { "name": "MicrosoftOutlook", "colour": "#CBF689", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788696612, "uuid": "29c8c326-894e-4286-8fad-d7a2b544ca38", "comment": "Malware payload (PhantomStealer)", "value": "47f4d99643603375db3154b155d27b66c3ca0d8d7e083a0fca143bca18d18e64", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-remcos", "colour": "#5D7FF7", "exportable": true, "hide_tag": false }, { "name": "MicrosoftOutlook", "colour": "#CBF689", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788696612, "uuid": "fdb6d155-ac7a-4791-81fe-90fc7687a3f3", "comment": "Malware payload (PhantomStealer)", "value": "b1cbd92fc11c41a28f8e9f7b6214c4736e79212f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-remcos", "colour": "#5D7FF7", "exportable": true, "hide_tag": false }, { "name": "MicrosoftOutlook", "colour": "#CBF689", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788696612, "uuid": "605463c4-f0bd-42bf-8d6e-b03a2710a0f5", "comment": "Malware payload (PhantomStealer)", "value": "f4e4d32197a47588aeb4c4e7095169a28a31f0e567e15523174842e45b781c8096626df9be6529fad3b5a99cba0b9f45", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-remcos", "colour": "#5D7FF7", "exportable": true, "hide_tag": false }, { "name": "MicrosoftOutlook", "colour": "#CBF689", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788696612, "uuid": "f3a99021-c314-4501-a881-44023b2e6165", "value": "T16B85CF7A548335FE87658906A7427F050F6829CB2963980B7DFC30D6EBECD688F18974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788696612, "uuid": "4eb2e964-f415-410c-b43b-e1fd96d07f51", "value": "24576:OT3u0hdSSF4tINPMcv+N092ilfS3W+XdZfTkjHoVqOXy1L7GH3IZ:svF4tzefdwdZfTBi1vGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788696612, "uuid": "4f19f07f-8fbb-4506-b570-f07e1b1f2d9f", "value": 1819624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788696612, "uuid": "a8266b9d-7638-432e-9b29-9b17212f909c", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788696612, "uuid": "9998ad27-23ba-4285-9d0c-e1f2af04619c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7772e9b3-aa13-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788713601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788713601, "uuid": "c4172760-8d66-4a43-9338-77824354bcf5", "comment": "Malware payload", "value": "7a157e80bbe3d2b6bfde402da886cc12", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788713601, "uuid": "91e83fe7-45cf-46de-b948-134f08aaadb2", "comment": "Malware payload", "value": "4813dffc1ed2b2a46c8e980a07edc668a3d26ca20d9cc65dc23b9c9dfd3dc2cf", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788713601, "uuid": "5e39e8c4-056b-4bb1-a07f-8b2c005da875", "comment": "Malware payload", "value": "bd7dd24df4843edd3cc6ab943aa1e4ccdaf805b1", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788713601, "uuid": "5deea798-dcbf-4d2e-a64d-b143049e9dde", "comment": "Malware payload", "value": "1fedd9e0f27aa42156a418ab0e62e4d20f869bac2282c7464b6def6b0c8fbdb3953c4aebe9ed462d1bfefeb6026fb6c2", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788713601, "uuid": "5c22fbab-24a4-4dc4-bf7e-ebb9e7735e79", "value": "T1C6383393FF3A15E8E1D0F73E932E15E50A46F84F990C10A4B3AE21BBBD395855C2191B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788713601, "uuid": "5d1584d6-833b-44b8-9b41-55a939d07b9e", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788713601, "uuid": "61f263b5-27c5-4dfe-b9be-3bec1362a692", "value": "3145728:iDe4SIG3UlBLbPG2S7f6xI/0A/3/vHLosEtj:N4/GKsj6GcA/3/vWtj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788713601, "uuid": "a04b7e21-8fa0-4b86-a89e-8129515be47d", "value": 104062439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788713601, "uuid": "1b61c875-b811-406f-b0f8-5aee19d259bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788713601, "uuid": "85da5765-67a4-4470-9e5c-c2cbd27552ca", "value": "StreamorApps.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8fbd99b-aa19-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788716368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716368, "uuid": "0a5f0bad-0f30-4b5c-8087-b4aa1d8816d3", "comment": "Malware payload (Mirai)", "value": "571e3adf98784baddef6ff820aab541d", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716368, "uuid": "fa2bfc95-8e28-4720-92ff-2a61b29c6f5f", "comment": "Malware payload (Mirai)", "value": "48774f065bdc6e6a65eca8778af0f96ae2c38294246f01ebabc2ed6711f8c9c8", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716368, "uuid": "6da746e0-7c0a-4226-873b-60ca15f8a49f", "comment": "Malware payload (Mirai)", "value": "04deaddbac5d93709cfe513ddb512b39d7e3daf4", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716368, "uuid": "22c49516-d872-486d-83c3-be4133fef97b", "comment": "Malware payload (Mirai)", "value": "07012aaf2ee1ce22e046cca380c4481fd128b1e81b7fadf82a86ce6c4f69f61997ae7270bd704d59a3c8f3573ece2269", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716368, "uuid": "0de77d46-6400-4124-b6ee-88b9791e1ae4", "value": "T1D8C36CC0B643D4F5ED5600752037A7379732F53A602EDA97C7A8AD32ACA1A40D61F3AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716368, "uuid": "88eb1919-b481-4fdb-83a8-0529d747e332", "value": "3072:0vUdNVklf9OaqHo3lK7ngMVm3LD47wbtHgW:0vuNVkd9pqHo3k7C33OwBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788716368, "uuid": "e7bebb41-c81b-413c-8a5a-aa663023e484", "value": 119884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788716368, "uuid": "df494775-bae2-48b5-aaca-26b9c288b877", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716368, "uuid": "6867e5e4-f2b3-4027-90bc-d8d5185fe968", "value": "qtm.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9bea717-a9fb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788703431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788703431, "uuid": "0370b2dc-f1b1-4c72-8874-25ca9f891e9f", "comment": "Malware payload", "value": "734da0911f97081a34ff420f64946d47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788703431, "uuid": "7e8de63b-3af2-4d5f-ac66-7689faf4f78d", "comment": "Malware payload", "value": "4a306628286c4fa614f438f502cc9fe31ae1fdcb3453eb9e25062d39b01fbf28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788703431, "uuid": "32113914-0f7e-4ae2-ba95-86b1d34193c0", "comment": "Malware payload", "value": "184727b68332b28dd04ffbb182c7e3fc6936e287", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788703431, "uuid": "de4ac1e1-c917-4934-839a-65ffcfe37c7f", "comment": "Malware payload", "value": "22c8994030ecd898f6dddee14d79143e6e172cf77128cd1af1e3882b3167b04e02d3765727fc14e3b91d263f86440802", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788703431, "uuid": "00498280-dd52-46b2-8115-b53fe8cb92c6", "value": "T13EF733ED85867755E713B2712F661BB2E02821C9026E493730CCDD79E63602BDFE847A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788703431, "uuid": "71c4462b-5939-412d-b755-c0c55af33e42", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788703431, "uuid": "71627cf7-d5f1-4dbf-b47f-4cab65b736ab", "value": "1572864:rLdkrEwSIjpyJJf1VDgKZipTenyaX103SAr4r3x/GlCQ2TsbZE7:r24L2yzfVZaLB4bB5YbZE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788703431, "uuid": "58f01e9a-03b9-4d14-884a-8d6ad5f86caf", "value": 72150498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788703431, "uuid": "62a07278-aefd-4941-aafe-f7c0dcc41024", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788703431, "uuid": "1866ba3e-fd17-4b50-925c-532c371429f0", "value": "CrimsonMods.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "311e5924-aa2e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788725079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725079, "uuid": "11b3c51d-d0ad-4bb6-aed9-f8abc6e55f83", "comment": "Malware payload", "value": "b59b6b5a88cdd64ebaf37c743ea965f8", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725079, "uuid": "be0a4d7b-629a-45c8-bd74-ee0afccca640", "comment": "Malware payload", "value": "4ae3908e2daf0d4ddf63935ef64b29d1707d217354168bad94bbdfec85e045f5", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725079, "uuid": "5180a9c1-4626-4cfd-9e8a-3325f328a5ba", "comment": "Malware payload", "value": "8e4ca7ec59983d1d26c554a832b89a9ef3358a04", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725079, "uuid": "584c8dd8-cebc-4cfa-a6bb-26153de0cfc8", "comment": "Malware payload", "value": "5e1eb363b2d71190372f03525ebe043ce6d624b853af762b01007a4c1bb8b4479735bed00f658007c572a60fbbd91e40", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725079, "uuid": "df6eedcb-6f49-4d7a-82a0-4f0c26fd3958", "value": "T14BB59F1BA7A900ECD0A7C179CE074A17E77174091371AADF16E08AAA1F27BE14F7E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725079, "uuid": "8ed0d242-8252-44ca-92bc-3754664d8b61", "value": "77fbfc5b6c1c876f8a1eba43f6966392", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725079, "uuid": "ddc4229e-34ab-436c-a4dd-376bfd2729c9", "value": "49152:LU6jcBrnlbM6PmqZI5qoBVdD/SVhBFzcYPHO:nCnvcMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788725079, "uuid": "e04dd18a-190f-4c49-b905-e9c7f1a534d8", "value": 2428928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788725079, "uuid": "4fb3f177-b073-4a44-b79e-fa6806108f8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725079, "uuid": "d7311c9e-f085-4c8b-ab3c-9d228d3a8b69", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3806314-aa2d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Amadey)", "timestamp": 1788724895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724895, "uuid": "0acb7f5a-2661-46ff-97e8-b531c1e72f0d", "comment": "Malware payload (Amadey)", "value": "045a3a09458a21a8b3b2d3011d1e02d4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724895, "uuid": "22413690-5878-4ca7-967b-0c537f162b92", "comment": "Malware payload (Amadey)", "value": "4d10c9b2408ba1f4cd2d3a776808a35528164e2963f497c4c06725ac840ea611", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724895, "uuid": "bacfa0ce-abbd-47c5-9662-ec7a5ffb3e71", "comment": "Malware payload (Amadey)", "value": "00642e3d2a067cd64089279e8a4e7db9dcd9f8b6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724895, "uuid": "00322d76-8239-45d5-94e8-0b5a7442e0c5", "comment": "Malware payload (Amadey)", "value": "1db0f1ef2ff7ef51d05485cb94a0c83c94164703eaf3603ab26347d4adcac42605a18a797e764b79cc5ba2826ae246ac", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724895, "uuid": "e3bf0008-11f9-41ea-8ab6-47dee67ae92f", "value": "T19A8533575B9335DBD63A1536E7452AC82B74331B301E35FBBE08A82A91C337DCE284A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724895, "uuid": "accb13da-4551-46b2-b589-701d948a2ba9", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724895, "uuid": "a0a55e2e-ee09-42b4-a6d5-988f5f216d13", "value": "24576:LfuAgZXWbHZptuQiY0ZjPz/WdYAN1HXLv66J+KdHCf6ILND/KGgJ1sfp1e2hiyM:LfuVXiu00Pz9AHD66JnIL9KyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788724895, "uuid": "c87a3175-fb7f-4455-b39e-8c85dd88afc8", "value": 1852416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788724895, "uuid": "8e4e54e8-6ff3-4f9c-bdb0-16faa8ece61b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724895, "uuid": "6a044611-eeab-430a-ba81-641611962c4d", "value": "1l74V2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76913bf4-aa01-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788705868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705868, "uuid": "edb6f416-8eb1-4cb2-9836-db796a69272e", "comment": "Malware payload (AsyncRAT)", "value": "ffc891b9126ffd173fad71e85d0b1586", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705868, "uuid": "ba35fab3-c44e-48bc-8a70-73d8bfe85bd9", "comment": "Malware payload (AsyncRAT)", "value": "4d3b6e67870e43cdec894fcb40ba6d8ce064d020698122fa2ab5a688cd137e59", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705868, "uuid": "845c2241-18b5-4376-828b-d49b3f758fdb", "comment": "Malware payload (AsyncRAT)", "value": "e20f322eaa95fe87770d52407de20797ee70d2e9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705868, "uuid": "a29f1887-cb8a-4af5-8644-58c8f68da3c4", "comment": "Malware payload (AsyncRAT)", "value": "85bbedaf7ff00cf6f388b816854bc762e17b576c5514b27cd3f6a048da2f3afd8f614ec1d564bb953b812f831adbbef6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705868, "uuid": "f61b5428-4933-496d-950c-0559c5e4e2a5", "value": "T186C22B0833E8C571E2FD467A98338600A779D56B9913D75A6FC890EE2E237C9CB14BD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705868, "uuid": "5d1fe6f0-d987-4b33-9a97-ee2d32971b6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705868, "uuid": "22f275f8-57ab-43d0-babd-ec1844cff7a1", "value": "384:cTdv2D9YfxWQsKHrSKfWSEHsH9qbuUsYbQxnCJfJBndnjJ8K/Y+:qdvhPrjECIbmBiBnV/Y+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788705868, "uuid": "ada3df35-85af-42b8-997e-b79316eb0f6a", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788705868, "uuid": "1f119f48-1435-4912-aaf1-9e45bd338b27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705868, "uuid": "6a01cc9e-b479-47ca-958b-f111b7881214", "value": "SODO66APP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed2f6af-a9cd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788683763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788683763, "uuid": "380f4969-adec-4287-84ee-c11da5b6ffce", "comment": "Malware payload", "value": "05c6081939ba7bd675c82b4ab754e600", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788683763, "uuid": "726951d2-4ffd-41a5-b715-83800376b4a9", "comment": "Malware payload", "value": "4d50834c2d3c506e8e93a7a025a7ca7777d0509f2e878dbcf43beaec8d183c2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788683763, "uuid": "15fedfc2-7a64-4d02-abba-f1ccb9b42092", "comment": "Malware payload", "value": "a2aa7b154fb5a7f8a85e5b0d8cda6784daa95f03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788683763, "uuid": "e5f7febe-d71c-406b-b1d9-570fda8595ac", "comment": "Malware payload", "value": "c8ea6ad3dfc4aaec981bdba5971e66498417f25a9fcb0ccf214b2827e0109679d38b9bf5faa00325f7faa7583b7ac6aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788683763, "uuid": "42e93796-f906-4199-aa57-7b558353e3c5", "value": "T1C8F37C4A73E510FDE1378239C9551905F772782607209BAF07A04BBA9F272E1AD3EF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788683763, "uuid": "dfeb38e7-3f34-40e6-9cca-4fa0ddb590ab", "value": "30750ba96e4675bed41fdebb145fc411", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788683763, "uuid": "9915e1d3-7557-4671-ae41-b8cc97a371f8", "value": "3072:0d6/4CsQSODs98mIOWgxwlIFaKAzhDEWxrGvjvHXrb15STd:0JCsDSs98JswWaKAurR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788683763, "uuid": "535507e3-0606-4527-86af-2ec672b07e3d", "value": 169984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788683763, "uuid": "71624c65-a1e4-42f2-ad27-2de70a5771df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788683763, "uuid": "4ed7f2ba-af82-4e9e-81b4-b0a99e1a0547", "value": "SecuriteInfo.com.Trojan.ClipSpy.124.5144.24302", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b04a7578-a9bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788675900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675900, "uuid": "14af7bd7-ee80-45ac-9164-50c214e3641f", "comment": "Malware payload (Vidar)", "value": "7ce5ebc04421d0935944f4546afea009", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675900, "uuid": "647a2796-795d-47f1-802d-6e5521edd0a6", "comment": "Malware payload (Vidar)", "value": "4dd80963270e18451e18e53141ea31de3cc8ff6afd91776e6a5ff2f5d79a6a73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675900, "uuid": "1350ad01-8279-4ecf-a38f-e5398ee60b29", "comment": "Malware payload (Vidar)", "value": "dbea07e8eb4956dc9c53a82689012acdbde0d6dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675900, "uuid": "6db756d4-33c3-4edb-8ddc-76fc780fb755", "comment": "Malware payload (Vidar)", "value": "b187c2a60daf82d0cccad295071f6f398edea72b1bfeb799c1a07e478b366b9001e62f50f0bbd628ffb578fe20afb8f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675900, "uuid": "47331a51-5bfb-4541-a723-380d2cfc6522", "value": "T1E0183303BC8544A9D47AD67AC55A8262FBB5BC080F31B7E77D50B6382E37BE1413A718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675900, "uuid": "f2c84231-3252-4a02-9dfd-f21ec3ebaabe", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675900, "uuid": "c0663bc2-21d8-4ee2-b786-46d6cfe148e7", "value": "1572864:47nGFFjD89nPOoEhwMJ17zfyaYgpKvT8vbs24XTSsILTLPTHLT3S:ZFNwIoEuMJ1f6aYgpKvTw4XTSjvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788675900, "uuid": "2bdf8ae2-75a7-47fe-b65a-63b962b42567", "value": 92705136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788675900, "uuid": "57316284-2e3f-45f0-a635-b7e519cd8a30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675900, "uuid": "b087f8ad-666c-4048-8188-1a47dd4a7c2a", "value": "4dd80963270e18451e18e53141ea31de3cc8ff6afd91776e6a5ff2f5d79a6a73.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f9cd23e-aa01-11f1-bd95-42010a9c0009", "comment": "Malware payload (SheetRAT)", "timestamp": 1788705937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705937, "uuid": "ec8c7d54-792d-43be-8d35-8c9fe4c78222", "comment": "Malware payload (SheetRAT)", "value": "7cf6e08f2de8e9f273f40a9a89a12457", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705937, "uuid": "f9f9199f-c788-474b-bd3f-d0eb9431ff72", "comment": "Malware payload (SheetRAT)", "value": "4f17b99bbfb7aae9663ee90c3f65f076bb19a848d62393c3a5d835c9c3142200", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705937, "uuid": "fe5aae13-7d3b-49fe-a64d-48f435a9685c", "comment": "Malware payload (SheetRAT)", "value": "3f14f533d79b45ab92e6d9ce6298eb03c9a1a14b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705937, "uuid": "13d2eecd-5952-40fe-aaec-7701964c2a7e", "comment": "Malware payload (SheetRAT)", "value": "3f3c50b71e467d10a7c1559bdc35250f43233a068262f67e4edacfffe5558b4ecbaa562e42a67b3a8a0c6ec035a8feb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705937, "uuid": "8248dfbd-ffe3-41a8-9905-57e1ed2b8f21", "value": "T1B7C4C20CFE91F805DE1E3DB7CFEA11004B7161C1AE1296462119AFFE8B653B259E267C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705937, "uuid": "0a1b36e5-341c-42a6-b0f5-71bf2c283264", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705937, "uuid": "90cbc191-cfa4-42b1-88b7-3d6ec5be04d2", "value": "6144:Tw1+D0Gj58OA1bJ6lL0JBVGyPvqjVHtWYjn4tz/mbFbJ+qmGoVFwntUwF:8+D0GNmVgLiyVtWYstDGb+qm/VFwn+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788705937, "uuid": "54e1d35f-98da-4e43-983c-b04e70382be0", "value": 544768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788705937, "uuid": "e0570e16-e70f-4d79-b61a-e1c6f57e4730", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705937, "uuid": "18c12dc5-ad2c-4595-b0e3-f14481bd6812", "value": "spufer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873466dc-a9c7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788680985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680985, "uuid": "fbe8dc00-13a4-4148-afcc-0d78b00f9552", "comment": "Malware payload", "value": "cdd44f41d29f3bb135e45773b961137a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680985, "uuid": "ae0d0e11-3017-44ea-8526-ca9b98db5384", "comment": "Malware payload", "value": "4f72ba825134a9f2cd3330db1a8bf3de770b9416bf481502c439d40cdb9c32b4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680985, "uuid": "15c3c50f-5514-43fd-acdf-0d0d458717e7", "comment": "Malware payload", "value": "2cbeef7e78bb297f87a8011a596c27a2281ac124", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680985, "uuid": "0a0a12b7-e961-4569-989a-ad835cbb4926", "comment": "Malware payload", "value": "502a156964dc1353e34366e21f47ce34f40bff85e5bd3098ed5f59e5dd537efb703ae3fcf0f2311677beec7e8b28a439", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680985, "uuid": "529e85cf-479b-434b-a5e8-c55a76cb1a19", "value": "T104F52F921685B0397BAD57ACF3254D28C90533C32B69BB0D316C9104EBB79C21B6EDE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680985, "uuid": "05d0fd0f-a3e8-4294-9695-40d10564c537", "value": "98304:KVjqXWe72J6V0iiU4CawTS119eKm368PQLR/MIz7z:1N8Rm3JeEcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788680985, "uuid": "4ed9cc81-7fd6-4521-a272-01d3d37f383f", "value": 3375359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788680985, "uuid": "11a3b6e5-e054-4674-af09-4be6544744aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680985, "uuid": "ac91958b-ed41-466b-bd26-b2575e9426cd", "value": "Scan Canon 20260609 0001.pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0d7de4-a9a9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788667973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788667973, "uuid": "393ecc3a-89ae-4248-9a9e-ea08534350d5", "comment": "Malware payload", "value": "398e023349263b5ac7e6535643ee13f6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788667973, "uuid": "b6d221f5-d689-42eb-b04b-04449c06db98", "comment": "Malware payload", "value": "515822954d714ca7c62a67140f19e1ebf77f43d315e0a3e7d8f1fcfb67151e4c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788667973, "uuid": "cea699f8-c1e5-4752-9445-dbb736488c54", "comment": "Malware payload", "value": "958f4956bb003e497c1698057b4617747d353aac", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788667973, "uuid": "cb9b44c8-8946-4398-a319-be3133546c6c", "comment": "Malware payload", "value": "2fde10a8478748eb8be1e7f0dcc3bc95691fc3ee6d3613ba25e5f17ee76d7546ae718a232de4c627512cd3ac21ada26b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788667973, "uuid": "0c2ba96b-f538-4ba0-bcf9-a1f12f4c89e4", "value": "T111237C652A817C14AA98C4371D7E2F0CB9AD43E6324452ED7FCF3CF68C4A69DA21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788667973, "uuid": "e7ecf4ce-f373-4249-9f3b-211abf920d73", "value": "768:RXOGVvJ9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:tLacr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788667973, "uuid": "2c700082-f88b-48e7-a007-2d052a7b3e1f", "value": 50047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788667973, "uuid": "576ecc60-a1cf-4106-9ae7-9eff72cbff4c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788667973, "uuid": "8d5d1805-e5cc-4050-8704-715ddc2a5277", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e3c98d-aa19-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788716039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716039, "uuid": "cd80a641-afcc-4b0f-83b0-4e9f35dc0ade", "comment": "Malware payload (Mirai)", "value": "2474cd09639129ccff25ed0ab36f2c87", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716039, "uuid": "b3444559-5494-4e6d-a72b-e17606e0e146", "comment": "Malware payload (Mirai)", "value": "521f98a73c97bf73fe0bfae7d10348ba92f9fff96e9d9e8e03e0b3c7d85a2cce", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716039, "uuid": "6ed32cf2-e4c9-4b28-9cf1-ec39dceb63bc", "comment": "Malware payload (Mirai)", "value": "4773b87c83d712b8c3d71a902775731f8f79bb5c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716039, "uuid": "31625778-8428-4928-92d8-975030a4d91e", "comment": "Malware payload (Mirai)", "value": "05e48747aca09f702ea6c949120ca4cd839bb4cd94892e0d1e670093e47aed7c78b9e4d941e74529df0164024605e5a0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716039, "uuid": "b334a009-fd05-400b-8577-a42aa3a2d2f9", "value": "T1FDA35B26B974192BC0D4A47A22F74721F5F647D925A8861F7EB20D8FBF306403613BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716039, "uuid": "a7580970-5727-4177-b16a-290882c8d3e4", "value": "1536:6bZJlgR5uSbjm7OnjqnRkIW1WeBD30sreMExlM5BoHwULvt074a:bbjm3De130TMExl8cA4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788716039, "uuid": "3730e709-bdcb-405b-ab2d-937d40334786", "value": 100200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788716039, "uuid": "9154aa34-743a-4c76-98ec-d0c32225657a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716039, "uuid": "ebb4a359-b099-43c5-be68-02d50d4cc450", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be34e093-aa20-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788719303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719303, "uuid": "67add9fe-c4e5-418b-8881-49eb0b0b6274", "comment": "Malware payload (Mirai)", "value": "4e0ec65c62216f36d5b503f3e25b1d0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719303, "uuid": "3c7bc21a-8658-4dea-a96d-274708b4aaa4", "comment": "Malware payload (Mirai)", "value": "523568ad4ea5ae7640bcc95917724f471612cf4972fa83aa940d589c010184b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719303, "uuid": "548d0ac4-1ef4-4f01-8963-75da60665dc2", "comment": "Malware payload (Mirai)", "value": "4836e1775ecff9e72539f8e682935b2110862fcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719303, "uuid": "9d88a7e4-9a00-4e79-93ae-096683dca8d3", "comment": "Malware payload (Mirai)", "value": "97d3ed7f61a90ac5ef38c0e5af76c183afeb28d39b3f0dee9f18eb5c008c69b626aba0382aeb43b758019b58f23a3cdb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719303, "uuid": "30a3b0cd-538d-4aea-9723-23740aede6f7", "value": "T1BFF33B47B7208FB1C368967109B3CB67A6E6269216E19985E66DCD107E3035C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719303, "uuid": "8782cc93-0edc-4308-83eb-f0361b6d467a", "value": "3072:93VJgTdgahP/2o/ZrTheIsnjCWRXFm4UpM1wLxpPNNOziH4fam:9FJMgWPZr8IaCWReS1WpPeN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788719303, "uuid": "73a7a028-2e3e-4ddc-838f-8a43120934fd", "value": 166976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788719303, "uuid": "435bd093-68f8-41ec-99f0-b423f3557963", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719303, "uuid": "3bddd75d-37bb-486d-9dae-81c2492faf27", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "006cc4d4-a9d3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788685913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788685913, "uuid": "464269ef-42a7-4fe8-97cf-45ff0626e58e", "comment": "Malware payload", "value": "4963d8f5e6e05abe73698c51a944ac5a", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788685913, "uuid": "5b30a8fc-6ef2-4393-ab2b-628678a92734", "comment": "Malware payload", "value": "53b91f312d840447ddc3e340f8e3f27d0fc93e03765957392b81a1f73fa4dd2c", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788685913, "uuid": "27cfac85-f8dc-4857-9477-1b085d18aee4", "comment": "Malware payload", "value": "4dd5018dd05155d29a556b91b6619806b067b92a", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788685913, "uuid": "c56efb39-3729-47d5-95a0-926ecfbc2725", "comment": "Malware payload", "value": "604d7b07e5fed1baea0e9c0a4b54137569b045d9704d7f982a0d16b5c903ecbf52665c0111582030b10a120ce8fa718d", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788685913, "uuid": "e4a4c8cf-0733-4b7d-8902-bc38c7e09c30", "value": "T19811543B49C0000148F181603DB2315E7092F99CE607DFD1E8AFF2669DE7FC15AAA648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788685913, "uuid": "f7fecc00-09d7-47bf-bc32-b758f14e27dd", "value": "24:hYjAvuAj3alxYJ5ZveDe67AW0bpdj9oYyxhoa:7aZ5Pn3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788685913, "uuid": "9b852e72-cf35-462b-a51c-a5eead16b8c4", "value": 970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788685913, "uuid": "b0e647cf-54af-46e8-be3e-a0af1c1f3424", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788685913, "uuid": "2486e002-0c71-491c-99eb-21237b57b855", "value": "Rz.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb040f35-aa1e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718546, "uuid": "3b957bf9-4b73-4d80-a17c-51050bf92080", "comment": "Malware payload (Mirai)", "value": "55376d63b8cfdf54d9b8cc7074705863", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718546, "uuid": "afca5fda-503f-41dd-9372-cfd5401a2676", "comment": "Malware payload (Mirai)", "value": "544d81990a0f72730a8321c290324de465ba19e16b7a77ce0e559ffe9d63bdab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718546, "uuid": "c111cbf1-b598-4cbf-946d-6d2b16c2e726", "comment": "Malware payload (Mirai)", "value": "7dbdba8c546b0bcccbfb1398318e4e0e1dba9be0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718546, "uuid": "fa0eee10-ade8-467d-93f0-234b0373e87b", "comment": "Malware payload (Mirai)", "value": "6deeb2522f49c51ee8c5385f4f6e98c55ac69083a50f6ab3ceed3edf444e8fc0a0ec0873cbd53b67ef97a249acb050e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718546, "uuid": "e0533548-aa22-4f32-b741-ad993ce3640a", "value": "T180530197E92CE2BAC120B974613ECF807A8678638967674F3051317B4D3ABC651A0F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718546, "uuid": "03154598-fd21-48d2-a103-6a4f2ff99c11", "value": "1536:WRsKc/oTLdQOnYHMf8UEwkINRfaF9o516FocykSVNOnPM4C+3:vKzTLdQOYHRENC9NycykSVoE5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718546, "uuid": "e79fdcf8-23f1-4488-84c6-bebf2cfa6d83", "value": 63504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718546, "uuid": "8be88bbd-81bb-40f7-a039-591437261528", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718546, "uuid": "7566ab5f-c831-45c3-b936-40bf4d44dd0d", "value": "wj0s.x86_64-dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d17709ca-a9bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788675956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675956, "uuid": "d9fc1272-26bf-4a29-9ecc-75fffb4555cc", "comment": "Malware payload (Vidar)", "value": "58657170c29c614ad2fbc7cd44ee18ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675956, "uuid": "7bc3876b-8d44-409e-bcfc-66b095de7011", "comment": "Malware payload (Vidar)", "value": "54f44827efaa45b8dd9a6d8cd2925dd41148eefd0a1112cdb212f24d12d26df5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675956, "uuid": "fe42cd62-a02f-403a-bec5-a905141f03dc", "comment": "Malware payload (Vidar)", "value": "a38887f51b36bbc4e4ded9f3e85471d1af9b989c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675956, "uuid": "09100174-e491-4286-9e55-96dc7d3ee0c2", "comment": "Malware payload (Vidar)", "value": "7529f85c4ed6ef1c503772631e00021ee822304ac9dbdf75d5ce84dfb97f7e400a2ed1f4c78f5268f2e3d489f3258d16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675956, "uuid": "0a29401b-f7c3-4d80-9893-04eeebad96f6", "value": "T1E9183343BC9544A9C47DC67AC9668262FBB0BC040F31B7E77E50B6682E37BE1153A718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675956, "uuid": "fc471f3a-c0e0-4497-844f-7c37e183abd8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675956, "uuid": "25f40a1a-14bf-4b8a-9152-2f5a9cdfffb4", "value": "1572864:4DKZVuVWmIB+aBuRgkor5hkYBuC6+F/de9E9ofI8J19OZfh2nRDbFm7EL:qMYVWmIB+aP7VHBx/dEE9w7OZfkRHY7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788675956, "uuid": "0cfbd959-a831-480b-8a9d-d69321575583", "value": 92705136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788675956, "uuid": "544fbfc7-3315-4cc4-9b65-c34019ec24fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675956, "uuid": "1053d5b7-cbd5-4ecf-a703-f40c815d1600", "value": "54f44827efaa45b8dd9a6d8cd2925dd41148eefd0a1112cdb212f24d12d26df5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82fe3f3d-a9fe-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788704600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788704600, "uuid": "091bf00b-7922-41ef-96f1-16fc20d3d118", "comment": "Malware payload", "value": "06014fb9c3522720f13dbc951e4dfd97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788704600, "uuid": "afef55e3-5706-42b2-986e-25803562be22", "comment": "Malware payload", "value": "552d43d78fb457f784374e932da0666c1530bf386e144ce8ba4f5631cb0ad0d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788704600, "uuid": "49dd70de-03a0-4b31-83b4-6c2dc8737673", "comment": "Malware payload", "value": "10597566013c9098c4f5fe60b58a8dd609524766", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788704600, "uuid": "d7badfb5-524d-4c64-b37a-f10a3d832644", "comment": "Malware payload", "value": "4141f0872f6354a71b120d01e7dcca6772d71eec9670ec2f0d6aa006f5c5bc327f2eea2d9a351868e74f6e49f8a0c946", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788704600, "uuid": "c6167334-3e68-4fd2-944b-80e946f8c703", "value": "T154B63807EDA554E8C5AEC13489729523BB717C492B3123D32BA0F6242F77BD0ADB9394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788704600, "uuid": "0738db25-df91-41d1-b108-f09c9c1d23b6", "value": "4e2bd2c481372f7ab13b83b63b424e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788704600, "uuid": "42b40af4-d0c9-4094-a4fa-0a3ce8451a7d", "value": "98304:1PO7n7Li6vUTb1JH8RH8OAsoDy4Y3Z+E:Javi6vzRH8BlDs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788704600, "uuid": "f42a9580-d9e6-4eb4-bb1a-26f9af103559", "value": 10847744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788704600, "uuid": "74e5aaf4-665b-4096-8016-3b7f69abab85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788704600, "uuid": "8edecd53-a649-4cae-9e41-dd5d8e08a3c1", "value": "552d43d78fb457f784374e932da0666c1530bf386e144ce8ba4f5631cb0ad0d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "969aa7ed-a9bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788675857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675857, "uuid": "848f6fd3-c8af-41e8-946a-3f5d743a3f4a", "comment": "Malware payload (Vidar)", "value": "bdc08211dfa4481fe7b931843d76e652", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675857, "uuid": "df20f0eb-58b0-47ea-b285-81702aa66a05", "comment": "Malware payload (Vidar)", "value": "5571c0d773d82cd7df0b4dd2603111c74368c287398e8d1363c77975e470d31c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675857, "uuid": "a79fffa1-f1b2-4bd2-bfc4-0a65e71ded6d", "comment": "Malware payload (Vidar)", "value": "32b2c4b86c5ddfe07fec0a7125a422279025a6b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675857, "uuid": "309fc09d-8170-4958-9ff1-b6355ccb0381", "comment": "Malware payload (Vidar)", "value": "98cb601ae61a27980313916a330cca9343f2166c2300a7528503e39d4d79c79712440a79931f27c405e7d8f2f3f154c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675857, "uuid": "06cf3d2f-9430-451f-a66e-e2ff6c2f0cd8", "value": "T1E5283343BC9144AAD07AC63AC56A8292FBB5BC040F3177E77E50B6742E37BE1513A718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675857, "uuid": "9b16c47b-69cb-42cf-ab06-536f8d6fcd92", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675857, "uuid": "773efebb-4f19-4d2a-9abc-78b399b9b7ed", "value": "1572864:4tRxhs/BuT0DTOrr4YWVdc8RlgLYT1Bqpe0z0HDTpSZg+2SA2TffMtAyTaLn:ohsJm0i3WVdVALYRBqpVz0HPpSK+2S5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788675857, "uuid": "0fbf399d-255d-4629-b937-3b12a368935d", "value": 98996592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788675857, "uuid": "8845735b-1384-42f2-97c5-ec2e1e30693b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675857, "uuid": "b4aefebb-13ba-42d0-9e95-f5f9a53f8206", "value": "5571c0d773d82cd7df0b4dd2603111c74368c287398e8d1363c77975e470d31c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a15bd8-a9e4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788693483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693483, "uuid": "5e5682de-98da-46a5-9700-9e3c42d4f97f", "comment": "Malware payload (Vidar)", "value": "eb651421300630e2695d872db691ef52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693483, "uuid": "ff5cac59-0e67-4a45-871e-d648d7652eed", "comment": "Malware payload (Vidar)", "value": "559077cee53b8cf153d196bc302e2236790ac2d28dd0fda43fd81c20a0601dad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693483, "uuid": "4443153f-ad26-4e0e-8f25-5a9c1b8f442b", "comment": "Malware payload (Vidar)", "value": "6fd3f498cb11b2cecfa256b2fed0b7a1a5996227", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693483, "uuid": "a92a501c-1a89-4707-a535-f99cd1974669", "comment": "Malware payload (Vidar)", "value": "9df7fc83d80d1554ff07631f08c9ee73dc49e7ab0bff260896150d1e37582a3c994ec71776b49c82c8f4c85ed6e56868", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693483, "uuid": "04f698e9-b1d3-4f37-98bf-f6dae44aa059", "value": "T1D818330769E990F8C18A4A75CA7A5261BA75BC98CB3077F32E44BA701F76BC23D75700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693483, "uuid": "20c8bc65-f170-4f52-bbe7-c2efb8454faf", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693483, "uuid": "98ec5abb-1fc5-475f-b959-306b62c1e278", "value": "1572864:N2ldxS+bF+qntl+AegOZ62PL/9TzCZvYJsimHF0U+4LQy:wdxSK+qntl+AegP2RT25YJsimmJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788693483, "uuid": "d14e3032-9a3d-44be-ab8a-31ceca003b88", "value": 90505128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788693483, "uuid": "1b04b0aa-7fa8-42a3-918e-9f8ae3bfccec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693483, "uuid": "7c7e029f-63d1-4814-ae25-38ef0fae14c1", "value": "559077cee53b8cf153d196bc302e2236790ac2d28dd0fda43fd81c20a0601dad.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d26df6a-a9c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1788680566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680566, "uuid": "ea9d322e-76fe-40ba-9fb1-302b23429ea5", "comment": "Malware payload (Stealc)", "value": "0b5b7b13e69539c68703ecc6dcdf7329", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680566, "uuid": "24dc059c-3c78-43c4-828f-e97a3e51064e", "comment": "Malware payload (Stealc)", "value": "56740ce59e959dfcc52e4aeb37b52765f265e5c47ab4af7f08cc150f3656a4f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680566, "uuid": "3eda2fa0-5800-4bf2-b0f9-979e0bf507e3", "comment": "Malware payload (Stealc)", "value": "d8715666057cfd472a5eb251d89880a1a214d141", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680566, "uuid": "1605832f-9e40-4635-b84f-51543c048e9a", "comment": "Malware payload (Stealc)", "value": "108cb0d48200b70134057d17fe121851d2a97aeda541a5b3a2c641f060e71a39f8961ab20f41f5e0029e3b36531b7c14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680566, "uuid": "f968961a-a091-484f-975c-8402c2867804", "value": "T186B50293B51007B2FB648AB5B0761C7169327E67F771B5AD72CC726806326928932F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680566, "uuid": "84409796-12a7-43aa-99a2-c0389ad9b74b", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680566, "uuid": "20c2d53f-6a6d-40f3-a52f-aabf35c588bf", "value": "49152:63tdRRIz48yQFp5RvdNWcdF720PId284/wagLmbqJyc:63tdsz481pDdNFQ8wvAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788680566, "uuid": "1b51b81b-1288-45dc-b4d4-7a325532bae7", "value": 2270720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788680566, "uuid": "a7d38fd6-0d33-4abf-8894-24383221452e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680566, "uuid": "a1d16a5f-0ae5-474a-9a8d-e0554bb5be86", "value": "0b5b7b13e69539c68703ecc6dcdf7329.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d03ff3d-a9bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788675680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675680, "uuid": "1603d9a8-0a13-48c5-8c65-8529bf1da6f1", "comment": "Malware payload (Vidar)", "value": "d2b2992e39f5ba69c4f76fa55a8504e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675680, "uuid": "39b9b640-5313-4950-a516-b0b10aeb6303", "comment": "Malware payload (Vidar)", "value": "56975da761c18489905a887741cbfef67f80d7e2f8d040eace9e0c5b76f15a9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675680, "uuid": "88788d35-9c69-412f-b00c-d8462abb3f77", "comment": "Malware payload (Vidar)", "value": "f3a49c09ac2e1881b647e6599e6ab0719a174cb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675680, "uuid": "d862db63-e415-41a8-9731-db094ec01114", "comment": "Malware payload (Vidar)", "value": "5cd7eeba7445a82660080550982367831c6ea7579005066c370debf513c88cc4ffec425c3ddc2cbcd90dcd0236e0f20a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675680, "uuid": "bcbf3fd6-ea25-4c66-a3eb-a101bb2793df", "value": "T10CD66B03B79852E0D4C5DA34D5AF4227A7687C8DCB3132B36E662EB56F35BD05AB8340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675680, "uuid": "9751a3ba-1db5-4c59-8452-e99ba313c197", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675680, "uuid": "16605c32-80cd-4ffb-9922-3454d1215c65", "value": "98304:RU3SBEPT8PSPAvcK+OlHJ7qNMaJRINBwPwc:R0C/xHsaBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788675680, "uuid": "34e713cb-8e19-49b2-94f6-30e9dd0c3670", "value": 13756304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788675680, "uuid": "202329e8-e114-43b0-9db8-c7ca9f70a1cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675680, "uuid": "03a11ec4-1ad4-4292-a7d7-e950f0e29ddb", "value": "56975da761c18489905a887741cbfef67f80d7e2f8d040eace9e0c5b76f15a9a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d6df5fc-a9bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788675707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675707, "uuid": "6cda8769-2265-4538-bf4d-fe9d21ae9a01", "comment": "Malware payload (Vidar)", "value": "adc82fee3ae38985c14f2c6d517e07bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675707, "uuid": "9ba7dbc7-464c-4984-8f44-02b4a2c3e0c0", "comment": "Malware payload (Vidar)", "value": "57563715eddd2a3d404518235fea75b7828cf0933fa10fee34737b694f37154f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675707, "uuid": "5050283e-4b1c-4389-ad9d-31b00142eb3d", "comment": "Malware payload (Vidar)", "value": "e82c31031f2ee2c09886c4db5cd111d3a19f6e62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675707, "uuid": "b364fc49-473d-4ca1-95bc-d9c26fc110b6", "comment": "Malware payload (Vidar)", "value": "4b60329efe5aba3dde3aeb5ecef1bf1e22e17fe4cc55623258bc0ccc0616a8fc9c8de8a20e38bd9ccb3fc63630818854", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675707, "uuid": "d732f621-2dcd-4a29-baaa-882638941a14", "value": "T1128629037A9545E8D0A5DB71C6AB4127F627788CCB3563EB5E0063303FA6BD07A7A748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675707, "uuid": "6021c221-577d-43f3-b235-3abc496c20d5", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675707, "uuid": "73d0fa35-7ce1-40cd-90b4-ea5e4a74b72b", "value": "49152:Qu6cSFrpcOg8f3svnsB9rsnMeG+sjjcubjl9k9/al1UrC5SuRFTdWe3LNq+qlMgC:st3frBpsnncbj1/dw3YSmIXIauIploX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788675707, "uuid": "2ca22463-da3b-4230-96bf-228f60a745c0", "value": 8214408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788675707, "uuid": "8ad8509f-8d33-4b28-9f10-4b99f26e22bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675707, "uuid": "a66286c2-a5a3-4c05-8a42-d515b13a869e", "value": "57563715eddd2a3d404518235fea75b7828cf0933fa10fee34737b694f37154f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ebc743-aa12-11f1-bd95-42010a9c0009", "comment": "Malware payload (Koadic)", "timestamp": 1788713336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788713336, "uuid": "16a7f459-75c1-4fb0-8275-cac61ddd03e4", "comment": "Malware payload (Koadic)", "value": "36a0c7d2cbef5eda495afdce626c8c94", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "KILLAV", "colour": "#242D8F", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788713336, "uuid": "4a9b9b0e-6aca-41b0-9ded-66cc3bf40c6b", "comment": "Malware payload (Koadic)", "value": "579c046d181eb09c4c28464382171bd5ebbd5761bdd463ed90f5d3ce8821bda8", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "KILLAV", "colour": "#242D8F", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788713336, "uuid": "3c54b7e8-b102-41bb-a986-429d7771909b", "comment": "Malware payload (Koadic)", "value": "d101dacf863d5f301e604c95cafda53faeb09bed", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "KILLAV", "colour": "#242D8F", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788713336, "uuid": "499121a0-5449-40f3-bd53-a014adac614b", "comment": "Malware payload (Koadic)", "value": "7dc6336064f6b36f26326c533b3cb251f772aaefda965389802a8595d406cbe42ce55d548950ae40d039de302467b0a0", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "KILLAV", "colour": "#242D8F", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788713336, "uuid": "663d92f4-edb7-428a-bdc4-ff85c9c875af", "value": "T19493E73039860E3EBC2C9875E21F761627BED43E50E5606E8198B3EDC9C52BB50A7D53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788713336, "uuid": "a124f42f-49aa-46db-b900-17e2af571829", "value": "768:64pCT39Xh1wGPDPe2WKf9RxHEeEfMnqRQdrRjGsbZ:64UBh1wSPeOxtEfMnXUe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788713336, "uuid": "45b69ff0-7ec5-472e-88d1-57221ba7f556", "value": 92871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788713336, "uuid": "177f4f59-3bc2-4c33-80ee-67b4750b7c0c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788713336, "uuid": "de2e41d5-23f0-4c10-b70b-f464aa521e7a", "value": "6 t.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "447ae948-aa2d-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788724682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724682, "uuid": "19731c42-6dd8-4477-8dff-daff66851041", "comment": "Malware payload (AsyncRAT)", "value": "51e64c2ff5c48a36454b023e75ca146f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724682, "uuid": "9c863e06-2e45-4b5f-9ef1-026afca46026", "comment": "Malware payload (AsyncRAT)", "value": "579e244c821b155684cec762f68b7ce76d806da76f5367a4798b97c9246500c7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724682, "uuid": "0c336d38-335c-441e-a2c2-940cc5492cd7", "comment": "Malware payload (AsyncRAT)", "value": "350079a36c0e81911cc3cda143047b2514c27e5a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724682, "uuid": "f9322775-eda6-44fe-bd7b-52a241999f10", "comment": "Malware payload (AsyncRAT)", "value": "73ef3748625daecb9f0c7ba1b7d6788646823fea98dafd3841e3f1951c73045613171d97f9e5937d3a7c28cbb868d015", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724682, "uuid": "b3edb8b4-a218-4454-9f64-dc1abc95371e", "value": "T1EE936D007BD88529F67E8B38A8B3438507B4AD576802DA9D0DD439AF1A737C59D063BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724682, "uuid": "26c33afb-7897-4b1b-8059-21450737c438", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724682, "uuid": "66b77853-e3ee-4cdc-afe8-fe65e4fe5448", "value": "1536:cfQhqlSvUAth+Mqf7/SBEbxsBuMxDKwzqH853wDu3Y6Uk9jg+rr6GbOsKpeQiQKV:cEqEfxBEbxWuM4rDud7r6GiX8QiQ/1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788724682, "uuid": "c01257fe-1cdb-4f00-994b-f8b86cc7b9bb", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788724682, "uuid": "3e54653d-4655-41cc-b275-4878e2c47c7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724682, "uuid": "b49b030c-4ad4-4657-915d-dfdf82ea7eb1", "value": "from_au88_with_love.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "222e0a59-aa19-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788716034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716034, "uuid": "92f10cfd-4783-4f14-a0e5-2160c8a4c7d5", "comment": "Malware payload (Mirai)", "value": "0aab13e733085e3395fa0c65522622e9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716034, "uuid": "5eb289d8-d278-4f56-9290-cd96479bf174", "comment": "Malware payload (Mirai)", "value": "590e57db9b9fd7b215ef94b654dd77a9a085059a390b7cbb43112a652f02eb7e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716034, "uuid": "f9dfad5a-f1a7-40df-b69d-af762f433ff2", "comment": "Malware payload (Mirai)", "value": "a481bc2ebdc893a3374dd5d1de42552db38a9b5c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716034, "uuid": "de03ec8a-152b-41c8-b404-2ccc45661c7b", "comment": "Malware payload (Mirai)", "value": "251e2d867f3a9863f52a4712af7793e7777aa1e89a57dba8527bde466078b61a3a1f1b84430ab4ae9afae9a3d89d575b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716034, "uuid": "3b0189db-bea2-4a50-a312-14dafdfa7bff", "value": "T18EC33A59FD819B11D5C622BBFA1E028A331357ACE3EF72129D205F2537CA96B0E77901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716034, "uuid": "cfc84b68-556f-4e77-aa70-6f3b02693d94", "value": "3072:LkUhW6FtxVLUap0Fda6bXQddLyYUfBY0lmPMa:LzhWutxVL+da6bXQdty/BnlkM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788716034, "uuid": "5fd54a63-8626-4cf5-99c9-5dd19297e4bb", "value": 124752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788716034, "uuid": "ef9710d1-bbb2-4081-8d8f-23da8aec1087", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716034, "uuid": "2fb64c15-0483-45be-a1e1-a29aab0270f1", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c292b75-a9f5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788700697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788700697, "uuid": "784c3e7b-32e7-4e97-b083-af350089c936", "comment": "Malware payload (Mirai)", "value": "ddde0b989d226c4826f2c0178db46446", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788700697, "uuid": "175c482d-0598-49d3-b42e-5de52a55b598", "comment": "Malware payload (Mirai)", "value": "59d51ea90b24d9d0c9724bf967b7ce3f0536c908bc5a6dbcb8f0b3e4ff16242b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788700697, "uuid": "89c9b120-913a-4a40-ac45-52bc2c6135a5", "comment": "Malware payload (Mirai)", "value": "14c7ed991044024bc80c9c6c5964c169b000bbf0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788700697, "uuid": "6e9f83f7-fe8c-4226-a669-4955828c60f8", "comment": "Malware payload (Mirai)", "value": "05b8946265275efb898e5cbc7c7ab4ee2808e8379d9e814dc77d1a6f5a26c8c35dbae45199b1e5ca5dbf1ee9c2c65f1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788700697, "uuid": "f9b8c283-bbc7-4aa0-9b4c-0cf689384aa5", "value": "T1156302B5501AFCA848A08A35F87D09ED73D0A53D429EB29FD860436EA1F63D76BA15C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788700697, "uuid": "41b1e354-c0d7-4df3-8546-1400df245110", "value": "1536:MuBo22ymnovRqWU3UQe7urZDiZL2PXVEdD3wLxWP:M22uRRU3UQJr8ZL2dC3wdWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788700697, "uuid": "6c855384-ad64-4c5c-8e84-7933906de7d7", "value": 70088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788700697, "uuid": "2b7ce4ba-24bf-4c5e-a3a1-c2196a8ec09c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788700697, "uuid": "0a043257-3ce4-4d5c-8f7c-af0532acbd83", "value": "59d51ea90b24d9d0c9724bf967b7ce3f0536c908bc5a6dbcb8f0b3e4ff16242b.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f30fc7-aa37-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788728926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788728926, "uuid": "ea8c1e0c-a8ae-4965-bb9d-e8a06c9b9f40", "comment": "Malware payload (Mirai)", "value": "914d3d8c1833038d4752ff5ff01939f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788728926, "uuid": "f67dfb0b-c36a-47d7-a36e-619d30aaaa6c", "comment": "Malware payload (Mirai)", "value": "5aa0cd0fb49efc5368952f1449686a63f61f33748892a08afe2c8e458dce70ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788728926, "uuid": "8bb55ad2-9b23-4f64-ab2f-cd9f5d82fcc7", "comment": "Malware payload (Mirai)", "value": "99d9055405b27f20277ed3810062054b7737d88b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788728926, "uuid": "b210f6ce-8b79-4b18-b816-ef91900d3208", "comment": "Malware payload (Mirai)", "value": "eb7cfc5197ef6a23f880a6418ca56090a8d8828a1964cce9019e2dc62e29952fda8f8e323ef9eb9bc30be8d397ca30e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788728926, "uuid": "98489edc-2227-4cd4-8178-5e5a8a748c9b", "value": "T123B32B40FD548767C3C227FAF78E439D3B356B6857DB33116A346EB42B85B982E29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788728926, "uuid": "889694c2-8315-458e-9d7d-1b170724457e", "value": "3072:jWT/ykVEhYlkVdEfclo346N2gaFNYLcvAIutpLYJOYV0mIerJnTuXm6ciQH3MhEZ:N6wqHtHu0mIWIm6ciQH36E5r6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788728926, "uuid": "ccfb9ed1-2444-4e1f-be84-5dd81c403c37", "value": 113723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788728926, "uuid": "81b4c335-c752-4cd2-a7b9-3b427d7b1568", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788728926, "uuid": "a01058a0-b296-4abd-b827-0a3effc0435d", "value": "5aa0cd0fb49efc5368952f1449686a63f61f33748892a08afe2c8e458dce70ae.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcee23e0-a9f9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788702604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788702604, "uuid": "d96671d2-4bc3-4476-8ae5-101dc9a6d5ae", "comment": "Malware payload", "value": "567ef7041533e87ba5426a70e68bab73", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788702604, "uuid": "1262326b-a377-46e9-aae0-ad501153a850", "comment": "Malware payload", "value": "5ab220e66a8c6cb3daa11a54a395a017ead280c7006b56d680d086eee4cb9a8e", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788702604, "uuid": "cbc18dcc-d22c-4feb-9cb0-6e4e5448928f", "comment": "Malware payload", "value": "3a0c63626678826020320c4e2bbb78d85f9e4280", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788702604, "uuid": "ad76feb4-7c6d-4053-a843-ef0187edc1ef", "comment": "Malware payload", "value": "b299b91a0fa52c19f1850b287a931407c68f53dd564073a77232fb682582eaf5d7ce81fdcf1233e32f70d048b3b32ca4", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788702604, "uuid": "32f0ab90-54ff-48cc-a73f-7354f5e8ee5f", "value": "T1C1F05C4294A04929623016146EC0FE055E9AEE479749BD4C76BA51B90FC87C1CDCF57C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788702604, "uuid": "4e8c28ae-6771-4c45-96e4-99ddcdfadddd", "value": "6:qTIuJzhqIwGiY63fAbplilAl3t11/+SR0AqIbR2AWHwlgV8IbZNV4LKTjawlauFa:qTp0JYyg9193R5qsPWBVhVeuqAEd2QL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788702604, "uuid": "39e03d4e-fbf5-4ae3-90c3-eac82c4ae377", "value": 446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788702604, "uuid": "e64343fa-027f-4374-8591-0f69e38e16e0", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788702604, "uuid": "27e00a19-d76b-42fb-9e20-78eded08c359", "value": "goodthingsforbestpersonforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c10792cb-aa20-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788719307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719307, "uuid": "f8c9b6c7-79b3-476a-9a00-2d833602e0e5", "comment": "Malware payload (Mirai)", "value": "37bc6e5085b4fd91b98935a1e0ede8f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719307, "uuid": "d476ab9e-d004-40a7-ae85-ae569a0482dc", "comment": "Malware payload (Mirai)", "value": "5ad7fcfde0a616ccaba02eaa95a55bc0befa61f7e1aea37402be23250ae6462b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719307, "uuid": "77bc1f35-bba6-4292-bc4f-7ed085317adc", "comment": "Malware payload (Mirai)", "value": "9f5dc375ae348a2b9b307bca3834a7821d0733c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719307, "uuid": "3d3fd74d-7f90-4c4a-b685-aa2416e6cc8e", "comment": "Malware payload (Mirai)", "value": "891fca319ff567aea11b6917e83d59d5f74559d49c1c129e441839bbe0004861cf4efd5dbd5c38475fae85213717c467", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719307, "uuid": "509c4aaf-772d-469f-bc12-5a4248f69e21", "value": "T15ED35C0A78D274FCC687D170926E9F61EA3A745C02183DBBA3C2AE711937DD05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719307, "uuid": "a78c303b-41da-4e41-91fd-edf88354e39b", "value": "3072:lAF2acRfkY6z3xv+ErH4vk9954rlvLFZW8YYQM:yIRfe3xvvSrlvZZ7UM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788719307, "uuid": "ff625478-69fd-48b4-84cb-1ac34208841f", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788719307, "uuid": "cf3ec307-18bd-4373-9fba-788bf0b17e86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719307, "uuid": "626f1baa-218c-4599-bba3-ef1dab9cb9ab", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b11f8a4-a9bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788675811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675811, "uuid": "7839c5a6-dfbe-45d4-9b33-e2d94dc4e460", "comment": "Malware payload (Vidar)", "value": "5512b064ee408840eb677f85d3d2daf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675811, "uuid": "abc86873-f59a-4c3a-9f0e-1f7297d226f9", "comment": "Malware payload (Vidar)", "value": "5b73a1a0d19d42c9f8ac1fd862779bb1ce19d40c4b98e8c644c3303ccc36cc6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675811, "uuid": "ac5fd9ed-3059-40e6-8afb-3d3153c0011d", "comment": "Malware payload (Vidar)", "value": "9f07cd38b99e89a58dbfe66abd4ede93bff4838d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675811, "uuid": "a89ba63b-a69c-4761-b186-5d3c5838d970", "comment": "Malware payload (Vidar)", "value": "20deb65a82415eee06fd1137d15d67d92cb133912c02725f1305b3b1a8708c28c0cbe14868081f5f414b92c59dca4a20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675811, "uuid": "9c487613-0f54-497f-bafb-e3d955a9b40f", "value": "T1BD283343BC9445AAD46DC67AD56AC262FBB4BC040B30B7E73E1076B82E377E0553AB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675811, "uuid": "028cc3e1-034d-4075-958a-4293cc8ae2b9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675811, "uuid": "fca0ef78-c6fd-48dc-b2e0-b4d9a6a315fe", "value": "1572864:4OoofafU7i0VOrMY93x3twcgtiH4mFiysjV0+J8udQePsOmA0trx9sNl46BmHaM6:dopN0kMIxHlH4m9sjV2udQWm19sNl4Ve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788675811, "uuid": "073f5fc3-7c60-4a0e-8296-5895311ba521", "value": 95850864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788675811, "uuid": "bc0deeb1-0936-4a15-afe8-d67c5a27cede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675811, "uuid": "effb568a-73d0-42e1-b1a9-987039df9605", "value": "5b73a1a0d19d42c9f8ac1fd862779bb1ce19d40c4b98e8c644c3303ccc36cc6d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc266b6-a9a4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788665940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788665940, "uuid": "91cd548e-5f46-4202-8e21-9fb5f2cf9871", "comment": "Malware payload", "value": "cf06a8bb27308e38b73da3ac154be44c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788665940, "uuid": "4ed350f9-1f25-4404-aae0-c612d22c2b6e", "comment": "Malware payload", "value": "5c6680bcb7d08f4da0c5ea317a05b635a8cba388dadaea4177364d1650c0ca62", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788665940, "uuid": "46199bbc-2341-475e-a0c0-b754af73bbc6", "comment": "Malware payload", "value": "d8fe53e68b89689b907abd398bfccc0f1416cf66", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788665940, "uuid": "106765b6-3698-4cf8-9997-0157b89da2da", "comment": "Malware payload", "value": "b9d05c9ad885190c230ca44f62463eddb5544056b96a96fb5687fe521f9c0bcff2c4d17a75d2188804454afdb53b662b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788665940, "uuid": "911c1aeb-cd41-4b25-8207-d41e29552732", "value": "T17DD05EE25623527654B24960F1C6B400B081877F8CD5A62EBA0664315E8674AF1D16A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788665940, "uuid": "48076a05-49af-4525-9bcf-8ff2a7f5ddbb", "value": "6:hTbPWTuX8s8aB6jplHAulNXYq4HvXDG+NjVsNXYrkJ:Vz9X8s5BwHPiq4HvXDGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788665940, "uuid": "810ffd65-e62e-435f-af16-f51f1146d3b4", "value": 263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788665940, "uuid": "340045d6-7cbe-4664-846e-421abb63b4c6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788665940, "uuid": "8903e6ac-349e-4777-8c8e-555959d7c2fa", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f41100ba-a9bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788676014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788676014, "uuid": "7c2895e4-be31-4a54-9a0b-dcba7d1dced5", "comment": "Malware payload (Vidar)", "value": "eab92c885759ee684a220e2500ca320a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788676014, "uuid": "3fe48b5f-0856-4305-80e3-b3be959614b5", "comment": "Malware payload (Vidar)", "value": "5cc5684a6b65305ca15d834fc8e1a8b62e1bf4d6c789a15029ddf1a2c396b34f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788676014, "uuid": "909babf6-ace0-44ed-b7b7-c515978027a1", "comment": "Malware payload (Vidar)", "value": "d41abcec40c0f35da598977b308404b3f22d0913", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788676014, "uuid": "bb2e6f37-db9b-4a17-96f5-3cdb4359b299", "comment": "Malware payload (Vidar)", "value": "b9ec2babe76fd4094b69b917f34ac99b30cc5b5acb37d169d752fc3528bbc17800c652e7acb05aa1b0d89b827cbd287a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788676014, "uuid": "f3967b1d-4b62-4222-bc1d-78aef9726532", "value": "T1C4283343B89444A9D169C73AC96AC252FBB5BC040F31B7E77E50B6782E37BE15039B18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788676014, "uuid": "fdb511f1-78d0-407b-bbab-31a24ccb9c5a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788676014, "uuid": "e639ef82-3c49-49d8-af72-fd1cb0129d8e", "value": "1572864:49au6T0iud6gfJShrALy+J/+WnnXREsKo9TJMJJwJqlQaI4sqa5XK78R:Gau6gbVfohr+cWXRE/o9lMJyqGaI4sqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788676014, "uuid": "7e2ee54c-e363-412d-b4b5-a59e32419b63", "value": 96899440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788676014, "uuid": "b486adfc-f1f9-4388-bd69-235b06ebc8b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788676014, "uuid": "14531a12-fec8-4c6a-883d-04625e7d2552", "value": "5cc5684a6b65305ca15d834fc8e1a8b62e1bf4d6c789a15029ddf1a2c396b34f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20bf91f0-a9bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788675659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675659, "uuid": "43dbe0ff-fea8-4f5b-896b-932e33965cef", "comment": "Malware payload (Vidar)", "value": "4c09885e2609cbba14e2425e189a0222", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675659, "uuid": "291477de-f496-459a-bdac-acad57912778", "comment": "Malware payload (Vidar)", "value": "5ce9391ab6bbe33345a0c4fda045ff55ef0548bb7d33bffd05b9cb42db23d16e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675659, "uuid": "434134b1-6d34-4b18-b352-741579d6e4c4", "comment": "Malware payload (Vidar)", "value": "37c70e1f167e1d0a7019ed99cc2f9e20167a9a04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675659, "uuid": "bdd42243-8eff-43b0-a59b-e15247bc4034", "comment": "Malware payload (Vidar)", "value": "7540bdeac61e5aad0ea896fd0db550495deeb48a931fcf4bab803a1f27be1a4f0232577a5efe897a05ccc28782f2bc9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675659, "uuid": "c7f1e484-9e17-44c8-8b9a-0761833e83b7", "value": "T1B2D66C03B79852E0D4C5EE34D5AB422766387C8DCB3132B36E662EB56F35BE05679380", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675659, "uuid": "c1a778a8-c5b2-401e-a966-8882f00e7658", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675659, "uuid": "73498d93-913f-4cdd-83b6-6740618250cf", "value": "49152:PBDDGYsUI43KjRU+duDgin4WxETmKChOHdj2GEUWFZ8A4P5e91vSVXozU9ne9X9/:tZ3KS+xkxoa8A4G1QYNj+2WJrqJF8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788675659, "uuid": "d1d0bb3f-f73e-4965-b923-9e294992ff60", "value": 13742480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788675659, "uuid": "134110db-7c63-4b14-bde1-6d606e714368", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675659, "uuid": "9b2ddc72-203c-4c9d-bb84-9b150e0b2ced", "value": "5ce9391ab6bbe33345a0c4fda045ff55ef0548bb7d33bffd05b9cb42db23d16e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b38eca-aa14-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788713943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788713943, "uuid": "2b57dfb7-f569-4e1a-8e2c-a508b5e6b7be", "comment": "Malware payload", "value": "0fefda497500ec168906f7b3cc3b66bc", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788713943, "uuid": "ec09c516-fa60-4a39-a940-abffe0062cce", "comment": "Malware payload", "value": "5d0f4e14adeac1256e4bfe68223af7555bdd2ea38141462dc913de6cf14edc46", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788713943, "uuid": "b914c75e-cd03-467f-88d2-c89360b3355a", "comment": "Malware payload", "value": "c3cc1bd760ce19223d3f0447231b87bad4eb715d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788713943, "uuid": "da3ef1e1-56da-4e18-883b-478d49cd9586", "comment": "Malware payload", "value": "6ba202b9ee9cf0d5dff105de186ec50ae6c3dbd3cdba1222720f61852cbdaaf31fccccf5074bf6b7fced4ed85b8524fb", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788713943, "uuid": "14f260ee-d63f-4cb3-bd27-b2923bd759f7", "value": "T1E0F0AF351CCDCAFA4254C4F70A35E1BCA1A829856E41B7208750EDC1F64DC7C8982CF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788713943, "uuid": "b5f6fdd2-563a-4bee-b5cc-8d0b62a6ab1a", "value": "12:15osiAWYFx/G+oAi+hFzUwe2Fxkp+bpsGIM:15npvrPh9PyGIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788713943, "uuid": "ff6bfed1-6954-430f-9e21-6970fa805891", "value": 601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788713943, "uuid": "b68f98e8-717d-4414-bac1-2cbb36bf99df", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788713943, "uuid": "b89ff19d-0830-46cc-a6cb-1a4fab9909ca", "value": "encrypt_fixed.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7272130-aa1e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718539, "uuid": "1a610fec-149e-4ece-8c23-c734d23a9caa", "comment": "Malware payload (Mirai)", "value": "53b84cef64b4b2807afe4146a1eb45cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718539, "uuid": "1c760811-9e52-4c8f-acdd-da8e4000e8f4", "comment": "Malware payload (Mirai)", "value": "5e5de90548b449bafee089ca71a3933f41490acda74f2bb2f692335dc0ab7b2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718539, "uuid": "385f1d45-83ea-49fb-b53c-f5b1312bb6a1", "comment": "Malware payload (Mirai)", "value": "c8b99b15c75e00416a521bce01632fd82fce916e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718539, "uuid": "fc9062eb-5e72-4898-93fb-117fdea13aa8", "comment": "Malware payload (Mirai)", "value": "63af2735f542b8a3adb79bbb532ee9753a0a87f809249922172fb180793fe1cce33eb3daf39c328d7b90a47361500df4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718539, "uuid": "1b405cda-1b92-4e55-bd12-4b10f8f7d8a9", "value": "T1B6F32956F890DE61C6D1297AFB5E5248335317B8C3EEB1069D106F7467EB80B0A3EA06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718539, "uuid": "775de0bb-3fe3-4450-a2fe-261666b9153c", "value": "3072:rifVldPtoeR1S4OjAwkk2Ld7lilvziBhrZd71fj:rCVl33MjAwkk2LdZitA1Z/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718539, "uuid": "d6dcd973-4a49-4c28-a55c-78ff91e7d953", "value": 161148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718539, "uuid": "62d70a55-5fbf-4ab1-8214-5e71e398b835", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718539, "uuid": "31af1f80-b575-46b7-92a2-01411904b93e", "value": "wj0s.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65529488-a9d0-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1788684794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788684794, "uuid": "f661e225-b130-4855-9ebb-8b8d0446300d", "comment": "Malware payload (CoinMiner)", "value": "a49def4b5a89277dbad16d7d8afd1392", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788684794, "uuid": "d71d1ab4-c9e1-43b9-8b17-1c0fef393c5f", "comment": "Malware payload (CoinMiner)", "value": "5e7a1b9857320e185d0dc8724dac6944bfceb01951a03b0f6c99f929020be862", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788684794, "uuid": "0a9378ce-ab45-430b-a7a1-1fc8f34e6ea5", "comment": "Malware payload (CoinMiner)", "value": "0425c8de3a57fa6dc3ea76a37b8981eb73cb95e7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788684794, "uuid": "462576ff-98a9-4fd1-9906-f83e7a0aa654", "comment": "Malware payload (CoinMiner)", "value": "1b6087fb21dbc646896401fc9f8512b71ec8ce35b0d833c80631ab6c95d8b048eb0e68a5b7d730991d467c3e7e6f771b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788684794, "uuid": "7a3015c4-8c65-4783-a2cc-2acb225b835e", "value": "T1AE36338AA8C3AAB5D086C334845661FDF13A7BB64EE5BC0B7B8D74408D1BF58653D381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788684794, "uuid": "1596874f-654a-4b5e-b3b7-bb577ad1d989", "value": "949ec789a5933fb6051c9013a550fb57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788684794, "uuid": "2d44caa1-98b2-4060-8537-a1e0d554ca67", "value": "98304:Ep01CUpPL1ZM0lDNdm8rbfhLAVpGo3qphf9E6C9/21J:EMfZMi68/fhCMXpO/yJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788684794, "uuid": "8520716b-5afd-4043-9d47-729225c95bec", "value": 5238272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788684794, "uuid": "f1a47c92-02fb-421f-8eb0-54fab3bc3b44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788684794, "uuid": "6444cf69-9632-4a21-95cf-1050b1e683df", "value": "5e7a1b9857320e185d0dc8724dac6944bfceb01951a03b0f6c99f929020be862.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d35c828e-aa2d-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788724922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724922, "uuid": "4eb0ade6-15a3-4aef-a795-e702df892235", "comment": "Malware payload (AsyncRAT)", "value": "36aa1dc60ecca0a2dfb562e0feda2080", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724922, "uuid": "925193d7-e208-411a-a01d-b07089cd166b", "comment": "Malware payload (AsyncRAT)", "value": "5e84fd9106777b85d5a60f4e607940730ba57ea2dcafaeaaadd6f21e38555761", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724922, "uuid": "11a33b14-834c-43fd-b9d5-69cc065a229c", "comment": "Malware payload (AsyncRAT)", "value": "f2e3bbb09dc3b30aa39af0794cd5fec2a2d052e8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724922, "uuid": "475fad0c-5456-4d2b-bac4-60e55f6ce6e7", "comment": "Malware payload (AsyncRAT)", "value": "41c84a3a79b471d3932f1360c1b00f5bf3747234900225e6d77d7a703045f3fad49b8db74719af49a4511aa5f0823b49", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724922, "uuid": "e1f1d525-95e8-403e-95e2-77b5cf1a9ef8", "value": "T15806232F6D423C3AE77595BF0410B1CDA8686D1187E9B2123A2FFB2CDD3CE57A906941", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724922, "uuid": "ce7aa4d6-93df-49ab-aa52-d7a89c335edb", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724922, "uuid": "cd55e165-adb4-4a23-8672-a0386695e289", "value": "49152:ezrqO7iP7RKy5h3lEKqd7n5D5dapQ2wMENKZhkqrweA0QvQcAtjySLveE9:4Wh3lEH951gCKZhfrwP/vYtjtrf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788724922, "uuid": "4baf2963-ab53-4931-9421-75226c195404", "value": 3939840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788724922, "uuid": "cdb9d999-4b48-4413-a0f5-9284a2484364", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724922, "uuid": "15a4d2cf-fd27-4bed-af7d-6b803243597c", "value": "Beta-Cheat_protected.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80376602-a9c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (SVCStealer)", "timestamp": 1788680114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680114, "uuid": "6f76e89e-2f94-4326-879a-27e841a43aa3", "comment": "Malware payload (SVCStealer)", "value": "6d76cf419ef27091ef9a90c65e78a025", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680114, "uuid": "3869014e-8346-43fb-9218-590fac295f9e", "comment": "Malware payload (SVCStealer)", "value": "6049aeeff1b21076191fcc6c47502f3f71e29dec65f788e01d1062245e589b56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680114, "uuid": "52f6fe1e-b839-4455-9be3-2243403a6269", "comment": "Malware payload (SVCStealer)", "value": "40b128eff9d0e01bef0d4af86a9ed2c32ba8063c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680114, "uuid": "f12e1da8-674c-4bfa-a6b5-d9e27d875356", "comment": "Malware payload (SVCStealer)", "value": "f04c0d76aad33fc1327b808fbb6d0e5708dbb314a69d1fe8c0201114221206b32015abf7ca18ee2a8b023ca2a60fb0f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680114, "uuid": "f81d1a6d-4e71-4f7b-bb0c-a06663df4399", "value": "T11CB59E4AA3B801FDE0BBC274C9565A07D7B2B8061674D79F13D4479A2F23B716E2E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680114, "uuid": "413fba2b-1e5c-42c7-bff0-7ece573e67de", "value": "7e867cc786c49e69b30c43a151a15953", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680114, "uuid": "989abeaa-534e-4f12-a70c-4ae67320fac1", "value": "49152:cZiB34IOPHO0XKDNEtR2Z3Au/PJvTs6a:k0StRa/54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788680114, "uuid": "d27913ca-9921-4e00-af76-ea8ec8d189ad", "value": 2417664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788680114, "uuid": "20dc1046-1a7f-47b7-931e-9ab46292bf42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680114, "uuid": "61682c22-5ebb-4f3e-91f2-84b085a28401", "value": "6d76cf419ef27091ef9a90c65e78a025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b82d0353-aa05-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788707696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788707696, "uuid": "432b9819-5616-4274-a751-58f0af9918b5", "comment": "Malware payload", "value": "db9f32581374d5b911e65acee2285d9c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788707696, "uuid": "4a2536a4-7697-4dc9-bc03-b830a8715fb4", "comment": "Malware payload", "value": "60d472a6f2f987b9ee4057e01128f1e76ec5d27184d843c9319cb226f2b0be7f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788707696, "uuid": "825b34d9-96ce-4820-92b2-e6fbf709b373", "comment": "Malware payload", "value": "ca1ed6082d87a16a5021ecb202e6fca1727bba8e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788707696, "uuid": "06396cd0-c68b-4467-9c04-32751426f3b3", "comment": "Malware payload", "value": "2434648c338accd8151a3b1338242c4ddbb95f3b45922a57e4f30bc81469bbcfd6cfb5e7cad755f44877ca90f14370c1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788707696, "uuid": "4927cd45-537f-4d0e-a5b3-e34eba4c02ff", "value": "T163236D6126857C14AA99C8371D7E2F0CBDAD43E6320452EE7FCB3CF68C4A69DA10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788707696, "uuid": "0f31bb49-1664-4dfa-a047-1ed209923354", "value": "768:86rDTPjH59GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:zr3Wcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788707696, "uuid": "f0c03b85-1aad-4215-b6d6-4d9a8876f0f4", "value": 50067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788707696, "uuid": "581d9826-505d-4878-81d3-5ada06200c3c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788707696, "uuid": "34e45393-e404-4c36-9cf5-5f3424ea40b0", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0e5744-aa25-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788721255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788721255, "uuid": "512f332c-4e2c-45b4-8bbb-6ef2457ed6f4", "comment": "Malware payload", "value": "5211d927bcb68146635773b50653fad5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "call-forwarding", "colour": "#A685FC", "exportable": true, "hide_tag": false }, { "name": "credential-stealer", "colour": "#7B6F8D", "exportable": true, "hide_tag": false }, { "name": "firebase-c2", "colour": "#75CD01", "exportable": true, "hide_tag": false }, { "name": "india", "colour": "#1F00DD", "exportable": true, "hide_tag": false }, { "name": "PNB", "colour": "#1CAFAA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "rto-echallan", "colour": "#292F51", "exportable": true, "hide_tag": false }, { "name": "sam-panel", "colour": "#3E822E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms-stealer", "colour": "#84A8A5", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "telegram-exfil", "colour": "#68BEFE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788721255, "uuid": "9b931550-3f73-482c-877b-877012574b60", "comment": "Malware payload", "value": "61af149986db26f8e4d084e994cf43bc2595ed7668393401cef7a15afa999b57", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "call-forwarding", "colour": "#A685FC", "exportable": true, "hide_tag": false }, { "name": "credential-stealer", "colour": "#7B6F8D", "exportable": true, "hide_tag": false }, { "name": "firebase-c2", "colour": "#75CD01", "exportable": true, "hide_tag": false }, { "name": "india", "colour": "#1F00DD", "exportable": true, "hide_tag": false }, { "name": "PNB", "colour": "#1CAFAA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "rto-echallan", "colour": "#292F51", "exportable": true, "hide_tag": false }, { "name": "sam-panel", "colour": "#3E822E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms-stealer", "colour": "#84A8A5", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "telegram-exfil", "colour": "#68BEFE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788721255, "uuid": "468ae9ca-dc4f-4cd4-9589-2275e7635cf3", "comment": "Malware payload", "value": "b99f803a41321d0453c54890306d0962fd3bf856", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "call-forwarding", "colour": "#A685FC", "exportable": true, "hide_tag": false }, { "name": "credential-stealer", "colour": "#7B6F8D", "exportable": true, "hide_tag": false }, { "name": "firebase-c2", "colour": "#75CD01", "exportable": true, "hide_tag": false }, { "name": "india", "colour": "#1F00DD", "exportable": true, "hide_tag": false }, { "name": "PNB", "colour": "#1CAFAA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "rto-echallan", "colour": "#292F51", "exportable": true, "hide_tag": false }, { "name": "sam-panel", "colour": "#3E822E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms-stealer", "colour": "#84A8A5", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "telegram-exfil", "colour": "#68BEFE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788721255, "uuid": "2fd59023-1f81-4589-bd5b-4b5a685d8ac4", "comment": "Malware payload", "value": "1c4ffa5249c844fc0d134ca2accd20b44e2f8b3b27ea6a2863c702adcaa7d17e1fb28a34e6f6463843cef4d56a5f7fa7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "call-forwarding", "colour": "#A685FC", "exportable": true, "hide_tag": false }, { "name": "credential-stealer", "colour": "#7B6F8D", "exportable": true, "hide_tag": false }, { "name": "firebase-c2", "colour": "#75CD01", "exportable": true, "hide_tag": false }, { "name": "india", "colour": "#1F00DD", "exportable": true, "hide_tag": false }, { "name": "PNB", "colour": "#1CAFAA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "rto-echallan", "colour": "#292F51", "exportable": true, "hide_tag": false }, { "name": "sam-panel", "colour": "#3E822E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms-stealer", "colour": "#84A8A5", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "telegram-exfil", "colour": "#68BEFE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788721255, "uuid": "0e17728b-351e-4733-a5e6-d8f789c3e9e2", "value": "T13AC61296F7C5986BC4F75332417A5272528B4D228B93C6D3AE04723C68B79D40F8EBD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788721255, "uuid": "fdc2bbda-7ede-4aa1-a00a-7e6a6257ca64", "value": "196608:pumbGH3c7oAXcdxm5TH9FfJr7ix7B8o+Kge0k91PRwnZ03LYmcwJYK4:pZ+zAaxmdH9FfJr7i1Oo1PRwZ03bcmY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788721255, "uuid": "20a8bc70-d70e-4a21-8275-389b253ce5dd", "value": 12271038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788721255, "uuid": "c8bfb9a7-7ddd-4302-a2d0-46ce9cb7f2b2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788721255, "uuid": "cf887946-98f2-4607-ba09-398c7efdbafa", "value": "payload.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a01afae9-aa20-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788719252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719252, "uuid": "d47a561a-fc3d-4670-b6fa-b8b85cc078cb", "comment": "Malware payload (Mirai)", "value": "0de0db0532fa333136cf28119974d865", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719252, "uuid": "ec948ddf-dbe5-4386-bbf8-675b74b783d6", "comment": "Malware payload (Mirai)", "value": "62ae86b10c9cb6e1949a409590526212619390725386cf64c3b10a199d8a53cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719252, "uuid": "8b22a7f2-bf88-44dc-b576-c021d81b3897", "comment": "Malware payload (Mirai)", "value": "3c92a7f4123d2639a39877ca57869bfc734a915e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719252, "uuid": "cfd1b584-986e-48b9-9754-2752e1626754", "comment": "Malware payload (Mirai)", "value": "b4a418f091d2799522e4829eef426ac7bde6be198dd8aebb17c3cee7a830593513adcb157f80e36d48265be30acfeab6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719252, "uuid": "d91a8e81-8b5e-478a-9210-a11ae23eb7fa", "value": "T1786302CF7D703F26C0C8A1B5603415D6D93AEC8AE3538A9C87E5E3550B3956754C8A1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719252, "uuid": "367fae8a-3239-44e9-948a-7bae2e8ce2f2", "value": "1536:zaxZLmYKVDNSl2y08yumeJyGYVmIMGjR8KNi:zaxZLmYKX+t08jmeJhYTdnNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788719252, "uuid": "50b893f0-3c9f-4a89-b18d-74a8fcd7a0d6", "value": 70468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788719252, "uuid": "69ab4ff1-c65b-46c2-a121-ed0d392a0406", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719252, "uuid": "b6374fbb-1ccb-42ab-8c75-3fd097bfc01b", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78133b66-aa2b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788723910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723910, "uuid": "a3028672-6da3-4921-b987-8fa2a4f78945", "comment": "Malware payload", "value": "d2582d9e455fa6cd3d314d6767c1f1ff", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723910, "uuid": "1fd8f888-fc49-4436-9e6b-bbd36db9f0b4", "comment": "Malware payload", "value": "65f1c072e9cf73d46829d6cab343d606d3430d8d090ee8cc32b6a0d4ebe43f74", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723910, "uuid": "9c816bc8-e27c-43b0-a3d6-37c803b0de1c", "comment": "Malware payload", "value": "961de4df64916880dba75e4932c9969d5893805e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723910, "uuid": "c9cb24d3-da5d-4649-ab84-96d6828a29ad", "comment": "Malware payload", "value": "fef798b534e1d55f0b17d68d0710a8e75b081fcfaf1536e7fb42546546a6e114c62574e6cad478462ac5db2151c10d71", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723910, "uuid": "1cef404d-da40-4779-b373-02a99ab40fb6", "value": "T108E5F1CF7DD5B16DDE2B993B04208082D51D20A8C08AD46F09A5498DE936F6D2736FFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723910, "uuid": "2f637a94-609e-4463-8179-c731595a637f", "value": "49152:AobhOmIcP747i6luFFJwIFqw0IRTCUtExSRp5dLIMXzjbywePuihQBAvjn1W0iwk:AAoOP747WFpaIRTCTkXHbePuihMcRWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788723910, "uuid": "f441141d-fa14-4009-9c87-030c0d5afdb7", "value": 3158923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788723910, "uuid": "c56a4a7d-2507-44a4-ac8d-1b16cd473f83", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723910, "uuid": "8894f5f9-fac4-44ef-b63e-8b579f2fc45a", "value": "OneDriveSync.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34643576-a9c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1788677840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677840, "uuid": "54eafa5c-eaff-4ee0-a866-d800d8ee5abf", "comment": "Malware payload (SalatStealer)", "value": "f1ce9e4aae6692fb034cdcc5ad29966b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677840, "uuid": "e7d70707-d80d-4717-95b1-9b9485890354", "comment": "Malware payload (SalatStealer)", "value": "660c6866e4451f641f8e0a48362dc5bbb8cc35af5fc01d85be99ec1f70f81e87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677840, "uuid": "521ab88a-b184-48ef-9b3f-058e7d61d1be", "comment": "Malware payload (SalatStealer)", "value": "3553b53210c1ef1d4db5a166abab53422c22b206", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677840, "uuid": "73a67339-b518-420b-8c7b-87282d8bff82", "comment": "Malware payload (SalatStealer)", "value": "9b913d38483eaf4496fa2a7ad1bed448768a2d52297b469a435840b2a3a8a018ccc1616c90ec3501e7c45608c281d297", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677840, "uuid": "e3b2bfe6-09ce-442d-b1ad-0993185e781c", "value": "T15AC65C11FACB54F6F9036831416BB27F23315D048B28DB9BEB583B6BF877691186A305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677840, "uuid": "f8c7ec72-c827-4993-a679-2ae94196178d", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677840, "uuid": "e09e6e68-8f29-4f9f-8de9-0f34bc429a5e", "value": "98304:gGsqTIVri2C3jGdD4/LoJr4i3HVd7EqO/:FTx3jUDsErTeqO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788677840, "uuid": "39531dc4-07de-47f7-9842-1a6358f92c8d", "value": 12570112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788677840, "uuid": "e32f471a-6b4d-49d3-a129-776e6da69888", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677840, "uuid": "570be85b-44d7-4fba-bac2-7199db566723", "value": "liv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "586c12bb-a9bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788675753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675753, "uuid": "4a64322c-a18e-48d1-a034-2894df59ed6a", "comment": "Malware payload (Vidar)", "value": "3f91088f26da199f685fc3e2b491054b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675753, "uuid": "1800bdf6-8e4d-4301-9310-10eb3be19a83", "comment": "Malware payload (Vidar)", "value": "666694cd6efbc6f8be5c3464868aaf83e5d7a6d0f1ab49eb2ed7baa168d9947a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675753, "uuid": "895de911-52b3-47fc-8808-25d6d03c9c60", "comment": "Malware payload (Vidar)", "value": "afbd45231c309a9a93a561a49a3c6f1cb8e57bf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675753, "uuid": "1c169b34-6b79-4c91-81c0-afe2a56c31e6", "comment": "Malware payload (Vidar)", "value": "ed55467bc779bd3c350c27586c2f12f6e2441e46a29537cea3f5e82e0c25062138095cb7dadf50803b17a0bfa9de600f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675753, "uuid": "7c084065-bc6e-49b7-8cf8-0e0bb57829dd", "value": "T1D128330768E690A8C5A65734C57E6222BA75FC98CB3177E32F44B9342F66BD13CB5B00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675753, "uuid": "b0ee0538-eb99-4590-909c-4f1575de6cf9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675753, "uuid": "c5e14372-5f2d-43f7-82a0-1dcc2eb75683", "value": "1572864:imfr7hDH7Dcu6HuoBmnPGATSoX1+W6YfFK6ijj9yQzx3Q6dgrSYlpuSVBJl7:9j7dH7DIDERT3QW1FLQj9ySF2eYvuo77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788675753, "uuid": "f1d5e088-fd15-4dba-a4aa-86f2c56ed7d4", "value": 100970912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788675753, "uuid": "f7222b82-12a7-4a82-8412-ae4327eadfc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675753, "uuid": "f5cb4421-77fc-441d-91e8-b89e339b1184", "value": "666694cd6efbc6f8be5c3464868aaf83e5d7a6d0f1ab49eb2ed7baa168d9947a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "001fe8f2-aa1f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718554, "uuid": "e5a54803-c61a-4855-90ac-687f53518808", "comment": "Malware payload (Mirai)", "value": "d526a584437cd98be2d8bb877d833aac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718554, "uuid": "e6f3a650-2f32-429e-95f3-5f1e917aaeb4", "comment": "Malware payload (Mirai)", "value": "671a554222cb91a65c3171946dbcebbaafe1a127e228bd03ae00589e6c2e5d6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718554, "uuid": "4f670f4e-6e4a-4b29-9bca-e4c19d629cfd", "comment": "Malware payload (Mirai)", "value": "f6498b451e0e54af275322d3c2ee07e712d828da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718554, "uuid": "82d13144-b4c3-4be9-81b4-c0c2fabf0e72", "comment": "Malware payload (Mirai)", "value": "acec3f6d45d83c2cbf21eb6796ab7390207df2baf8c876a051faf70c1ba0da5e4a5358bd29b3ad15c9b124ce8890f12b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718554, "uuid": "2047f76c-a183-4833-9270-ca94d99426af", "value": "T10CF33956F890DE61C6D216BEFB1E1288331317B8C3EAB106CD145F7467EF84A0A3E946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718554, "uuid": "40526627-52ca-4c77-bd9a-9cadc16d5cd1", "value": "3072:VfGqVLvzjo/PXjKSrdgYoMXi0XaqJ4zwvYNY1hwzaLKSBdxrVt71f:VfLVLv3oXOslKqJ4zwvY6hwcZxrVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718554, "uuid": "e872515b-115a-42a2-b1cc-aa837437b8d7", "value": 165240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718554, "uuid": "fd1fab2d-8f42-4f85-96c2-d72f0ab68962", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718554, "uuid": "33ed0604-b618-4c79-bb60-efc076860f97", "value": "wj0s.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700b9a64-aa48-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788736351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788736351, "uuid": "1d42d2a4-ee1c-4472-9f10-02754b8d831d", "comment": "Malware payload", "value": "b3148634c8654854e404f555d2bd2b96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788736351, "uuid": "2ac6bba6-a818-4466-a8ef-d478e7a1eb13", "comment": "Malware payload", "value": "67e8ef0325a8725e9884c0b19ac014f0c3ea497eee1f905187b8d77b25221689", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788736351, "uuid": "28f42dcb-8a00-4f39-ba7f-c8c4e02b7d61", "comment": "Malware payload", "value": "3692cd56bedffa423bbec11f824a3c0fbdb0de83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788736351, "uuid": "f9a9d04f-8383-411f-8f16-fdc867c70c82", "comment": "Malware payload", "value": "7180463d8edaaa044ea69bd8a014ec4ff3783e949272f12860902be74c058532bf4dc920501658e9397130bbcddcad35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788736351, "uuid": "6636bacb-96b6-4962-be42-ca36b80c8f7a", "value": "T136D66B03B9A861F4D45D9A34C57F12A3AB25BC8CC73563971E406A302F6BBC17EB6358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788736351, "uuid": "3efff7ce-bd18-4f3e-b552-4249d53ac050", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788736351, "uuid": "6fcd3d90-ab19-4003-9681-fdb17dd8647a", "value": "98304:c5nu8M9wv8tC+8XEIWnHFNn1MmURPE9NuDdAyiZ:ckuvd+RIUnUoYiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788736351, "uuid": "e5b3d5ac-aa7c-44fc-8642-0a59002e2740", "value": 13437384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788736351, "uuid": "c4e4cc69-95a6-4bf0-bf2a-597d3552a5de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788736351, "uuid": "17e88530-7b1e-45ce-988c-6b22ee8d76e2", "value": "67e8ef0325a8725e9884c0b19ac014f0c3ea497eee1f905187b8d77b25221689.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae6ac50-a9a1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788664832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788664832, "uuid": "6d53ad9d-7d89-46cf-bd04-af39d1fd1287", "comment": "Malware payload", "value": "4dd0042257ce71039fc3c3dba8ea7c3d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788664832, "uuid": "f7235d88-e386-48b2-bd1d-b130374d364d", "comment": "Malware payload", "value": "67f0c442b8e6a1c84ad5cf8a1346cc691351c2b87162b9aea728d1123b7dc4ca", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788664832, "uuid": "ed952037-5c16-4b27-9f7d-785cc472588a", "comment": "Malware payload", "value": "497b90d654692ed67a866fe127ad467673c2835b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788664832, "uuid": "e4103020-5ec4-4b03-a4bb-28f2b6828179", "comment": "Malware payload", "value": "3b0d62459c50ca98a97e3c5c6cba49dc108f0bc91a3da6c1ffce48a86eecfbff534835632be46c581da40df2fdc431a0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788664832, "uuid": "b3d9e16d-d5b2-4d85-b64f-eb2426dae242", "value": "T1CAC27C956A867C44BEC98A3E4CBE2B1D6DF5C3D1224942AC3D8A3C71DC11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788664832, "uuid": "6f4d6046-7ccc-4975-a500-6a744e5f81e7", "value": "768:V8vCB+25j6es8Rm9FYpMSUpi+20qUpi+20YQX:V8l25JQd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788664832, "uuid": "bea994e6-7e7a-461b-9e24-36a293a6362c", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788664832, "uuid": "e9488f55-530b-4745-ba89-d57b22d9442b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788664832, "uuid": "247d8a50-714a-48d5-80e7-1185b5108b56", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f459e5b6-a9bd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788676873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788676873, "uuid": "d5f6b890-0ebe-495c-bcfb-32efb8e29913", "comment": "Malware payload", "value": "1854dcc174d9ca672026036f3913afa2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788676873, "uuid": "27215402-5666-4f23-acf2-f745cf3641c7", "comment": "Malware payload", "value": "6835371019f25845227b2aa4b0cba3cbd38804c9b4299c5165a4f167fdbf26a7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788676873, "uuid": "15ad129b-fdd6-472f-a7a8-e071a36f98b0", "comment": "Malware payload", "value": "c1b071f58a49f8e4a0502531e7d54d88753c1c25", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788676873, "uuid": "6422c238-dc13-4b36-9f10-5fc6ec57e1fb", "comment": "Malware payload", "value": "d21e1e43b6d03065dc80a64a97caf5134e9fd72255b76a422ce4b93c0703042aa50d0e34ccf5a1beacfede2fb99ca99b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788676873, "uuid": "8e30b2ec-fd48-49a1-a4ad-5e50cdfd59f8", "value": "T127C28D956A967C44BEC94A3E4CBD2B0D6DF5C3D1224942AC3D8B3C719C11F9CD618B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788676873, "uuid": "1e2bf8c1-a13b-4439-9367-3f0d2c6b96d5", "value": "768:r28vCB+25j6es8R69FYpMSUpi+20qUpi+20YQX:K8l25Jsd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788676873, "uuid": "87cbbec9-737f-4274-9a2a-3d327a09f6e0", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788676873, "uuid": "f6aac02d-d821-407f-b9c2-0cd7ac43b03f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788676873, "uuid": "3351c0d3-5012-4db4-ab43-d54f424d6fc9", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa32c2df-aa1e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718544, "uuid": "353fb245-c776-4fe8-8a40-e4da2714bd8d", "comment": "Malware payload (Mirai)", "value": "3db40aeebeb1aeaa51b0c73cf2f1e34a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718544, "uuid": "59457f59-b389-48d1-8272-34bbafd5c2e0", "comment": "Malware payload (Mirai)", "value": "68743696ad6ad35db5ab15152bfe906f09f5712df6349cb6fd1a7228fb303702", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718544, "uuid": "d72e68b8-a83f-4adf-b887-9d81a2cc4c32", "comment": "Malware payload (Mirai)", "value": "9f66b5197326537fd6145055c06d8ff1407f17f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718544, "uuid": "db081416-28ee-45a8-867c-8a6166db654b", "comment": "Malware payload (Mirai)", "value": "0ac392f0c3080fc883e1be47beff8d19b69696fb7258d357683d470c61e76651d92547163c8532f4a8350166799bb72d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718544, "uuid": "e5a05ed4-b1ae-4d58-a6f8-feff413cc4cd", "value": "T1387302A761A3C2F3D67720B235A6624DE652D147361A533F0781BCBE2CB2927F264F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718544, "uuid": "a480cbc2-43df-4e13-806c-9290e160b110", "value": "1536:yic+Ea6jAIJJYmIvMcOGuoMcvMRiqAtmbuGPB+YF6ZHX5Y+rkC+O:Xpl6zJYFMEocvvt6us+YFCphZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718544, "uuid": "a14898fc-3e62-43f2-82f5-78c300f80d58", "value": 73928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718544, "uuid": "36e38da5-a4bb-4dc9-880a-5a9b8f93993a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718544, "uuid": "d569bf4d-8e16-4a94-9194-bf947b273f60", "value": "wj0s.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dae9018-aa00-11f1-bd95-42010a9c0009", "comment": "Malware payload (SVCStealer)", "timestamp": 1788705504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705504, "uuid": "287d1a6e-b947-4b2f-917e-0efeffb519fd", "comment": "Malware payload (SVCStealer)", "value": "a5aafa3fb6d1d9ca39faa48291cdf583", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705504, "uuid": "8ddf0e8b-cac8-4cea-b024-f83ee75e533b", "comment": "Malware payload (SVCStealer)", "value": "68820341f896670ddcaae0ff78ee95702814a407a74fe8f6c897a2929683fe05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705504, "uuid": "752adda2-385d-4b2f-89ed-1948b80d5844", "comment": "Malware payload (SVCStealer)", "value": "096151c4d5a8f893769490ae800c979cb52b5b8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705504, "uuid": "91294110-86a6-4405-9646-90afd2686275", "comment": "Malware payload (SVCStealer)", "value": "70fa0511d79c5d5ab58d33a51424c28c9b800f8c06e14368457809a72167a624498132601fea0735ec67e7a526d2f247", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705504, "uuid": "0edb39ec-e667-4379-9617-4793189a5b37", "value": "T13B432B3752DB8271E8964338DBF9073FE57075426A30334F436CEA192FA6352B518B9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705504, "uuid": "12a2c6d1-dab6-4d0d-91fa-591de37aad6e", "value": "768:8oV6NSmBAH06aUpQ2LJ7MGMu9iog2Zg5eF8fNryjXyXfB7LeF0HRhdfhdGa/iiNL:8oVWNB4adBW8eZN0NFXfpxv/FMx41p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788705504, "uuid": "978e568a-656b-4d12-a602-e844c5ec2c5f", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788705504, "uuid": "32b3a16b-7967-4271-8306-61c16f6d6dd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705504, "uuid": "70989ed5-8b0e-43c6-916d-2c28dc5c9d22", "value": "68820341f896670ddcaae0ff78ee95702814a407a74fe8f6c897a2929683fe05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "712fcccc-a9f5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788700705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788700705, "uuid": "0e9b0d8a-325b-4fb8-a1d9-fc3ef20439e3", "comment": "Malware payload (Mirai)", "value": "a8020e57866a3b3c27507839cf940de6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788700705, "uuid": "75f7e00e-8ac6-41f6-86ce-dd43ef9d8eed", "comment": "Malware payload (Mirai)", "value": "69dabccbe65b8fdca8d6dec8c06ac644b4430eaeb2039e1ba1e984652c6bd675", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788700705, "uuid": "9e620e63-bfa5-4d40-b1b8-97dec6da2047", "comment": "Malware payload (Mirai)", "value": "cb3e046cedcd41376e854c15862589b40fd1af5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788700705, "uuid": "54782331-d6b7-4f2e-9da8-a1427fbfb162", "comment": "Malware payload (Mirai)", "value": "520be94481a0ac98e35cb42c2a07366c2e7d598b16263fcb2da4bb61412c893030520ff006413a5e5630d640e88d0cb0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788700705, "uuid": "eb943e7d-be9b-4f85-8a58-b3cd9296fd0f", "value": "T128043B46EB418B13C0D7177ABA9F42453333ABA5D3D7330699286FB43F8269E0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788700705, "uuid": "e6d6425e-1d96-4c33-9fc6-3543f98bfc57", "value": "3072:lpr6Zj8PnCuNWa10mDcFYJZjovoxhzg68mKptyM/9JCmfwsrhK:lpr6ZjSnC4Wa10mDcFS6v6hzf8mKpMM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788700705, "uuid": "f1f9a4c6-9168-4f4a-ae1f-8bef25f9d21b", "value": 182484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788700705, "uuid": "2e6e3bd5-4d24-465e-9d00-26a5e893e6cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788700705, "uuid": "6f3dd717-b0e9-4052-ab2f-0c80f3d978ce", "value": "59d51ea90b24d9d0c9724bf967b7ce3f0536c908bc5a6dbcb8f0b3e4ff16242b.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f29cf5-aa2b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788723829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723829, "uuid": "7fd28902-5578-4781-9161-03c3e5c61c6a", "comment": "Malware payload", "value": "1d9f5bcd1b117cdac4c95f1515321137", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723829, "uuid": "16f10c52-69e1-47c0-861d-451bffacd8b2", "comment": "Malware payload", "value": "6a6b2b5e9349887e370b97b2c4deb54898ec0736a6793cc4ca4b2620cb96d12b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723829, "uuid": "c49663d1-146d-487a-8d0f-36574e4a0339", "comment": "Malware payload", "value": "aed295c9b00bd5606834f96a2ddcad9f88478174", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723829, "uuid": "6af1635b-9f94-46e0-bfb3-34fc391ae6d0", "comment": "Malware payload", "value": "0a58e42381d4772f5b63f8a26df19ccaa9a29b9cedcffc4e77abafc050cdb822056bdcbb83ec2b5e5b21f01e91bd143f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723829, "uuid": "3254c51a-e652-4756-9cef-f074518d49cf", "value": "T103454A17E26364ECC56BC1748667A772F970B86901347E6E1F98CB312F31E60972EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723829, "uuid": "23a44b77-f4cd-40b6-bafd-244007245c49", "value": "9bc9be2eac143a21bbd0d21b05e557e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723829, "uuid": "1c6f086d-b7d8-4753-9046-8a7ce8de5e3b", "value": "12288:rf3038kDOc5xl/K/j4ACo/0Mi2JGCc8xDfihyTWjIKcg1JEnqfvc0/PoMUkmTCQu:rNkDn//K/j4AV/0MLJdFCRLPAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788723829, "uuid": "d93212d2-728a-4ec8-b63c-53a3584fe387", "value": 1209856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788723829, "uuid": "62560e9c-a64e-42b9-b613-b43e9d3d35c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723829, "uuid": "b0b4ac3f-8f91-4a6e-9c08-ca7c448af333", "value": "003_hook_CHROME_xor.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f7abaf5-a9c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (QuasarRAT)", "timestamp": 1788679093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788679093, "uuid": "31c488d4-5295-469f-b59a-6aaf1a95f7b6", "comment": "Malware payload (QuasarRAT)", "value": "adb97a4ba31db339c57c65d2c850cc74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788679093, "uuid": "fbd8075b-6f8e-4509-8f27-54b5e2a9f47e", "comment": "Malware payload (QuasarRAT)", "value": "6ae48c7e21dbe0791b95f03746ace0c564c21a4f4239652cc5c13c19d6e2f880", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788679093, "uuid": "8a55d94f-a125-4f53-9fb8-4f14bdc4476a", "comment": "Malware payload (QuasarRAT)", "value": "9ae8bc550c60d88f0e283a95c98f1829d9283bcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788679093, "uuid": "3b6d18f9-f90e-4e5a-95c9-0cb65a6d11b3", "comment": "Malware payload (QuasarRAT)", "value": "2c9391b52822ddc63edc7c3c245688dc82c15bd1d171a944ded9b3df375320256d0bbe8c1a864e6119982228bdf12c22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788679093, "uuid": "20549aa3-4963-4ccf-9d7a-8b708b6ad4c2", "value": "T1DD5633372591FBAEC6ED9C340BD0A10F3B49AAB687ACCDFD1E440953D3669C4A150F86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788679093, "uuid": "c139f7f3-6e4f-4aa0-a3e5-54c692f8357b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788679093, "uuid": "83bc1c7d-70f9-4e74-96be-1931f3949275", "value": "196608:uMeSNmo1q+Te9HcjOZptRkAwDEbDof/+cLAi:1hn1LTcHcjOzueD8/Db", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788679093, "uuid": "f0056dba-1891-4e42-9589-73e534c4b551", "value": 6386420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788679093, "uuid": "b95a12b6-0af7-400c-8f89-210bfa9abcc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788679093, "uuid": "624481b4-039b-4049-b946-722ecb3fa8ee", "value": "adb97a4ba31db339c57c65d2c850cc74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "220b6ffd-aa19-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788716034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716034, "uuid": "dadd98f9-5ebf-465b-bdaf-a45fad5b2d44", "comment": "Malware payload (Mirai)", "value": "9833830826dbad304e6f55f59a701274", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716034, "uuid": "aa4b6119-ceca-4c0e-a6be-66773567be49", "comment": "Malware payload (Mirai)", "value": "6b79651654d8d9fd1fb9281d22c455ee991ba0a4606a461428a5f61e3aa59a72", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716034, "uuid": "f64299fe-2bab-4163-a455-6808c64ce690", "comment": "Malware payload (Mirai)", "value": "c89b1eb9d515cf7570de80bce8038ef1fe8e1ab5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716034, "uuid": "74d011ae-1000-47f9-8611-dd79b0452b68", "comment": "Malware payload (Mirai)", "value": "4e181046768e6b94d01b2acd563e8126799379fc829fa1499d1f4263b958fd1ee886741cfe1121c148da451efa79852f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716034, "uuid": "c7b85e95-27ed-4c5f-aa54-bd5ae2d7bb20", "value": "T1D7B32959B9818B22C5C212BAFA1E128E331357B8E3DF73179D241F6477C696B0E7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716034, "uuid": "71d7c097-2a21-447e-8a87-d7ba82a202b3", "value": "3072:/gazwz1wyggswLgXaR5+UfacmMI8ywMJC:4azwz1wygJXaR5+Am57JC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788716034, "uuid": "5156d43e-033a-42b6-acc1-f73a0c0d9918", "value": 108208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788716034, "uuid": "c5adc6bd-b767-4916-b958-63dee4b38450", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716034, "uuid": "ee9d9b3a-3a79-4431-91e6-f78e6f10da27", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dd924be-aa2b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788723839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723839, "uuid": "872395c6-adcf-41c6-95dd-21f46886bf4d", "comment": "Malware payload", "value": "c6d034965520cf0b9db8603855648760", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723839, "uuid": "71757fe5-c59c-44f1-ab91-9f57d524e394", "comment": "Malware payload", "value": "6cf67d5bc9970153926c7b65e1b25c18142ea8185f077cbf43dd57fb6491c421", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723839, "uuid": "4c42a100-a1ed-4030-b1f4-c88a2eb00607", "comment": "Malware payload", "value": "89ad8670ca8a6547dc52d6086a2f0265179d9a57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723839, "uuid": "5d6bc5ab-0761-4775-a937-6e852a6f2a59", "comment": "Malware payload", "value": "ad4cac9c7ac16327de74b3f7f42cefc557e3a9d5f60059ff0449885aed4c36b4f5f7faaa4ab10049087a6ba74e5ac219", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723839, "uuid": "c7b541a9-6f74-494a-a730-a20d2e60cf97", "value": "T184454A17E27354ECC56BC1748666A772FA30B86941347E7F1B98C7312F22E60972EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723839, "uuid": "c34e0b85-7a4a-4945-9d6d-3a07df2529a3", "value": "9bc9be2eac143a21bbd0d21b05e557e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723839, "uuid": "55a834e5-2d50-467d-afe4-7c9ce942eedb", "value": "12288:ziPP3F/GThqoWKRek4IoD8M6dA0cWET+2QLUGZr5N+gSMip2PjUmNNCRK0u:21/0/WKRek4LD8MoAFLHMP/sRK0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788723839, "uuid": "f1f041ea-8d60-4486-b411-1c4142c10402", "value": 1209856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788723839, "uuid": "fb05a567-5528-4140-8860-56988e1d747e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723839, "uuid": "dcd404ab-be6a-45c7-a1bb-8be29c3d1e26", "value": "004_hook_EDGE_xor.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a9733e-aa20-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788719265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719265, "uuid": "d4300a70-651e-49b8-a874-83405a6d02e7", "comment": "Malware payload (Mirai)", "value": "9ea7afc77629a4c4b2adf5797679e0d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719265, "uuid": "c8696258-f4b9-43d9-9e12-64aace93ce4a", "comment": "Malware payload (Mirai)", "value": "6db16a14ceb98491d62dd1414e63e501dba7a45c75efa42c06a32ec6e4ff5db8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719265, "uuid": "28205ff3-4166-4250-ad2c-b3d99c62163a", "comment": "Malware payload (Mirai)", "value": "5c622e3d475ff978fa0756cb43c66279eb721859", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719265, "uuid": "915639f2-8f2d-4bfc-9a7d-982c623bae25", "comment": "Malware payload (Mirai)", "value": "8bafa3592fe5730b36e20e847ebb057e33d9136b5d94ce981467adcfd6bf2224dd6b4e3cf4773b8ca9ac0308c3828603", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719265, "uuid": "d8cade9c-9dab-44db-9d18-1af3df80a941", "value": "T171146C2BB3C3ACE6C51063308C316362776FD7081958EAFFDA1B3794A99772256246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719265, "uuid": "d3efbeed-5e80-4872-af90-e3d0ad5bf6df", "value": "6144:1R9Om5159ZA0mzoWcz4Mm4ztkES7IKTtw:BZAyFzQSdS7I5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788719265, "uuid": "8229a1b9-265c-42da-85d0-4521b06b09e4", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788719265, "uuid": "6f2e9bc5-3d3c-4a77-a26e-5a94b8a0a098", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719265, "uuid": "d0a3f2ac-455a-4320-aecb-bd610f46658e", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a48614-aa2b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788723872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723872, "uuid": "3a7af1ac-8de4-4ff4-811d-4fd1d89e0fd7", "comment": "Malware payload", "value": "815c3281cf31f1a5b867d588358dedda", "object_relation": "md5", "Tag": [ { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723872, "uuid": "a0dceea3-dcb1-4b0e-b218-cccd0fe4ccb8", "comment": "Malware payload", "value": "6eaa66cfe3d62cf967dece46f8a6851dd2c6cc71521f7ec57b30ea4c1ac295f3", "object_relation": "sha256", "Tag": [ { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723872, "uuid": "d51972ca-8b81-48ce-9f9e-b97a7b5b986d", "comment": "Malware payload", "value": "8fe5c16f42628757d201d24f8d14b6dd157cddc9", "object_relation": "sha1", "Tag": [ { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723872, "uuid": "0cc12086-3966-449e-afa9-91b0b8ab6f2b", "comment": "Malware payload", "value": "a65b75f6bb0e2875d93bb13042444154c160b0c60e9bf263f3e689d17043ea816dd50497d9f6aeec408e85001aa4bb3c", "object_relation": "sha3-384", "Tag": [ { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723872, "uuid": "6fffb861-09df-4951-8066-3167a580252c", "value": "T1B85185579E16CD28E86F16238EBEED2E3D3C001FAF51C482E07D8E5435947B4539650B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723872, "uuid": "df15f7a4-2390-49ae-b55d-f1b3d4f49d5f", "value": "48:9NyDXYHsggT7pbvxpEqi3jj8ddALhn27YkLpcdAjchnDFXzWdLBYndAlSA6o:3yDXYDg3NvxppiErv448OSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788723872, "uuid": "238745a2-2244-4b94-b719-45da38c9191b", "value": 3039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788723872, "uuid": "e390ee31-6385-4e95-a992-f10dcd2e622d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723872, "uuid": "964536c8-164e-4190-a96b-30264d855af8", "value": "Document-52848.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb3e746-aa2d-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1788724830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724830, "uuid": "b1309400-1040-40b1-8db8-c76b414ab451", "comment": "Malware payload (njrat)", "value": "5a559b6d223c79f3736dc52794636cfd", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724830, "uuid": "4d0ef6be-1f58-4700-aa50-91d5c6cffb69", "comment": "Malware payload (njrat)", "value": "6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724830, "uuid": "812bed8d-c9a0-4014-9004-7d3337481f41", "comment": "Malware payload (njrat)", "value": "5c4676b37fcd49990d21960a2df57af72ceef29a", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724830, "uuid": "ad8d902b-75b7-410d-b015-f070de701b4c", "comment": "Malware payload (njrat)", "value": "752856d3804b15f1ad18cdc35baeb6b7bd3f648506da607387c150119773272368d49163b3c09d8fd2111cf01952e8ba", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724830, "uuid": "466c2eaa-a314-4911-8de8-7f7fe642d418", "value": "T154B32C4F2BDD901ECDE0B374E68EA7C9009199D596F118826BEF0078019F36BE778D96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724830, "uuid": "3e513d69-720f-4b3b-866e-709b260eead1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724830, "uuid": "467be15b-ba60-47ff-b7f5-9885f5274cf3", "value": "1536:aDYEasJqkUssXOcfaAJzYU4r/1CbSYlIePDVFkhgIJZH:aasJjUfFOderYRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788724830, "uuid": "aa83242b-da67-4982-879b-5286580318bb", "value": 107520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788724830, "uuid": "32fefde7-eb7b-4dee-b8d3-12127e81aa92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724830, "uuid": "d9a7c5d3-8551-4d0b-bc1c-ce457801376e", "value": "hostr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c918a3-aa1f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718564, "uuid": "b628217a-20c0-4168-803d-8844f5eb3a91", "comment": "Malware payload (Mirai)", "value": "69a5ea344b2496edf7549098cf7aafca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718564, "uuid": "1c3f440e-78a3-4917-8a9a-6baae9d3c560", "comment": "Malware payload (Mirai)", "value": "6f7a14a3d1ec4a6b3c27d0c9bf2f0ab55f99e39941635c90e5ddb27cbe9865d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718564, "uuid": "2cc0d616-a24f-44dc-afd5-445bfb54819a", "comment": "Malware payload (Mirai)", "value": "5bbab5916b20914a6d49531be869688abb5c052d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718564, "uuid": "8a126088-d277-4824-965c-3348b4ee7b5d", "comment": "Malware payload (Mirai)", "value": "75b26e670a1ce4be35189a8835a4e77de108e81d305b1f7d557a0096aa937021b48aa06b3d216305a1bd440d947da9e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718564, "uuid": "7f3e0169-1616-430f-b64f-8dae53826560", "value": "T199145C12FB0C5563C1821FB04A370B65D31E64D30DBBE14D2609BF991A379FA968BF89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718564, "uuid": "b7807c77-5f4c-4266-aed3-e4be8dc79bbe", "value": "3072:IAtnhJmkeKVkbWH1HA24OFrdyXyGVYwYIyRU8X2ZCjJlWxuaB7uFWYDt07XUol7:5kSVHH4OBdAhxYIyW8X2KJlWxuPFW6Ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718564, "uuid": "00c9b9bb-3034-4eef-8acc-a011725570b2", "value": 198216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718564, "uuid": "4b348307-e316-407d-bb2c-cfb59fca030a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718564, "uuid": "9638a4d6-00f6-4c4a-80ab-b4637283c502", "value": "wj0s.ppc-dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6f2124-a9bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788675971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675971, "uuid": "db8a4fda-359c-4e5b-adf3-e9ae39890544", "comment": "Malware payload (Vidar)", "value": "c553d103c501e797e2f4876cfa970c6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675971, "uuid": "abca131e-2f3b-42e6-8f86-bef0d151608f", "comment": "Malware payload (Vidar)", "value": "70efc12c62323bf9382803b1b68e61f341e687312c1ca8d87e962e5265e9dd91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675971, "uuid": "12466a0e-b8f9-4f30-bd7c-5ab42bfed888", "comment": "Malware payload (Vidar)", "value": "4fcd51b7818989733cf985315b2a4eda36c27f48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675971, "uuid": "ce5eb4e1-4409-4115-890f-6aaae66d58d1", "comment": "Malware payload (Vidar)", "value": "1c13a37c7f4af75869c2a023e5cdab726be16d8f38e6171ca43f1dff02b1d9fae19afddfc1686ee956cf7a3dc57a18fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675971, "uuid": "266e92ae-ed54-44e7-a07e-5fb1bc354218", "value": "T112283303BC91449AD479C27AD9668352FAF5BC180B31B3E73E107AB43E367E1553AB18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675971, "uuid": "90c018a9-de6d-418a-81c4-c895bc3721a9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675971, "uuid": "9621b6e6-2fd2-42c2-9ed5-f3f002a7a244", "value": "1572864:4oXvgHGgsNTSME6fzB19yvq9SNnu5NgMl0IVbXQMQi2SMPZh6a5Ogl3OwgsM5:GHDsdSafzBXfAnEN9+GbXqeMPZh6av+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788675971, "uuid": "cbf93fab-899e-428f-9bb9-124ad17f6a95", "value": 94802288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788675971, "uuid": "4d41be2d-4d16-4f1f-875c-80efa870cecd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675971, "uuid": "d9756ace-b27b-431d-9f4b-0e09e6b8b23d", "value": "70efc12c62323bf9382803b1b68e61f341e687312c1ca8d87e962e5265e9dd91.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "435994e8-aa2b-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788723821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723821, "uuid": "38b70546-64ad-46ff-b2c2-fefe78147eb8", "comment": "Malware payload (RemcosRAT)", "value": "475482be775634683e6cbef70202be6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723821, "uuid": "02aacafe-b4d5-4ca0-a2fd-8b257405b0c4", "comment": "Malware payload (RemcosRAT)", "value": "716a31908fdd9f7fc83481bd49a272ba666fd970c0884800ecbdaeda6ea6a8ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723821, "uuid": "284b2703-aa6e-4a16-b4bd-ac26f5af76d9", "comment": "Malware payload (RemcosRAT)", "value": "7b4eea828f2b7dc70319b9176d1e27ce6af545ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723821, "uuid": "c3531ec7-d71d-4a7d-b384-c4a177b56cf5", "comment": "Malware payload (RemcosRAT)", "value": "36c60ef722ad289e92e0bc497ccfa2439d2b3396df2e11022739eb1a5e0e613c5c187f74704cf4c3485f605c9b62e9cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723821, "uuid": "92be883c-0c2a-4faa-a9ea-9ff0eeba68a2", "value": "T128E46D59A39402F8D0B7C135C982952BE7B2BC065571472F03D70E9B2F276A16F3EB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723821, "uuid": "261286b1-4ac8-4cc2-bfd4-04154c9b1324", "value": "91e69cff27767212388496ea08379c84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723821, "uuid": "37dd89e9-0d60-4beb-9ab7-aab471b76d65", "value": "12288:BIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDza:G5GXkH4nnwitNfuq9wgs3y3V5vgNyo38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788723821, "uuid": "4236332d-5876-4441-84a8-22d688dd846e", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788723821, "uuid": "4f7bad74-a599-4d51-8101-87a644139971", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723821, "uuid": "813bb885-3fae-417e-a85b-20b436926682", "value": "KO_THE_CHAY_DUOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a2d33fa-aa19-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788715994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715994, "uuid": "2c9fa25f-4523-452c-8130-6e1dc622d7a1", "comment": "Malware payload (Vidar)", "value": "dfea342c0c087d3ea0d0f6e59a618714", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715994, "uuid": "d9ef7e77-056f-4904-af8b-9ee7d6d8176e", "comment": "Malware payload (Vidar)", "value": "7201e2ca1792e127587564991099a805ff6554bfa17f8b6ff8eed8a4cabf4b96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715994, "uuid": "c697fb8b-3e1c-4f66-8c58-af42db647800", "comment": "Malware payload (Vidar)", "value": "67466cd004abf3c6d65c158f7fcbac83f6c83b69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715994, "uuid": "112ab0f0-a234-4e22-b1dd-ce1fa4b8842a", "comment": "Malware payload (Vidar)", "value": "f3b6bfd27499cc86189d6ab90610b3f0aa2c940e92d7689757daeddc7cbe42abd53bcf54c7e671494733bd34ec2350dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715994, "uuid": "bc7766be-2746-478f-bbfd-df110392573a", "value": "T176C64B03B95804F4C955AA34C0BF5263EA64FC8DCB3977A71E50B9702F6ABD136B6384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715994, "uuid": "a083ff43-6412-4cc6-9042-d0355c8e1111", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715994, "uuid": "d5ca4aa3-468b-497a-84fe-e8dfe809cc8c", "value": "98304:Lg03Qop48mDuIC0JuXxudkV62oQP1B//6t:Lg1owD9QhuWX//4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788715994, "uuid": "562b916d-047d-4818-9dc4-40a76f17724d", "value": 12506568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788715994, "uuid": "35c9dc24-838d-44e0-af5b-d324c35f594d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715994, "uuid": "ccdfc152-1d9c-4425-9f8d-f9886925ee08", "value": "7201e2ca1792e127587564991099a805ff6554bfa17f8b6ff8eed8a4cabf4b96.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd17d75-aa16-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788715057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715057, "uuid": "ef504d0d-3e4b-4244-8b26-779197ad8f62", "comment": "Malware payload", "value": "c54cb010b0510417c79b4935ab17f521", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715057, "uuid": "1380c638-6d43-4785-b915-a9da50d4039b", "comment": "Malware payload", "value": "745c0cd5124b60a5f633512deadbd7dfdd06703ff34ec7f8d06b56d4a24fb4fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715057, "uuid": "c4731d47-4eb1-4ef2-8203-18b1c7a6f360", "comment": "Malware payload", "value": "f43fb13e228bc03324c94b296078f42d696feeba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715057, "uuid": "30232916-4546-4e2f-97ac-28ac97611d2f", "comment": "Malware payload", "value": "1f6c133c6ddd4c8cec3bd80fba01829893bd0dc826342c8d31a1c8a5bd498acf7b0fc6a4b2895ca0801c91704ad6e62b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715057, "uuid": "e5d8d6e9-ad7b-4fd1-b1c2-135a81e64842", "value": "T1EAE32A98F890DF26C6D0267AFB9D428D33530778D2EA7105DD149E3623EF91A0F7AA41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715057, "uuid": "4b03e580-1a93-4743-bda8-e52ad4876bff", "value": "3072:tfQHbAjpbIpDAPt21ZBEFaPUgdVBLRJjTd6vIbfqMcuoSAVgKOr9Gw0aJp:tfQkbgAPt2pPPdXRzjbpoSAV1Or9GUJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788715057, "uuid": "08a7de37-4335-4d4a-a3e8-78b1b8338782", "value": 157012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788715057, "uuid": "6e809e97-17f3-4a2a-a716-9202b7187fea", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715057, "uuid": "659d530b-0ae5-48f6-9cb5-2f25030b40b8", "value": "745c0cd5124b60a5f633512deadbd7dfdd06703ff34ec7f8d06b56d4a24fb4fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da15d5ec-aa47-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788736100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788736100, "uuid": "bf97e6d7-1857-4ee7-8948-2ff74360b3bf", "comment": "Malware payload", "value": "c78b60ce5342bf9df1a81e4165c433cc", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788736100, "uuid": "b163b701-9133-4476-b2db-7c1c62cdbc5a", "comment": "Malware payload", "value": "74a28581cdc96b69d58c1b2f640c2f3c6932d11eb4b53fb5bf9cf2e89ac30dd4", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788736100, "uuid": "82af0ee2-757b-48e6-9e68-efdb3ef96692", "comment": "Malware payload", "value": "12cf71c80316f19513163cab9c8c73944ac75a87", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788736100, "uuid": "fa39a393-8937-4603-8a29-a268d078e9d9", "comment": "Malware payload", "value": "ecd44c0170a2fef8836931554eb664a1534b73c1332df5c40c632c2dd811603764bb91e25d8da4aa948e07cf4d2948fc", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788736100, "uuid": "594967ea-4518-44d6-8d89-9e2df68d8de5", "value": "T178B4F15BF78817F8D12AE67889654A45A6B2B4913B527AEF07A001E35F737C04D3FB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788736100, "uuid": "f0cf4a60-ad9b-4846-9039-96f0793ac5ee", "value": "fd0cdb4a8a6540edb41d120205cd9d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788736100, "uuid": "3b1589df-0458-485f-8654-de791965eb9f", "value": "12288:r7558r/GPc1rwpBdITX8GsEilnfT4Z8N:3kGU1rwfly+k2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788736100, "uuid": "5ea17734-25b6-49ae-ab9c-93002fae9a24", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788736100, "uuid": "51b1bbe5-30dd-4a5a-b858-0535f92fee4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788736100, "uuid": "cfa48275-d7d2-43a4-8c1d-13dd08e0e216", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31981a1-aa04-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788707231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788707231, "uuid": "713bdf03-ab31-4141-8633-8255d4f0ce5e", "comment": "Malware payload (AsyncRAT)", "value": "9df2d77dfd3b802930a2497c02508750", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788707231, "uuid": "24d1d9fe-a215-48eb-a4e2-60c890b5f3d1", "comment": "Malware payload (AsyncRAT)", "value": "754bd1a147a369aa267c09697306bbe9408365f3b64c77ceeca129f84b2061c6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788707231, "uuid": "ccf604f8-0bf5-4232-9a64-301b8fba9e91", "comment": "Malware payload (AsyncRAT)", "value": "4aa764b30d27cd42dfe716db477c6b40b4c85f05", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788707231, "uuid": "59ec90fe-ea3e-4af2-b325-eee6b2941422", "comment": "Malware payload (AsyncRAT)", "value": "e9223ff4dd96dfff7adeb43f20ce0a7ffdcc602655aebcf7b1e0b61a6a304e02f56063c7e364f3ce10659436115fb4dc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788707231, "uuid": "bdbba292-2e6b-4d40-9789-27c246121c09", "value": "T1ADA44B3851547BEED9CFB973CFC49BB5337A4A66631408F88A05F9942693237DA03C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788707231, "uuid": "978647e2-c7e8-4390-b08d-94439ee3a511", "value": "6144:WWnWBh0OqeZv0rin/YQi1iPp10WH4QTyR2hRDmr16D0qBcWrgmrG0K3qGJhQ2S3:HCdYfAx10Sw0k6jBcWvrGj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788707231, "uuid": "d7a58cf4-0c78-4d50-bf2f-abc580e76ace", "value": 449130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788707231, "uuid": "3bb35a7a-ab22-4cc3-b840-76f133fbf9c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788707231, "uuid": "ca47c2ad-30e5-494c-bb4f-6c67b2d699de", "value": "crypted.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "397ce7be-aa2b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788723804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723804, "uuid": "ccde40d3-88ba-487b-83df-47c9e755fb18", "comment": "Malware payload", "value": "58bba130027ede25a012103901e1fb04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723804, "uuid": "085beb92-b6ad-42a6-b0c3-243179452571", "comment": "Malware payload", "value": "76007565d910f28b4dfedbf6982dc56afadfa7e3c22cea25d3dd03dd7efbfbd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723804, "uuid": "0d9b0c00-f7e2-427a-acc4-622aec8bd9d6", "comment": "Malware payload", "value": "aeb8777307b268766ebe253736156281c6fde304", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723804, "uuid": "8542c0f1-51d0-4887-8a11-99451680492f", "comment": "Malware payload", "value": "91ab5f6d42ce44b3852921f9288f6b92ea2523a05c3cfa2ba40cdff43c3ebadbdf3cf35c444eeb7b7a35d86b53daca3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723804, "uuid": "b363358f-1ab4-4841-9e10-bb8e1d1db57a", "value": "T162452A17F26364ECC56BC0748657A772F970B86941347E6E1B98CB312F21E609B3EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723804, "uuid": "98a0080b-c28f-48b9-bccc-5905f0795ffd", "value": "9bc9be2eac143a21bbd0d21b05e557e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723804, "uuid": "9242274d-558d-4230-89fd-1663382a82ba", "value": "12288:Mf3W38wyOH5xl/K/j4ACo/0Mi2JGCc8xDfihyTWjIKcg1JEnqfvc0/PnJumlCQZ:Ybwy4//K/j4AV/0MLJdFCRLPJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788723804, "uuid": "b81f1407-81b8-4a89-8689-2da6f1f23009", "value": 1209856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788723804, "uuid": "80cb1b5d-30ad-4bb3-ab37-639c0e504362", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723804, "uuid": "08445204-fda7-4720-8e67-fb549a90e180", "value": "001_hook_BRAVE_xor.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5005a150-aa42-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788733721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788733721, "uuid": "01fed549-a19d-47b3-9368-84c69c256481", "comment": "Malware payload (Mirai)", "value": "4b18b349465b1caea55f4236f91ef32b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788733721, "uuid": "37ff6260-03d6-4aa3-9442-63ff2ca910f9", "comment": "Malware payload (Mirai)", "value": "764e5f51e92dd166ff27cf105a7e1de4ab8689db0aaf6aa404839db6dc549b39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788733721, "uuid": "d1ced37d-74f8-43d3-990e-211704dbd14d", "comment": "Malware payload (Mirai)", "value": "5d003d4a1c3c6709e668510137e37cf96d0fb410", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788733721, "uuid": "4cac413a-5bd8-49cc-8de5-5a8ebc527168", "comment": "Malware payload (Mirai)", "value": "181a9661d6880fe5fe7a0f89949b2f8a28e933a4100529cf0a25a375d4c84a5f479c43c297fdb91cfefabf2ed0f70504", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788733721, "uuid": "37605b42-8825-4cbe-91e9-8bff3449945e", "value": "T168D32A00F990C767C2D2177AF79E429D33332B68979B33255A34ABB42FC17992E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788733721, "uuid": "14c0cf15-3a3b-44a5-a6b1-644c661eb29f", "value": "3072:81Hfa6gzyrlJLQ3navxWIFkqHPVwkqf706CjzmsQTi7aHgp:4JLmnavkwP2kqajzmsQTi+Hgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788733721, "uuid": "206fb473-96f5-472f-bbea-06ed41d4fed5", "value": 130988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788733721, "uuid": "7d195752-d544-4255-8799-1e68e3a34149", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788733721, "uuid": "28146dd0-096d-49f2-b1ee-762d2c0e9785", "value": "kworker", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767116e0-aa2b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788723907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723907, "uuid": "b4a9c011-46d5-4757-bb68-a4f5da216e7f", "comment": "Malware payload", "value": "5ac7bf90e2599423f25f99a20e392bb8", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723907, "uuid": "85d7ba12-dab6-4ccc-a51b-ee5a8cc0cc5f", "comment": "Malware payload", "value": "768e90adbcd48bb7c8f2f577aa84167b3fd90b62a568a64e2f20518628de799c", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723907, "uuid": "f4ee7b39-9bd2-46b8-a1c1-2d9e43d22def", "comment": "Malware payload", "value": "34cc580b507883f79da20c9bfb4650825acea861", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723907, "uuid": "d6b0fa66-7137-45a4-b486-64cf8da5d7d1", "comment": "Malware payload", "value": "c30ed7602a0b8a857661e5d767419834a7ee992774e8349eb51c982bdd1e0e0504c0a24725720f74baaf9723a2ec076f", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723907, "uuid": "013de240-93da-4732-b503-1f0523c0d108", "value": "T176763807EC5515E9C1AD923589B39253BB71BC490B2263D72BA0F6383F76BD06EB9310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723907, "uuid": "7e45526c-a0bf-45b4-a105-ba87ec3c2554", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723907, "uuid": "7f16ad41-3d5c-49ee-baa9-502f34a98b44", "value": "49152:e1ZNjtlwmGKePeF/zK/we8FOAZivK6aZYzB3KnFow/AR5JxeTYDeOVW49Uy5oKQQ:e1n5CW+zUFSFMTaj2uEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788723907, "uuid": "2e0de414-cb05-4317-8e39-de9aa469ac61", "value": 7392256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788723907, "uuid": "90e66bba-0c37-4a24-96ca-cd485d103296", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723907, "uuid": "230c25a9-2b3d-427b-8db7-66e1028f8841", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad3aecae-a9cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788684485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788684485, "uuid": "298786a7-5536-43e9-be58-6f3dc4bd3d03", "comment": "Malware payload (Vidar)", "value": "16a7c31cbad39a8dac3b6de7efe71c7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788684485, "uuid": "41d5022b-bd11-407d-a027-18c207b8725a", "comment": "Malware payload (Vidar)", "value": "76b32b96762234d459750b76cac9e937d027c9d08381c05c29daaa2ac3bc615e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788684485, "uuid": "b2c21bbb-ba5b-4cf5-9ccd-366cd370581c", "comment": "Malware payload (Vidar)", "value": "47e7053d6602a7478deca3c0dc298f4d5b0e0908", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788684485, "uuid": "d53dd411-76c9-431e-8683-2aef13a354be", "comment": "Malware payload (Vidar)", "value": "e1940caffa812648f7b4b6611ace8ddd5876842680d511fc37410f8f55844da3e4e9c0ea9be4b4028dde5346ff788c03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788684485, "uuid": "18f95d90-0c93-4981-9006-f6b8f6e34797", "value": "T1EE18330769AA90F8C0964B35C9BB4266FA74BC98CB3577E32E40B5702F66BD13DB5700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788684485, "uuid": "66158415-4cff-4f13-9d1f-345409dda76f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788684485, "uuid": "1d0ce46a-78cc-4c3e-be3c-15a2942df8ec", "value": "1572864:NUiqHyOvteQtGBEpBr//7Ext200BcSvObgPvzXmIBcZ3Ql12pL8ykhOtiRAib7+3:sSweeGeLr//stUcSvOEvzXWA2x8yCVq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788684485, "uuid": "1eeeaec9-f629-460b-85d1-42a05f7388c1", "value": 90505128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788684485, "uuid": "8c0baede-a632-4d2e-8f1a-199b65b43704", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788684485, "uuid": "c40275c2-ef31-4811-ab3f-b187a0255f59", "value": "76b32b96762234d459750b76cac9e937d027c9d08381c05c29daaa2ac3bc615e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6cd8b7a-aa0a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788709922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788709922, "uuid": "09c1016f-c726-431f-969a-b5183371a11b", "comment": "Malware payload", "value": "889e2eff1d42d9b1c852144a669064f2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788709922, "uuid": "13a98589-2446-4e58-b894-6685b14b3089", "comment": "Malware payload", "value": "775d85dd7aa696d791a6a400e21e6097915a0b206898b380a0517db389fac824", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788709922, "uuid": "8df42d4e-1395-4c60-9861-4bfa86678689", "comment": "Malware payload", "value": "d87e652ce4c958207652dfeb0cb46857469ed49d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788709922, "uuid": "23b3fe8f-ab23-4a14-bbfb-9b16c67c8902", "comment": "Malware payload", "value": "64a354f5d4bc790dd2f861f3f5619e3623c0c8dfe392addcd978a1f3557bfd5615f5499902ac55c910902e2953093eda", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788709922, "uuid": "3f8ed163-5584-4d59-863f-eeacf99f2813", "value": "T116C27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324D42AC3D8A3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788709922, "uuid": "1d3299c2-758f-466d-9e8f-5d89da1d22a9", "value": "768:R8vCB+25j6es8RV9FYpMSUpi+20qUpi+20YQX:R8l25Jzd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788709922, "uuid": "85e01b3c-2198-4357-a688-0f1c705252b5", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788709922, "uuid": "5732e625-0a62-499f-80fd-c540b804ebf4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788709922, "uuid": "9bfb2e35-418e-49eb-bb24-10ebd9536dce", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de1b5df-a9c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1788677963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677963, "uuid": "687e244c-257f-4f06-bfd2-c3821f667b16", "comment": "Malware payload (SalatStealer)", "value": "d2b0013a720cdad2c45777f7d3590a42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677963, "uuid": "dd734a93-bf87-40d2-b76e-32ebd2688571", "comment": "Malware payload (SalatStealer)", "value": "779d1231bfaab9eab75e66187b606997247d95d2b071c20dafd33cf4791515c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677963, "uuid": "111c6a95-4c5f-4383-a873-9c1ab440ac81", "comment": "Malware payload (SalatStealer)", "value": "8d199f624b0b64f8e584b450eb3bbbaa786df368", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677963, "uuid": "aa3fdb74-67ca-4589-bb70-831534f80554", "comment": "Malware payload (SalatStealer)", "value": "b14df1ef5ba256d4f3097025fef6e32e9653f448c0dd36cffa76bb43658bfd919f0f9ba1831e16c279ee863c7af50d56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677963, "uuid": "d84daa20-66d5-405a-8585-9abc7f0b22fa", "value": "T1D7C65C11FACB54F6F9036831416BB27F23315D048B28DB9BEB583B6BF877691186A305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677963, "uuid": "a58c86a9-2b78-4dc1-b686-1e229b0ece19", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677963, "uuid": "af5759b3-5e1a-4395-b794-090e77fa9764", "value": "98304:NGsqTIVri2C3jGdD4/LoAr4i3HVd7EqO/:+Tx3jUDsdrTeqO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788677963, "uuid": "ba1eee5d-79d3-4338-a39f-7dbe7407dcdc", "value": 12570112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788677963, "uuid": "92ff6ce4-2bfa-4e78-8a82-c105c57261d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677963, "uuid": "e555950b-7b06-4465-bd00-a45835cf93a1", "value": "NewLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b2ac00-a99a-11f1-bd95-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1788661811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788661811, "uuid": "3f69a43b-e9fd-4b39-8086-f16a211d4bf6", "comment": "Malware payload (NanoCore)", "value": "ed8c27e5acb067148937e6da6e763d32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788661811, "uuid": "f6fe2e26-9940-4ec3-aa07-450301bc6fb4", "comment": "Malware payload (NanoCore)", "value": "77da09a95342309e29b441182c91d79ff511f5d35bcfda7aaf5a212b763f589c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788661811, "uuid": "538d842e-f514-4600-90d8-bb7b57166c2c", "comment": "Malware payload (NanoCore)", "value": "4e12f2568ed928d24a8e168035040b8ec767abff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788661811, "uuid": "e9dd84ed-45c3-4350-9b32-ec99f3505630", "comment": "Malware payload (NanoCore)", "value": "c1c3480c12ce953f6b432343cecd6e78d31cc1366c11880a9444b2f34058b84ff4211a10b03471ccd9c7bfd55cd92496", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788661811, "uuid": "e60bda9f-33f0-4ff4-b90d-edc96d5d9ea6", "value": "T19314CF2A77A84A2FE2DE85B9611211538378C2E3DCC3F3EE18D855B35B663E50A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788661811, "uuid": "3c27ab1b-bbc4-4b18-9742-fe1730194c0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788661811, "uuid": "9dfcf61f-21d0-4cba-93d3-da76b1f50a9f", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIuIsvu1SEImfAF8V7m8CJvflR5:MLV6Bta6dtJmakIM5PuvImfVqflRj0vm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788661811, "uuid": "3681ffb3-98e6-401c-8b2d-6420294b7296", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788661811, "uuid": "052dadf8-2542-494c-8a08-ffafbcb81f28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788661811, "uuid": "56ceed03-bc46-4917-a136-5d0f47cdb76d", "value": "ED8C27E5ACB067148937E6DA6E763D32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a41a2f-aa3b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788730667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788730667, "uuid": "2cb7305e-1f3e-4917-848e-6361f69f5cf1", "comment": "Malware payload", "value": "9793d48461d9c2ea834c1e9bc9e60587", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788730667, "uuid": "91a529ef-be67-409a-9981-c8e1bcc43a68", "comment": "Malware payload", "value": "7856c46f70d3cf105ee1a4b89a56e66270ef07e364436d33748455e7871a8db8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788730667, "uuid": "131cfd04-9ee7-42e7-b744-f55f6d1d99b9", "comment": "Malware payload", "value": "570ae0979537faa4920abb4956d0e581cc91949f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788730667, "uuid": "c6faa1c0-8bfe-4506-b829-174dd656ee67", "comment": "Malware payload", "value": "94cfe58f82803bc5ac594d81d73151a839377c657ec297c8d3948bea0e1aa4133149802fad682c9dfbda230509e93e3b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788730667, "uuid": "ad8d36c7-6885-4506-ba9b-bea0f87eeb3f", "value": "T1323164DE01141A315002CE8E73A33249A19EEAF7689FD7D4DD685EF991883CCF263B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788730667, "uuid": "b5c9288d-665e-4c07-bf87-88772fc7b8c0", "value": "24:zq/4v3we5rX218MdLCaF1Nljadk9fqIMZMF:zq/EbiNLfNleYxMZMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788730667, "uuid": "45cb8462-7cd8-4b27-b38b-f8fcf93cd340", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788730667, "uuid": "c68f4c75-8f84-4e17-8155-af496f8c75b5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788730667, "uuid": "c88ac8f1-a4d6-4384-8bfe-efb73a61acfd", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a625fb07-aa20-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788719262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719262, "uuid": "e41f05da-c7c4-45a0-96a3-9a2b44fd59ad", "comment": "Malware payload (Mirai)", "value": "29fb087ce9ee379a4c288e5d16f7efea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719262, "uuid": "4d10c3cb-7e37-4396-be64-d67c0a2832ac", "comment": "Malware payload (Mirai)", "value": "790c94c9df147170f67f236d1332c2f22e3130a68b6dcba5a64e2710bf0f7fe4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719262, "uuid": "839ad186-0d4c-4ba8-ae51-18851bbdaf57", "comment": "Malware payload (Mirai)", "value": "ee04bd6a3844521bb6ea89f6d724cc82f8bcec2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719262, "uuid": "17376512-7d5f-49f0-9672-f74abcf485eb", "comment": "Malware payload (Mirai)", "value": "efc2b6d437209e742ec887eb15b0a9faeee624642363d0e22c426592c0dfeb38d2c189ce3ef1b041d2271e913a44fc07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719262, "uuid": "d968196e-8505-4ead-8b6c-50f36a75067a", "value": "T1F95302411A7CE83ACFE2D43D0F2841E786DC5DE454D6901E13CA7DF4CA06D68BAAC597", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719262, "uuid": "f8536959-0c80-4353-b4c5-d7ae5a22fd33", "value": "1536:Mdcqm5iERozq3p7o8FwOA4zCKOFGUfKbeH6UhV/V3U6AQY:MaHJgMo8FwOA4zUFGUO3Uhb3UtQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788719262, "uuid": "d908a1fd-b462-4de2-a092-74ea0ea2e79a", "value": 63928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788719262, "uuid": "6e5423c0-a0c7-4f83-ad23-1108a7938d01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719262, "uuid": "037abc98-ccef-464b-8a22-27f4dda3dd22", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd778c99-a9bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1788677667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677667, "uuid": "0a6775e5-2745-4e63-aa5b-ff06185566d9", "comment": "Malware payload (SalatStealer)", "value": "aac85efd2d298dcb919ee4d30224415d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677667, "uuid": "0877eb5d-64dd-4ea5-add1-f02b2453d967", "comment": "Malware payload (SalatStealer)", "value": "795e30e56ce1e68d271e9e258ea32686cbac763b264b036c48ca7d4fcce80dfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677667, "uuid": "056354fb-30ba-4d04-8f34-cfe330b6d423", "comment": "Malware payload (SalatStealer)", "value": "d232d6b8648c4ab024d5fd1897715cf63a63e886", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677667, "uuid": "55d4d43d-0c60-46bf-a42e-4402a5c80ac1", "comment": "Malware payload (SalatStealer)", "value": "f9431ad007fde33b8bf575e16d5d0d994a4c491f7f2a5e949de6cd1228eb9560488ed9cd3d0c20068c45a2d66df73af5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677667, "uuid": "1d12c816-91b2-493d-a3ca-100f46a76c13", "value": "T147C65C11FACB54F6F9036831416BB27F23315D048B28DB9BEB583B6AF877691187A305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677667, "uuid": "3c105489-4fb4-4dc5-81b5-100320497c9b", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677667, "uuid": "6c3d5792-a83a-4134-a9e9-3d8f2061396e", "value": "49152:8RpK6fWxZHGQAulw19JRgfFC3b7HJFlwNwrH6PfLsdRyzVeAXH1SX8wRanDyBZO/:aKkWvw1rGtCfHur4EbRyvo4yrEpO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788677667, "uuid": "325f691a-58a1-4846-94a7-a7fab9300282", "value": 12570112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788677667, "uuid": "96ed22d9-a0c1-4c2c-a057-698c37e2081a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677667, "uuid": "a02cdace-05bc-450c-970c-b335655314ee", "value": "Everything.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc8783d1-a9c5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788680216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680216, "uuid": "5f91c0be-b184-4290-b0fe-8e0e7eaf0bff", "comment": "Malware payload", "value": "547482748f2036f59c49b4197503f042", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680216, "uuid": "b6bbd935-b2dd-4eef-be62-80d73b5f7add", "comment": "Malware payload", "value": "79cf7fa5c1b880fa1e25d7a25b57b0152d38301db19fc74b65b2fa97edcf2160", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680216, "uuid": "847b8768-f39f-479f-8f7a-2d97908b7857", "comment": "Malware payload", "value": "1c4703e84ed122b830672ceb2e8bd7d078d80ffb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680216, "uuid": "d235e8a1-57e5-4967-b5dd-21d50eb604cc", "comment": "Malware payload", "value": "dc429b57501c99ce8a11ef70b0a352d6da7b11f4602d23a94343502bcdf7b2c2967a3c52d607683b47fd520aa5e2a1d8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680216, "uuid": "e5a9a55b-341f-4fed-9c0f-ecb05edf988c", "value": "T16D235C651A857C14AA98C4371D7E2F0CBDAD43E6320492DE7FCB3CF28C5AA9D910972D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680216, "uuid": "cc96c1fd-c507-43eb-b146-71437298f2d0", "value": "768:bXRWNGxVe9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:1lxtcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788680216, "uuid": "1d7ee9eb-3dc9-4e68-bc9b-d358e5364940", "value": 50075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788680216, "uuid": "df896ff1-a98d-4dc2-9647-06843e55c718", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680216, "uuid": "70ea0e3d-2908-4d6a-9c28-975c2c48eac8", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bffb7930-a9c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788680221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680221, "uuid": "99d89a66-0d9a-4727-a3ec-d6dc256677b5", "comment": "Malware payload (Vidar)", "value": "034566579ce6c3c0c472530c39950716", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680221, "uuid": "ace0e79e-7193-43aa-ac0a-7bd083737491", "comment": "Malware payload (Vidar)", "value": "79e15a009cd5fc796b0ee1c2ac64a4701cc8726d4d66809999dfbd9de6e8884b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680221, "uuid": "4c2bf93f-c67f-4af0-a642-881750d623b3", "comment": "Malware payload (Vidar)", "value": "ffd0a7ad51ceb427f9e1dff1f76e7bdb1b9e088b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680221, "uuid": "168db575-c6db-41f6-87cc-dea99177945a", "comment": "Malware payload (Vidar)", "value": "2d5ca786128c62c4701ebc85b989d6d2635d201125ee9de23a71928853336d35c8dceb0971026219baabc2f2038512e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680221, "uuid": "392d6ef7-193d-4583-82e0-7d1de020a15d", "value": "T14B2833077C9590A8C4965A34C57A6262FA74FC98CB3233E72E48BA741F76BD13CB5B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680221, "uuid": "c9af61a9-5bb3-4b78-a8d1-c9fc5cec6535", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680221, "uuid": "5f9382d2-efd9-4fdc-b55b-03f6a81cb20c", "value": "1572864:im+Aw8Dq6C7YkRnnx+jfMSY3XHHmvy2mVcWR252FCuLi8d8oRt84Dyay2AFC5d8D:9SP5zIjRmVcWRi2FCB8e4+xm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788680221, "uuid": "0946e7a4-fb7c-4618-aa8a-774004b88d28", "value": 96776608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788680221, "uuid": "d2650c4b-6123-406e-9989-ee48f97b548d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680221, "uuid": "a9b2d806-0b13-4bc2-af8c-5ab1d5e3ac67", "value": "79e15a009cd5fc796b0ee1c2ac64a4701cc8726d4d66809999dfbd9de6e8884b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ca49941-aa2b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788723863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723863, "uuid": "18cc466f-761c-4dca-b609-4812adf0d1f0", "comment": "Malware payload", "value": "54f4c9e754136c302009a54e49c39c96", "object_relation": "md5", "Tag": [ { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723863, "uuid": "4391631f-cb3e-4145-8aa6-32db63eeb08e", "comment": "Malware payload", "value": "7a7b8eef418a8dee833097b2f077d783cecc51e1dd66778d52c54268d422f7d0", "object_relation": "sha256", "Tag": [ { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723863, "uuid": "35504802-dac3-447b-9a64-cc34e249d605", "comment": "Malware payload", "value": "9a20b9f04222787abaf95f6131b90ccbc3babd94", "object_relation": "sha1", "Tag": [ { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723863, "uuid": "206ba933-7ce0-4bcb-b851-af5344f97637", "comment": "Malware payload", "value": "736acf08dd11decd13136e945be4f73a96a67fcc4090116149c70e0cb1d8e9e53669839c79a049189bfe1cc6888bab7d", "object_relation": "sha3-384", "Tag": [ { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723863, "uuid": "c51a2656-d2c2-4fe1-93a8-23f781f01369", "value": "T1FF519467AE59CD3CF8631A1382BAEC2E7E6C05137C52C4C7E06D864436A877853DA40B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723863, "uuid": "29a59ee2-23c6-4e3b-939b-c48c0107711d", "value": "48:AyDXYHsggT7pbvxpEqi3jj8ddALhn27YkLpcdAjchnDFXzWdLBYndAlSA6S:AyDXYDg3NvxppiErv448OSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788723863, "uuid": "c07460ca-618b-4977-92d2-368120fab6fc", "value": 2595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788723863, "uuid": "633daf9e-9f0f-48a4-a47b-24864d5a8b8e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723863, "uuid": "70969f17-3112-4b95-9cb3-91716e1c262e", "value": "Document-52848.pdf\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000\u3000.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a338aa4-a9c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1788677903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677903, "uuid": "6a331ac9-a3ec-4c8a-a5cb-c5879ad8e668", "comment": "Malware payload (SalatStealer)", "value": "35495a294172f35e45868b4a78c9025b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677903, "uuid": "671f6786-f17a-4599-b80e-e56660ea42e5", "comment": "Malware payload (SalatStealer)", "value": "7a8352ee2386178be00dff5e9c1b600f93ca4338b17cb3082c13fc24ca46fc46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677903, "uuid": "14383502-82d1-4347-acce-cd5e90a34cc6", "comment": "Malware payload (SalatStealer)", "value": "d9a45cf71ace6f0a47623da44510de704884b0ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677903, "uuid": "43fc169d-db89-41d8-999e-6e432a54a14e", "comment": "Malware payload (SalatStealer)", "value": "1eacb4c7894dfb3692fd1a8feed9caa2de1d41dbe1263ed21fd384e7b9d57f29a9e003d300a2d43c2256c27e09c8a930", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677903, "uuid": "a7ec88f0-7ac0-43a8-add7-ea412da2c9cd", "value": "T158C65C11FACB54F1F903583140ABB27F23315D048B28CBDBEB547B6AF87B6A1196A705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677903, "uuid": "ac1039e9-2375-49cf-9aa0-1039ac5968a9", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677903, "uuid": "39e4aed4-1959-4216-8120-171f1b5f86fb", "value": "98304:5h+R39x63rXViKFZdzsEQzglfp4/G2IflEq:YxUBFjQzgBpROq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788677903, "uuid": "553e4b94-4dd1-4ec1-8c6a-e58efb5ba06b", "value": 12572160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788677903, "uuid": "240a3b4e-9d62-4507-8c3e-7cfd2103bade", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677903, "uuid": "dca4ada1-03f6-4b3e-bf15-98df792cbbfb", "value": "svhost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb45156-a9c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788680187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680187, "uuid": "5868bf4e-fc9a-4a0f-b36d-5055d530bf2e", "comment": "Malware payload (Vidar)", "value": "ec62ee8191a9132d7b5c3471f3af6e31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680187, "uuid": "8deb8b82-10e3-41b2-8cd0-288d66166cef", "comment": "Malware payload (Vidar)", "value": "7ba7f57195d202d87f28190340eaafd1222319ac60e64ba35c0803730ee0b706", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680187, "uuid": "790c47bb-3704-4102-9e27-8ea0ce3cfbb2", "comment": "Malware payload (Vidar)", "value": "fc024b38e7d80df88f8001f64eb6f5a5eafcd45a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680187, "uuid": "0590b03d-b368-41ca-9b1a-4fc84779a76d", "comment": "Malware payload (Vidar)", "value": "3349f930df81e1216423326fe772d160cd949a2716865e91cc82ca817331d7c34d421bcbce6544a635c43503f81f8259", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680187, "uuid": "a60d9f1b-96b9-4063-a048-fc0090ba54b8", "value": "T169467C0778D550F8C59A8735C57A4222BA35BC98CB3537E32E40EA742F67BD279B9B00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680187, "uuid": "10742e13-45a5-402d-9c1c-ae5d78063376", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680187, "uuid": "d2f7ee7e-c236-40d5-985d-fa264035d5e8", "value": "49152:7omQuRHpxe1U9swfmg/IiCjvVzcyNZuLS87p7gxFPL0YzMmt7rOi6CVjnBb1cUIF:7ru1Vw+viCjRcwX8d7gvPImtPB9fiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788680187, "uuid": "98bf5d7e-23bb-4b60-bbb0-ae01155208d7", "value": 5551520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788680187, "uuid": "821a2fa7-f957-45e0-a83a-90468ca76cfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680187, "uuid": "083b53cd-be20-42d3-bc87-d814d78043c6", "value": "7ba7f57195d202d87f28190340eaafd1222319ac60e64ba35c0803730ee0b706.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d97fde23-a9a9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788668238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788668238, "uuid": "bf00f3f4-1874-4271-8bca-21bfbe607b2b", "comment": "Malware payload", "value": "6804c35b71d3ee6c1e95f0b345483568", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788668238, "uuid": "b6248461-d4ff-4085-b416-edeab4c20739", "comment": "Malware payload", "value": "7c826bbde3430854e37dd34864a0326e8a55df146dd64126087b0a7207163e58", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788668238, "uuid": "6e825366-9e64-4297-8f88-d26d7d4387f8", "comment": "Malware payload", "value": "58c8ab83211eea0d02c4689c0e72108b4d05f97f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788668238, "uuid": "4b1c948c-75f0-4f7f-8b99-92e769c1da1d", "comment": "Malware payload", "value": "cb4ba7c3d081666ba98ec7a79d63c95ce31d86d132d00f2f6915f13316fa3b422db330d96b59add3acc2b06c20a41ab6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788668238, "uuid": "9658faf3-dc5e-403c-8a6e-bca5b94dffe9", "value": "T15E31609F14611A315503CA4E73A3758C668D91F73E9FD7D498980EAA93883CCF2A2F4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788668238, "uuid": "72a9d338-511d-4039-81f8-ff4cc540a1ba", "value": "24:cKNEKG0YF4m6QqsheRDl4GMGAU3qAXNPJv0KGAyR0q:cuEK5ozqEa3qAXNPJv0Kc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788668238, "uuid": "acf7c494-4d31-41ef-aebf-e8cebd52e1fe", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788668238, "uuid": "f7e64ee1-73fc-4b3a-baf0-23ec55e7136e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788668238, "uuid": "8ccb9538-cdd4-45b9-bea7-cdfb10e53cab", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dafc1d6f-a9e2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788692722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788692722, "uuid": "c6c85a06-b86f-4e43-bffb-54686cc551ba", "comment": "Malware payload", "value": "73c080daaf67b32a7aebf41ec228dcb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788692722, "uuid": "31ffe9b5-c242-4c21-9c11-9a49d93e9f79", "comment": "Malware payload", "value": "7cebcea111d709acaaf429b74fa1820d54ecaf0c8a220aafbc5f4394998b2a67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788692722, "uuid": "1b0db24f-134f-49e9-afe1-25f15e6e3bf6", "comment": "Malware payload", "value": "a1fa8a40ae47eb89182c8067dc4d8a9568c6c1cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788692722, "uuid": "69ef7d3b-2fab-4a86-a7eb-898f12dfbb4c", "comment": "Malware payload", "value": "dfc863898ab99885e76fef5ccbae1a0aed54d21a9ea9e34ffbd30204d4c1479dec2ea8b777e78307511ed19e71da03a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788692722, "uuid": "f4387388-024c-4ad1-bf9d-84467d0e9601", "value": "T1B795F14FA9F05473F2817B724167BA4A8A7DBD370649EE8BB30009E4974B3FD94998C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788692722, "uuid": "dcbc5067-e47d-4d36-8ffa-76830fa59e25", "value": "c557afab7ef1607ab852b85203270ddb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788692722, "uuid": "91b823ec-5793-4b79-ac26-706eca74c87e", "value": "49152:uEuBoJPrNXULo6VJ4cX/4KjzmiQbh4v2mZznK:RuCrN36z4cnQbM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788692722, "uuid": "cd7df5cb-0bdc-4e59-ae72-924b2a1a8ec2", "value": 2017280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788692722, "uuid": "397f0890-9887-42aa-bfdc-92e20143850c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788692722, "uuid": "a8c62182-4225-4b85-be36-07b35469ffb7", "value": "Discord Nitro Generator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0112bb16-a9be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788676895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788676895, "uuid": "a3c22e40-7799-4fa5-a342-51c9a0d0be26", "comment": "Malware payload (Mirai)", "value": "90b71971cb0369c250e153d3a0bbdca7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788676895, "uuid": "4eea8c5c-81f7-477d-b63c-7918dfadb7b2", "comment": "Malware payload (Mirai)", "value": "7cf78bede0adb90e9eda0eec609e3dba6277e7cf233d875a4ceb712de9f804b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788676895, "uuid": "4ba1dbf8-d4e8-464b-a9ce-231c7141b5d8", "comment": "Malware payload (Mirai)", "value": "36744dcc0018a5d1ff7e89ba3cc9e3cc1e5385c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788676895, "uuid": "63487e20-63ca-4cee-959b-4010a9e73d76", "comment": "Malware payload (Mirai)", "value": "deaced834569f5cdd011d05163a4460e5dda9fe936d62d17251d996c9649ea2620f3dc11fb4e873bf250c55330cde99a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788676895, "uuid": "ab61880a-4e36-416a-aed5-6a3fd6f3ecf0", "value": "T14FD56D26B9B314BDC96FC830875FD022E978B4D85262BD7B3285AF303E2AD505F1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788676895, "uuid": "6f845675-c725-4c9b-9501-9b7791b0ee52", "value": "49152:SH3oKT4FznXB1hJwi3jz2szlugiriA8O8OfIU6inVB08A9t3eZbjk/nl3NM:i3o3RTesNfOw+nVBf2fldM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788676895, "uuid": "f67a2a05-0213-49c8-bc12-d4df6dcbe2ae", "value": 2857512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788676895, "uuid": "f909c039-79c3-435b-bd24-ac935b72918a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788676895, "uuid": "9829a101-fcc6-4a56-911c-4a2bd0d0edeb", "value": "agustin51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1da1351b-aa1f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718604, "uuid": "fd8b82bf-b259-4b34-9021-68bae5c09e58", "comment": "Malware payload (Mirai)", "value": "b3e758924c5d5a4b152d9a1ab410e377", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718604, "uuid": "18cb1120-504a-4806-9613-62fb698da114", "comment": "Malware payload (Mirai)", "value": "7eac2d229bdc0b93a20cfd7830a355afc1f65e4a55a6645790e8b6350c7b805e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718604, "uuid": "9f4a39a7-fb9b-49ed-86b1-8d75ecec0097", "comment": "Malware payload (Mirai)", "value": "0876033f37c3c85e5bd837fb5254ef40c37b922d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718604, "uuid": "e3fdb836-81a2-4a90-bfb5-9ee5f06ac2de", "comment": "Malware payload (Mirai)", "value": "90ec5fb69aa1f3cda248edb3c55f75fcd4fb6d7ca94cca4bacef2450513d33b893dfbcc0b40c86b77e53eacbf303d511", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718604, "uuid": "cc2b1ab5-b54b-462c-87fa-420a63657c83", "value": "T1C4143C89AFA40EDBC06FCD30432F172715EE589A83F5737B41BCDD88369A24849D3958", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718604, "uuid": "9f60d5de-b36e-441b-bb03-a7408e32ae8b", "value": "3072:Alz8GHvhBSRFl5yTG83iL37Tl6ei9rQUI1DIJUsvjAbhA6:At8GLWAiL37Tl6bV1IC5AC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718604, "uuid": "0221360d-20db-4186-a96b-e21c964bc4ac", "value": 196152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718604, "uuid": "77b62d57-5a59-414f-93b5-57d276536a2e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718604, "uuid": "fd836545-ddff-455e-a330-cce6aac9f367", "value": "wj0s.mipsel-dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c06a96f-a9d6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788687409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788687409, "uuid": "fc8e1ecc-8a87-448d-a79a-0b82f489105f", "comment": "Malware payload", "value": "4ea2b9800078053cf36de3055e45a8fe", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788687409, "uuid": "75df0d04-6517-4161-a988-08515e4fb57a", "comment": "Malware payload", "value": "800c2105eb004da3e975859f19c1afd34f38f1fd555247236e1136a6def52058", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788687409, "uuid": "ca992465-e43a-4230-93a2-266731bbd9e0", "comment": "Malware payload", "value": "e3397f1acd9f57a1f7dced4d88525fd0cc55c3e9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788687409, "uuid": "859972ab-c772-4db3-be56-bb9456873afa", "comment": "Malware payload", "value": "1defbca00d145be68934a6b46bf248fc2d67e2fb1c2ab00f1b375cb0a44abea43b759d1417b91cef06af941bc10f168d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788687409, "uuid": "d5a0f3fa-0754-468c-9623-6c2465d0ac09", "value": "T15A235C651A857C149E99C4371D7E2F0CB9AD43E6320852DE7FCB3CF28C8AA9D920971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788687409, "uuid": "fa6054c9-3f32-465a-8f0a-7265b6af9792", "value": "768:3GVEJVIhtM99GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:3UEJ2Mecr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788687409, "uuid": "02dfe513-c183-4875-9338-2f03427ed25d", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788687409, "uuid": "58328d7e-b985-4fa6-87df-2707a9b25226", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788687409, "uuid": "9476dc6b-dffd-466f-b801-3127bbc1944d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "667abdb3-aa2e-11f1-bd95-42010a9c0009", "comment": "Malware payload (RedLineStealer)", "timestamp": 1788725168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725168, "uuid": "d8a6ca88-2f8b-41ad-86fe-f08754eba661", "comment": "Malware payload (RedLineStealer)", "value": "1130fe776458c3e4f3779a8f037eaa0b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725168, "uuid": "c6b5fbd7-b022-48e8-8363-46994777390b", "comment": "Malware payload (RedLineStealer)", "value": "8211468fff3cd6cf858f652b53db995782d573a092d00dac648b863d1b237efd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725168, "uuid": "2bda5f5a-1f45-44c9-bc95-0d7962680039", "comment": "Malware payload (RedLineStealer)", "value": "ff8b0cc9c8554eec5e5c65cc1990418ec812b8f2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725168, "uuid": "6231fbe5-0311-470d-bd5c-ccfea9dcb0f1", "comment": "Malware payload (RedLineStealer)", "value": "b79e94a06943ece638fc2e016c696ddd4bba4a907c944d2afd3989cbb03ea3831b73f6e89beb2a08eb338240de9b2b16", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725168, "uuid": "041da777-5fac-4f68-a5c9-177b28a3d65c", "value": "T11176335BF2C6206FFCF9473309F961930725EE710F24959F9A40ACAC29706266EB5372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725168, "uuid": "f064980c-348d-4034-8009-b37468e46006", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725168, "uuid": "07ae6db6-b725-4edf-91c0-78ed9ef5f4c3", "value": "196608:TuKsZTLojKaHaPSN1I0F0ekhDd7phctNO/Ecudbv:eBa6KjICLkhDdfIAEcuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788725168, "uuid": "5d3f41af-df4b-4958-bff9-a780ee129835", "value": 7394816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788725168, "uuid": "d8c1a86c-45d5-43f8-b09a-43cf8073160c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725168, "uuid": "0d64f55a-66c5-4239-ba47-b81432aaa905", "value": "8211468fff3cd6cf858f652b53db995782d573a092d00dac648b863d1b237efd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad30f6f-a9d8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Seduploader)", "timestamp": 1788688212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788688212, "uuid": "2b71d9b1-fad6-42c7-8247-8f6e2c946ecd", "comment": "Malware payload (Seduploader)", "value": "3de592c92a67c36b59969b8d3d8ebb72", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Seduploader", "colour": "#24071E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788688212, "uuid": "79ec68a9-1e35-4011-855c-08706b9928c4", "comment": "Malware payload (Seduploader)", "value": "822a816abe24a755d8b098e1bb95fa554818ec6b1a072faad64677e884c0539f", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Seduploader", "colour": "#24071E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788688212, "uuid": "006b355b-dc40-4332-af30-a3b875f8c93d", "comment": "Malware payload (Seduploader)", "value": "c3ce9a80b5321292d681869d3ff7f7cbda2fb21a", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Seduploader", "colour": "#24071E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788688212, "uuid": "a290086c-36ff-4ccb-a286-512a8d9200ff", "comment": "Malware payload (Seduploader)", "value": "1b53b0cdcfad0ad37f5cbb685c872e0c0cae26dc0ab72e8ac854c48c7e9e2d2fa28fa10f19732ab6c18df01a909e3aee", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Seduploader", "colour": "#24071E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788688212, "uuid": "eb3adcb6-8049-4984-b7f1-4d1ecda20417", "value": "T1CA0833ABBF92A9A9C0448EBA603F2365053C0C69E5143747D7307D99DAF06C4E2F5EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788688212, "uuid": "951161f7-c058-43f8-add1-c2fa5f0cd464", "value": "1572864:ybwCLYf3+WvS35BHoHTAHgLLvO/NwPX/t52lFpPowT6YNWdYwzLKTgweNA1QRYLq:KwCLe3+kHTAHgLbfF5kpwhdYQLKTgwYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788688212, "uuid": "bcc0475d-8cf2-4b40-bd56-b44f477fba50", "value": 83156594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788688212, "uuid": "4dd0104c-101a-4810-a0f5-73c903b18797", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788688212, "uuid": "da99e3a3-bee3-44f0-8e48-7960573fdc82", "value": "InnerVeil 0.9.4.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538dd68e-aa2b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788723848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723848, "uuid": "b789134f-17f5-4e7e-885c-4800cac4cf8d", "comment": "Malware payload", "value": "c8736d3ab5f76975f5cf424207bf9403", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723848, "uuid": "957e3ac5-bafa-4304-8139-b73d057ca123", "comment": "Malware payload", "value": "82db87b3c438dd8d3233c74632252bd577ad1faf6b77ade05f69beaf8602b298", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723848, "uuid": "9cf4a09a-bfd8-46bb-a530-730c8b28842b", "comment": "Malware payload", "value": "493620a61f19269ce32456db54051be16a130727", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723848, "uuid": "4007b08c-d6d7-473f-8916-70ab4068f3bc", "comment": "Malware payload", "value": "f18ff79d76aaa59aee7d48ad81e3401b7ada4a1ba08e70524292a5930bfbcc84c8b07275da853a50be2fadf82755cae0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723848, "uuid": "c66e8c0f-c952-4ad7-8bcb-b7a799cc815e", "value": "T180453B17F2A354ECC56BC0749656A773F930B86901347E6F1B98CB721F22E60972EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723848, "uuid": "3193ecab-5284-437d-91f0-f9df360e575b", "value": "9bc9be2eac143a21bbd0d21b05e557e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723848, "uuid": "f56f46eb-4365-4537-a0c7-a2ba92048854", "value": "12288:kQld3DP2RG6acBewAF0Q2oNRICbaxSIoL7rOOj5LoP6Qoa3c6jQvLdmXD3/tA:kS92R2sewAF0QJNRIeaIZPZC+LZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788723848, "uuid": "ef165141-faed-46ac-9e00-f21c47afcf00", "value": 1202688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788723848, "uuid": "0c4806e5-e984-4b4e-b00c-e5e25486857b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723848, "uuid": "b620bbd9-46a3-4766-b33d-4d26c4877341", "value": "005_hook_FIREFOX_xor.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a8a7ff7-aa2e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788725068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725068, "uuid": "68ac13b2-f964-4903-abea-9bafd1c3341f", "comment": "Malware payload", "value": "b1a1fc9d59c0a43b55732cc1b07c2bf9", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725068, "uuid": "ead45973-ccad-4a99-bd1c-8fe940c26c92", "comment": "Malware payload", "value": "83a3a48e8998fe74853161d31476c613d6eaf05f618446dd9d9b1016ada44822", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725068, "uuid": "eaa641ba-67e4-4141-a3ba-245ddb358f93", "comment": "Malware payload", "value": "6f86ecc5cb4008d7276d3cf69004a90caa4f7417", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725068, "uuid": "3629d8dd-a30c-493a-b178-771ec483603a", "comment": "Malware payload", "value": "f6ecc07e834db4cf8a2948b412c424844931c8874182fa652639ff27f9a6ca7a46c562b7b8ccb7ead267ced13103eec1", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725068, "uuid": "d98fbce4-4b6f-40da-b38d-048dcbc2e2d4", "value": "T195B59E1BA7A900ECD0A7C179CE474A17E7B174091370AAEF06D08A9A1F27BE15F7E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725068, "uuid": "2bc7bb85-5f12-40b5-8931-67f625e221f0", "value": "77fbfc5b6c1c876f8a1eba43f6966392", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725068, "uuid": "99a0377a-116c-4e21-9a8e-ec1a3b0766ba", "value": "49152:GS9n8GzolfC6unBixZyt8lv6O+FI5VE/h3QMN:VE5VW3/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788725068, "uuid": "bea0b40a-3b09-4b3e-9f25-a6a8df65f2d1", "value": 2421760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788725068, "uuid": "d017ea8a-56a7-435d-80cf-6ab929dea069", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725068, "uuid": "44a541fe-1f7a-4882-b048-a2e7be2a7417", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e497f2e-aa01-11f1-bd95-42010a9c0009", "comment": "Malware payload (NyxStealer)", "timestamp": 1788705801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705801, "uuid": "6b6ec84f-5a8e-4783-b2fe-0efb51ea6f9b", "comment": "Malware payload (NyxStealer)", "value": "1819f2999b4833a2654904aadd5e993e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705801, "uuid": "704798d5-652b-4795-9cbb-c324462df807", "comment": "Malware payload (NyxStealer)", "value": "84114420fc4a73b25f6d70d44893bf7a5d5ac7d7418dcca1e5574681cee85c36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705801, "uuid": "6900fb0d-3d5b-4ddd-ae07-73110f6acb29", "comment": "Malware payload (NyxStealer)", "value": "a3590ab80d12976a4dcfa9ad67582f6a63a6bf06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705801, "uuid": "55db9e81-75e8-4016-9888-39a5fe093f09", "comment": "Malware payload (NyxStealer)", "value": "f95e2e488a003c5888d18df3a88c217cd90ac28705603275abeb2cece64fecef58c184c78399ea4d2dc11565d6c5866c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyxStealer", "colour": "#89EE95", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705801, "uuid": "83965c8c-4f98-49ba-8048-4e6fe06b5d5f", "value": "T1E62833912FF00D7FF09EA875B18853E26C9F7CB228C54C869A5C54A6B0744D65AFA03F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705801, "uuid": "53a6a111-0a16-4aca-a4c8-fb38e2fdecda", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705801, "uuid": "95a96490-646a-4d60-8c85-58556578d232", "value": "1572864:t60gG3Bw1D+neDSSm3TfGkPrFvofPlkrguoBuCv5KOoPkM8Dy5BhyZgF9Th2jw:t60gN+neSSoGaIPC0uonv4wMJhrFNAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788705801, "uuid": "0c950317-bb9b-4f5a-af98-fa6adf23f0b5", "value": 98631320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788705801, "uuid": "6cd1366d-c317-4392-89ee-ebad05c51f5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705801, "uuid": "08235445-811f-463b-9c5e-05dfdb9f0266", "value": "Lightcord.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a51559-aa4b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788737534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788737534, "uuid": "e37e00dc-1fec-4c58-8244-c9a50e8dd81a", "comment": "Malware payload", "value": "e87ce4b1b9398c6290557d0852e7fbd2", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788737534, "uuid": "41f58413-fab0-4050-a463-ec8015a1fbe7", "comment": "Malware payload", "value": "846f390faea2a33d5ca0c1876292853c55439bd1c26c8206a62afcd4c7333593", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788737534, "uuid": "dd56b5ba-ed67-4be8-86fe-75c2e7299c05", "comment": "Malware payload", "value": "4eee87669038ff0c974af1a447931b8eb22f2a85", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788737534, "uuid": "a3e4dafe-af9a-4182-9ede-328a4221c11f", "comment": "Malware payload", "value": "aa39c34605bb8364d77b0c11148d83fea7ee2843e544ab2e2c25850c18c7bbcc5b5251f42b6cbca474b34929ecac33b3", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788737534, "uuid": "6622726e-c225-4a93-aab4-dd06092ab0a0", "value": "T1A6F523A4E4C728B4D85BF7B6869B737DF16E3BA20560DC473ACC6F000E72215653AB91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788737534, "uuid": "39b48342-26fe-4d4a-a416-73ff20f33adf", "value": "5f5fa424e9b15e23e31be560376f47b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788737534, "uuid": "fa615683-45bc-420c-9f66-2738abf5280b", "value": "98304:QNnZtvLXVvr3vZ8OJvNNK9Unrcq1kLpvgXPCDH:QDtvLRjvZlJvN0KCVmPCDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788737534, "uuid": "104200ad-4185-4da8-9710-7642b41fa643", "value": 3369864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788737534, "uuid": "06e70ce2-3575-498b-b8a7-8177242a4139", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788737534, "uuid": "41cfae0b-c2a6-4930-a8ed-954371b57d16", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4ac1002-aa20-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1788719260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719260, "uuid": "c5646122-b658-4880-a775-baeb9d6c1eb1", "comment": "Malware payload (Gafgyt)", "value": "8183b2828769fcc2ca0355b6007e16c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719260, "uuid": "1aa9d6a6-20d4-4a79-bd6f-bc686b195033", "comment": "Malware payload (Gafgyt)", "value": "85ccf7c48406d26fe242fdfb768fb6439890db5b283463923f59a5b7e2f206e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719260, "uuid": "38c6fe4a-3e76-4610-800a-a00fa47588c5", "comment": "Malware payload (Gafgyt)", "value": "804b86bd09e1d57e0d96cf29818e28870c87ef85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719260, "uuid": "f4c19815-fa37-4340-8a45-6dfc9e888642", "comment": "Malware payload (Gafgyt)", "value": "b4243f3ee00bfb6b407dbfe269f82bcb55d360e738c2f04c8f154ab73effa2a12da4d1de10e6b1434e76545503a5b592", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719260, "uuid": "3e2eb829-01f1-494c-9098-00fde2e034dd", "value": "T1E55302F7A4D87DCCC1569334020B06433ED67678609AA63BB6C5F66886F1340DBD8BE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719260, "uuid": "ab7997cf-678a-4a23-a3f7-9545a481732f", "value": "1536:C1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8ASRbI0izdLkg4azHB:CM5az1Fy0oPgdZX6hTo8Rl4pLGazHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788719260, "uuid": "308305a5-6206-47fa-a5c0-bbde5a10aae5", "value": 60808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788719260, "uuid": "71dc616e-8b81-4761-b882-3676b51287a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719260, "uuid": "489f1f46-a3c3-4e1f-999a-ea1b8f5f3839", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2535d442-aa19-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788716040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716040, "uuid": "4b2ccf87-8a4b-4a57-ba7f-b2e15a035c69", "comment": "Malware payload (Mirai)", "value": "4417d472a470e07edd42ae8d7f225a1a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716040, "uuid": "5e5fd7aa-37b2-4e39-91c6-64eb0b2e651a", "comment": "Malware payload (Mirai)", "value": "8617964867e6dd57129437c41798d9b21fc74095c2aa13b980858e5066aed98e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716040, "uuid": "8aa26010-62d6-4944-b3ed-15ead8eaba07", "comment": "Malware payload (Mirai)", "value": "451734a11b987715d6d618ed65568ba3d2349109", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716040, "uuid": "40f0b4fe-a369-4da6-a40e-c4a67f7eb997", "comment": "Malware payload (Mirai)", "value": "450fb9cb06deeb771398ba355e580fb5c7b849ff693c90398c282daa28997c0d938104f91318df5c8fe0a403da8f6eff", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716040, "uuid": "c5f2c165-ac17-4dc3-bb48-aa14c438a730", "value": "T1BC934A02B3080E47D1A71DB0353F2BD197BEE6D121E4F689750FAB9692B6D331486EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716040, "uuid": "2814fc31-fd88-48b7-9487-377a02dd424e", "value": "1536:XefrO+xXyy3U+M8JekB739ftJLUynJqABF0gtCebSNRcYJfqqS2JINlK:XGptyz+VJzB739fbLUUVSebSBJOlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788716040, "uuid": "892f8eb4-747e-4b52-a9b3-374cbad29db9", "value": 95864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788716040, "uuid": "4b3642a3-ea5a-482e-9402-082a38a27050", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716040, "uuid": "cb341bbb-b9ba-4ce7-9b0c-3883a1fede64", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f57ee23a-a9d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1788686324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788686324, "uuid": "9e9e12df-e879-4923-b2f7-58f297777205", "comment": "Malware payload (RemusStealer)", "value": "7e905f2eb239bc2c23c8b3a4beeec7fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788686324, "uuid": "0bdb2950-9e4c-4cfb-bade-974ba08f6e3f", "comment": "Malware payload (RemusStealer)", "value": "88b256990db71b0d8988f0f7acb666aba93ea8d77b68dfdbe90d479597568cd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788686324, "uuid": "800561ad-a2c3-4e1c-8227-dead7e6ac0bc", "comment": "Malware payload (RemusStealer)", "value": "7038c9e1ce2c29e521093fc8c5901338c4c62cc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788686324, "uuid": "53a5e79f-828c-4c3b-be23-d60b21219779", "comment": "Malware payload (RemusStealer)", "value": "728629a76d90cc1bc5c605915e0b267552b3456b5f785660f2baf53aecbccb9a8ab4f4c89297e21b4e46d1bca539fc63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788686324, "uuid": "c83b21b2-7464-45a6-b507-d185ad7b80bc", "value": "T1F8D57C47BD85B075D4999A31E42291A1B730BC68873973E32F86EBB40E713C01E7AF65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788686324, "uuid": "2a458cf5-0d77-47bd-8785-93916481a2cd", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788686324, "uuid": "2d7285d6-fc35-41e4-8e85-eaac13cbf96b", "value": "49152:q+DTE/5O80MNkkZzU8vpuLzgBnFO4JD1oJd:3a2SnZzU8MLIFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788686324, "uuid": "24800949-045f-4c58-8c2e-95167d95196f", "value": 2824608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788686324, "uuid": "6d9a495b-cece-4be2-ac52-9b891ed652e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788686324, "uuid": "3abf74fe-2053-4378-815a-91c7ab38e62e", "value": "Download_Roblox_For_Windows_7_32_Bit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b31a9a-aa19-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788716039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716039, "uuid": "cb25f7bb-9ade-4867-8996-5863360559ab", "comment": "Malware payload (Mirai)", "value": "9371a3d71de8439205504ea805bd1858", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716039, "uuid": "fe209afc-fa4c-403e-b4a8-cf823c5460c4", "comment": "Malware payload (Mirai)", "value": "89ecdf265c88a64847eba1401becb78012065b2d6840642d08ccc8dc80c7f736", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716039, "uuid": "86e10bc1-8384-48ad-bb11-f690fc55a70e", "comment": "Malware payload (Mirai)", "value": "0234330dd28f6ab27a0b11ed179adc637872e97b", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716039, "uuid": "61e69aee-f443-42ad-9e5c-df3659306138", "comment": "Malware payload (Mirai)", "value": "5bf5376ff7ddffe57e609eb6829e2c1a4561a8cce9e7ca59051788de00b74ae45cccc4e94933988b321089c5de576e93", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716039, "uuid": "87b3b1d7-9b7c-4df4-9d74-7b9d5d400e26", "value": "T1DA83AD32EA292D44C14555B0B0B98F395B73A5C082476FB666F9C6385047DECF90AFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716039, "uuid": "4829660d-5ac7-4076-95b5-8dc7dced2d1c", "value": "1536:EenMpsd6H316K/1toNJMCZdbzK+45t3qvwe+aZ+WC7no:EeAsdukutoNJHb2+sqvPf8Wio", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788716039, "uuid": "1832ca47-11b4-449e-a880-c950638678d8", "value": 83532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788716039, "uuid": "3882c095-7b18-4bae-beb1-94d826699f16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716039, "uuid": "f6129e4b-8d7d-42bf-8636-535a2375db07", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb6b77fc-a9e4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788693555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693555, "uuid": "d0078a2b-bbf8-47b7-b3a6-9a0ddd0c8377", "comment": "Malware payload (Vidar)", "value": "ff3ee370db74de9de7f0b07d803dac1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693555, "uuid": "bafb6a18-c385-410d-a7d6-2ddd4b219551", "comment": "Malware payload (Vidar)", "value": "8b24fe79beab186b645cb57d74ebde048b467e203a454ddc5819664743e5d89f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693555, "uuid": "d88c5859-9035-4c8f-9178-8e50a76c79bd", "comment": "Malware payload (Vidar)", "value": "5446ce26cf2df0e22b9130ec69db708e4b68003b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693555, "uuid": "87b5d591-9ce8-4873-9fb7-63fc01a9fa55", "comment": "Malware payload (Vidar)", "value": "af3f616bc486a9b83116e45e04883602ed2f05785c72042e0a0524f25574a6ccdbbd2b4f0500e266ea70b76271ab729c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693555, "uuid": "92551e1e-2bee-4182-ae20-e66cf6dad2d7", "value": "T11028330769A990F8C19A4A35CABA5361BA75BC98CB3577F32E44B6301F727C27CB5700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693555, "uuid": "6d53d5b1-385a-48d8-8ecb-c9f685dfff56", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693555, "uuid": "3e361dce-6abd-4c09-a9c0-0437daf4d410", "value": "1572864:NJ/DD7T531BAq8b+Z8GXBh2RGTIAKW2i+44CUlESBKD0C5Er:nD7T5EN+pXBcRpiHwK0Hr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788693555, "uuid": "88df2ed4-3812-4e66-a0f2-50b2ffa2534b", "value": 96796584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788693555, "uuid": "d79e92ae-037d-495f-8cb3-f434390df063", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693555, "uuid": "585a75fc-fddb-4206-bf1d-01d42af48336", "value": "8b24fe79beab186b645cb57d74ebde048b467e203a454ddc5819664743e5d89f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e91b5bca-aa19-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788716368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716368, "uuid": "8e8d25ed-4d92-481f-abf2-f49aef5d84e4", "comment": "Malware payload (Mirai)", "value": "95deb2c9eed93956f0cc5e9452eddf2b", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716368, "uuid": "d791f679-4972-47ec-809f-ffbceccafcfe", "comment": "Malware payload (Mirai)", "value": "8b7b1c7003fed38c1a82537e6916b1bace5bcca70ebdab5bba107d15fed0697b", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716368, "uuid": "10683023-e2f2-4aca-b5e7-0a41f3e3bacf", "comment": "Malware payload (Mirai)", "value": "96d6044b80c18222ca439fcbb5bc9ccec21d7fa7", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716368, "uuid": "bb068309-14c0-4d1e-99d7-6c39757020e4", "comment": "Malware payload (Mirai)", "value": "218ed42aa88b57cd9783b84b7272851fdeb7cdf4e9e82ca834da66f1044301c495ca443139c6327c1b0e765a078f5edf", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716368, "uuid": "3dc93044-623b-46d1-90a0-a182479d69a6", "value": "T18FD31946AD419A12D4D732FAFAAE419933136FBCE3FA7102DD205F5023C599B0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716368, "uuid": "bc557878-db56-4e64-982b-758a108c0755", "value": "3072:Nz9j6bykqVapTHWDvHz8SElAoOvaMKjDjUDy33f84hAbsH+3R2:v6bU4pTHWDvT8SYDOva7jDjUO33hAweE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788716368, "uuid": "94b1fd5f-019a-468a-bb0c-a621a9145970", "value": 133108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788716368, "uuid": "76ce7b68-cff7-4757-b14b-fd151d44f246", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716368, "uuid": "53627b4b-f647-4ebe-b024-0a7cc7e61d68", "value": "qtm.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a41ec55d-a9c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1788681463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788681463, "uuid": "9476ed25-4925-4d19-ba9d-59e6895c3532", "comment": "Malware payload (Gafgyt)", "value": "f83429c699cb5e22851a964a22bbd696", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788681463, "uuid": "802fc79b-b75c-44b1-be27-2ffc8fe5c67e", "comment": "Malware payload (Gafgyt)", "value": "8c0836ba86270b6c2aea0f21abbc0241b887cf1547bbcb668d9f00c9f4bc0faa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788681463, "uuid": "382ffa3c-17a4-4088-bc8d-2c48f086c3d6", "comment": "Malware payload (Gafgyt)", "value": "73ce63eb920c7bc1ae5c45a1798c0d9b68b20ccd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788681463, "uuid": "22bbf17d-0f9c-4dc9-b0b6-31d799f4a58e", "comment": "Malware payload (Gafgyt)", "value": "c38e2bcfd8a5d98aecfc8cfe2b2143a6d7edee5b6ac7dbf18bdbfe2d8b0909318b3e31b7cefa2b20bfeca6f787c2bfee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788681463, "uuid": "6f68439f-4346-4ff1-a55e-e0fa532b769b", "value": "T14DD32A01EA508767C2D2277AF79E429E33336F64939B33255A346BB42F8278D1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788681463, "uuid": "eeb6456f-6416-424d-8f7f-000f6673250b", "value": "3072:Ou/7mamgzyazQ2HmKuaBCEqmbDdEbaqqQYRCzmsQTi7aHgp:3zpHxuaBDxEWqqhCzmsQTi+Hgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788681463, "uuid": "a90cccc7-00a1-4f90-977a-e54c2d2f46e5", "value": 130265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788681463, "uuid": "354ca8e7-652c-4eb1-abb0-96c4224b6268", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788681463, "uuid": "07594c9d-78a7-4148-b334-f10d6f4c8439", "value": "kworker", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e88c05-a9bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788675985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675985, "uuid": "ff5097c3-07c6-4bdd-8485-4d52178e09cb", "comment": "Malware payload (Vidar)", "value": "e672d0e7b4af5a4a070e300f2659c48b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675985, "uuid": "0d56fea6-9957-4bd7-bd54-b66e2aac37c9", "comment": "Malware payload (Vidar)", "value": "8c56ab44eb8c6f70a4b286c446b2dc1fd97a68c5b65e6bdfc2c3d1ec9c522e43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675985, "uuid": "7279f485-8d19-4ea9-9928-95881f70ff4c", "comment": "Malware payload (Vidar)", "value": "de5f2ef1ebc8426d72ab86cb64cc3c16fd60d790", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675985, "uuid": "f159fcdb-c2ac-46b1-964f-b1eb61367fb4", "comment": "Malware payload (Vidar)", "value": "ff4c1dbf13671f1d4cd24b357e98a0a10d1af0dbc07ce90a7fccc5132682a521e2bb9b0288c9e10992bd75770af48a17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675985, "uuid": "b41998ad-21e2-4cc1-aba8-e8781932d83c", "value": "T152183343BC5584E9D56EC63AC56A8262FBB5BC040F3173E37E10BA682E37BE05539718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675985, "uuid": "f238c1f0-8df0-4890-b61c-cb54937576b7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675985, "uuid": "044e2fff-992d-44a3-95e7-66904804e566", "value": "1572864:4UdZdAPIactUr1HAPytnB56bm4fVMefHsgFj4+9Jf2lIGoK/:hEwalFv5z4NjfH1FjZJWIGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788675985, "uuid": "3c492d92-a09d-4b09-b05e-6110e7645701", "value": 91656560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788675985, "uuid": "2841cce8-b9bf-42f3-b79e-3e9e8643e95f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675985, "uuid": "19c56fcb-3238-45e6-a186-bc362f20ed60", "value": "8c56ab44eb8c6f70a4b286c446b2dc1fd97a68c5b65e6bdfc2c3d1ec9c522e43.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "624d82af-a99d-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1788662884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788662884, "uuid": "f07f51a3-cb86-4a13-87e0-441d2429806a", "comment": "Malware payload (CoinMiner)", "value": "15b76068e4b451b21d40529d0c99c9ca", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788662884, "uuid": "e4ae548b-4a65-4801-89eb-5c1821c2452c", "comment": "Malware payload (CoinMiner)", "value": "8cd47f460e7662bd783f60167be6eba941e29377abf3d21213ab0b0f19fe1ce4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788662884, "uuid": "eff45cc0-f447-4980-a073-9fd71c08deee", "comment": "Malware payload (CoinMiner)", "value": "a3dfaa61c695d75e1ef22fe108515ff93505945d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788662884, "uuid": "d53b369d-761b-4f07-a7a1-f2c49454f7bb", "comment": "Malware payload (CoinMiner)", "value": "000b437f31539917f4086311b23bc108cf9d6309d08237edc3ae9a39b50dd15dbc8bcb35846b632d59bfbb78859556ee", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788662884, "uuid": "79a0c54e-e0e5-43a4-bcb9-deb290ecea1b", "value": "T169363396B6C6B074D097C3B890A3A06FF37EBB614561BC067BCD5D190E2AF0969393C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788662884, "uuid": "97011f0c-b251-4e7d-86d8-b8adb2344d0c", "value": "949ec789a5933fb6051c9013a550fb57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788662884, "uuid": "b1156253-763f-4bbe-8375-c08ce5b92e4b", "value": "98304:DHUSOCzPscKsGDYPe+3A2Zx6vPT1Rv638Kf6FmFDTEcTyhcT:oSpJzGDYPeKPx6vPT1p638U6IFAcMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788662884, "uuid": "85fe3b37-ec23-4196-8fb0-1d33d48710f5", "value": 5269504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788662884, "uuid": "fadb90a3-9aee-4c07-b666-24b21485f1ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788662884, "uuid": "169d6fae-c701-465a-a374-d64a92a19969", "value": "8cd47f460e7662bd783f60167be6eba941e29377abf3d21213ab0b0f19fe1ce4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b6ee46-aa19-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788716039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716039, "uuid": "9d51cc05-2d66-4321-a864-ed93adaa3932", "comment": "Malware payload (Mirai)", "value": "75d33a1d318eb0fb2113802f88b5ca5e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716039, "uuid": "a4e04208-ccdc-4eff-927c-dd35647cb8f6", "comment": "Malware payload (Mirai)", "value": "8e9f1ad3299b82e1350700b5bb104721a93e55178e58e4302a7c610ea2175ad7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716039, "uuid": "7a73a3e5-db14-4a0e-a91c-a84d164c6cd3", "comment": "Malware payload (Mirai)", "value": "86e9984612931ac3020eb9c27c5cd58252c45c4d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716039, "uuid": "63aaf3e8-81fc-4ce6-b823-58c1e50c7701", "comment": "Malware payload (Mirai)", "value": "2d2502fab65e6fd9b835a665161258228075b4ca142ccf26affa04ac467623c4375289fce5be5a03ac6d87d46014c344", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716039, "uuid": "f28a7828-caaf-44b6-b793-17d866fec56e", "value": "T1ECC3D60ABF210FFBD85FCD3B06A91B0225CC555722E9BB367574C928F64A21B09D3DA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716039, "uuid": "e32a1811-84e1-44fb-85e3-fd7bbb9301ba", "value": "1536:QhwCvdHmez3BK9LW05Biw6PmPQ4+efKmWhS4cUz9KrZ9nTDCV5bOvd7JMtN:MwCvdHmezn0nUPMu9KryXsMtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788716039, "uuid": "346f4fd3-33ce-48ed-abb7-a25099ac07bf", "value": 123348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788716039, "uuid": "1d7bbbe9-7d43-46fe-941a-901ad005b2df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716039, "uuid": "f85015bf-7c92-4bed-aa3d-3a6a0ab75963", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65145a8-a9d3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788686299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788686299, "uuid": "c23d97af-be58-4de1-bdd3-05a93efc5387", "comment": "Malware payload", "value": "9a8d971e89eaf2a0937c83d7e6470c3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788686299, "uuid": "c84b0cab-a7ae-4ab0-bdfd-602b09a9969b", "comment": "Malware payload", "value": "8f952860dafa2eae631e71944236819966d7fea303366a8408a4e17bbb15894a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788686299, "uuid": "d5317ee2-ffef-4347-a792-db4e7470b2df", "comment": "Malware payload", "value": "282c0bd15c3d5b1831ca660b1a676eed2163281f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788686299, "uuid": "e7d6bf8c-745d-4e4d-9dff-07c71ec40a52", "comment": "Malware payload", "value": "946b7767cad18f12501ef15164eb1b4a0f98501efc431553c5c59f99b23715e7587cf36f2d3695bd8bdb1382f74a9423", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788686299, "uuid": "db24d8e3-0a95-46ae-ae9d-2713bada7492", "value": "T161D5239A78F21EB4C836C335DF46E46C702E77928A718E1BBACC29509E536504E7B374", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788686299, "uuid": "c4b2ed2b-f19c-4c41-9c02-3cd9eb57077f", "value": "58f4b17816a07f7a36dd14e504d515e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788686299, "uuid": "6bb6cde2-bcc3-488a-bfb1-c4968d88c5c2", "value": "49152:vMCNNjIa1pAZwSdNZ4NJryNxe+obIr1w7ZbFcXb6Ct:vBN5IQAwSruuI2+1bFbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788686299, "uuid": "cbdf7eaf-913d-4841-b8b0-f55c21d9453c", "value": 2927616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788686299, "uuid": "de45cb80-4b18-4ef3-bb64-cfdf3c3bdeeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788686299, "uuid": "ed773f51-a48a-4895-b9ec-2b5addc0cd66", "value": "8f952860dafa2eae631e71944236819966d7fea303366a8408a4e17bbb15894a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f141231-aa20-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788719250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719250, "uuid": "653af87a-deb1-4dcc-aca9-89d08af3564b", "comment": "Malware payload", "value": "ea967c2f0238a326f3d3f786448cca6c", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719250, "uuid": "63512de7-b1e8-48f7-83a4-7fb315009f86", "comment": "Malware payload", "value": "91a67896f3d58d3b3ec5d12a0f45a4678b6983b5033cc0905ad71776f5fd463b", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719250, "uuid": "97bad9c5-9c41-4bc6-ab0d-1e6697bc1964", "comment": "Malware payload", "value": "35492b09032244440381294d63e34d51475e1bac", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719250, "uuid": "daffdbbc-4fc9-4c94-8aaf-45b83100fcc7", "comment": "Malware payload", "value": "66c4b8c8aa64be8d32352c153ff86b03b7686beb045f0af5efd53937085f122d7d5f9bc94dca1bf93080979693985350", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719250, "uuid": "51f4e1b8-ee3c-4a25-a898-80c86e82e608", "value": "T134265C03749894E9C0199638C57B52A3AA64BC8C573633E31E90BB383F6EBD07DB5716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719250, "uuid": "09416017-0aad-4ae4-8a60-8230449781a1", "value": "4e2bd2c481372f7ab13b83b63b424e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719250, "uuid": "04e787fe-428a-45df-9709-911705811708", "value": "49152:uSWYEcmiKM/B5dsq20J7PeVfjLVzDJIHBvtsvBp6mSM8ZZo:uS95m5vcSTkmmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788719250, "uuid": "d6a26de3-d698-42a1-9133-ffa1af23e636", "value": 4605888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788719250, "uuid": "0cad7af8-fb28-4fac-adf4-7836e8d247b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719250, "uuid": "4076d0cc-8419-4334-9740-91bf7b05ec42", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614025ca-aa4b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788737615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788737615, "uuid": "699f8119-a764-4d11-bbea-310787045f98", "comment": "Malware payload", "value": "2375a2379f2d8305069831aadc72eeba", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788737615, "uuid": "3027d0dd-fea0-4c19-af18-b138e5e70e1f", "comment": "Malware payload", "value": "926054d5f2882959f4747a04ed67d899c9983a8788660fbfe9a887164b411fdc", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788737615, "uuid": "6b560d9a-650c-47d9-a801-6626fd32fc24", "comment": "Malware payload", "value": "82d87ee37e674a8152647d899f20fd9a6d123ce6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788737615, "uuid": "55bb0e2f-f4c9-4f8c-9d53-28e6071105df", "comment": "Malware payload", "value": "27c80716d78b053edb093e38c8dfe476950122951e7521eaac9855a690966530b2c39588ca5d434359473c5a5015527d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788737615, "uuid": "5a6f5dd1-cfdc-4ec1-85b3-5892da0a35d1", "value": "T17C963381BAE1447DE1BC6F78C6F38101CC34BC988BB1960F3599F99E89B23D25678716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788737615, "uuid": "560c2757-a64f-4cf8-a92a-308c99db1d09", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788737615, "uuid": "efde23bc-a131-4859-86f3-521d80335482", "value": "196608:UGpyS4/cNzwbTBS0DZxdS+rcBI5/qApRuh97so6bT6:UG8TUVwBXDxS+g2qAp476bG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788737615, "uuid": "736d99a2-1736-4c0e-a5b8-ef41e4eef199", "value": 9207808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788737615, "uuid": "a31390fb-37f8-40b9-9f28-d602928bfe8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788737615, "uuid": "74cd2175-2bd1-45c9-af24-fe30266057f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8b85b0a-aa2e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788725333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725333, "uuid": "3194cda9-0e5d-4c15-b8b4-9cd6a204e8ce", "comment": "Malware payload", "value": "447313e14f08e285c0f3e407b62a4972", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725333, "uuid": "8123160a-fd93-4d1d-a773-d1de8f9892e8", "comment": "Malware payload", "value": "9536bb0a76bf37fdc27861c3f6948a10f5a2c9a7ff1d26c3eb51b5770045d670", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725333, "uuid": "a871d0a3-cd75-45ec-86be-679645abc28d", "comment": "Malware payload", "value": "45b2a56b1fccde7c5c7e3e5314decf3bb8c9b640", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725333, "uuid": "affd6b9c-b0e1-4e2f-a53d-d55b8630554a", "comment": "Malware payload", "value": "6ff2244e39cf8e50f48e1bad14b009346b2c977c44f026d1613b9ce779b9bf718bdcf19500079c87f58004d3752648a3", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725333, "uuid": "25b027a6-32df-452f-b852-57bb20420c15", "value": "T16BB58E1BB7A900ECD0A7C179CE064617E7B174091370AAEF16D08AA61F27FE15E7E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725333, "uuid": "915f9e84-28fb-46ae-bf6c-56a8961d31a7", "value": "06ac4d4c38fdb478d2cae1f0eea00634", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725333, "uuid": "ee24d759-5c26-4807-aef3-a595c693410b", "value": "49152:PHsa8sSkULl/VZveXzuq/VbN5A6K3fALG4qC3:PgcGAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788725333, "uuid": "71b7683a-cc71-4933-95bb-fb5842160313", "value": 2404352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788725333, "uuid": "c86baea3-a691-4ea1-9f01-0a491b0a8274", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725333, "uuid": "3492eb29-6bfe-42f0-9b56-a9bca0f23ce1", "value": "WinSystemHost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6351724d-aa36-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1788728599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788728599, "uuid": "0b18c451-e8b3-4d42-b08f-7cbdb0c4af42", "comment": "Malware payload (CoinMiner)", "value": "7148799ea07b90d6e2a187d3f1bc0538", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788728599, "uuid": "53de82b4-79bd-4eb3-a114-7dd7c6092b42", "comment": "Malware payload (CoinMiner)", "value": "9831a1b023f28b6cfd4c7c83099270aa48e43bf7bd8842e8858993abce86dc24", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788728599, "uuid": "62095393-851d-48be-9a00-99a05134cf65", "comment": "Malware payload (CoinMiner)", "value": "382969cbcbdf57754c256daf99acdcfa676d7280", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788728599, "uuid": "00084a5c-fd28-4814-9336-a1526ae9467b", "comment": "Malware payload (CoinMiner)", "value": "4683ed54bccbf32c62620588802a37a872ebed6aae4a22c54fd35b4eb89dccc3faf891873745c6ed19d420cb9cff26a2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788728599, "uuid": "032df526-fb24-42a4-96e2-4dd9b2965d41", "value": "T1E73633C57ECEA478C417C3B85653607E726DBB818934BDA336C9BE008D67D19687B388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788728599, "uuid": "b813905d-8964-455d-bbf6-35bf227d061a", "value": "949ec789a5933fb6051c9013a550fb57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788728599, "uuid": "3e2d843a-0824-4fbc-86a6-b48bb3c5f2fa", "value": "98304:1H0YLgGVOWd85SyjBLtCcPp8xe1NbmdFHxxJPqOe6Q41gZ99iexTx:1Hd0GIBFjBpHp8gGF9PW6QggZHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788728599, "uuid": "dc67278a-6785-4501-80a3-bbb14643aad3", "value": 5323264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788728599, "uuid": "748e9cf6-2b71-4331-b17e-26a911e84adc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788728599, "uuid": "3e5bb158-03a6-4cd6-8177-883980a4fec5", "value": "9831a1b023f28b6cfd4c7c83099270aa48e43bf7bd8842e8858993abce86dc24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8453a927-a9f3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788699878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788699878, "uuid": "654d647d-d213-4b9b-9284-7e9b8624b248", "comment": "Malware payload", "value": "b86ed8ce35fa83860d98c31fb198a810", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788699878, "uuid": "9908c9b1-0b74-485b-a349-a4af5da3275d", "comment": "Malware payload", "value": "985fba74ffe59b29a4f19e12997c2f8b435a4f15d575f97e6f6e453d9789e11c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788699878, "uuid": "24c6abf5-0f6d-4990-8058-e10960cbc8a2", "comment": "Malware payload", "value": "5f6111a112accbc25c30c4f2f07890babb349a4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788699878, "uuid": "078e823a-1b76-459e-96cf-f15cf6f61ea3", "comment": "Malware payload", "value": "38daecc773fb51a1ab8b0d152b783121b5ed19751e5715516a471d105de6c7fd56b43a83570d19742ede180c23683b06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788699878, "uuid": "7528b259-ac4d-44bd-9df7-83b1260788c5", "value": "T1F3283310B606C656C0CBDFB9652E0FE25F2649F08679B4EF169244B1FEE0963D9980CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788699878, "uuid": "11c97be5-fea9-43ff-97cc-bf457df8e273", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788699878, "uuid": "61224b7d-7f90-4147-a8ba-29d33ac8ef71", "value": "1572864:MLdk85BkGvLUrfYe6+sbFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB7cK:M2Wk0LUL3qaABZVPArg/bXeB7cK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788699878, "uuid": "abd296f3-6645-43a1-9067-2862f9a34622", "value": 95115152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788699878, "uuid": "42277cb5-1838-4eb6-a384-82dee3108a20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788699878, "uuid": "64517e09-bc6f-4e2d-ab52-3f280a99bd9d", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b959754a-a9e4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788693525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693525, "uuid": "7a6941c2-7259-414e-bfe7-8a7888244385", "comment": "Malware payload (Vidar)", "value": "416a142faeb8b954410e518cd4db3a7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693525, "uuid": "4720ac5f-4b4a-4d39-9d08-2abf9c44d0bd", "comment": "Malware payload (Vidar)", "value": "988a67f7385f08bfbe51e025f2aae8d709b658d514fc257d9a2317281aec1877", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693525, "uuid": "597af77b-b229-45b2-bb20-59113597aa0c", "comment": "Malware payload (Vidar)", "value": "8ce7abfdf12ce85b24407f45bdba5e1031518312", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693525, "uuid": "8646e4ca-1c9d-460f-ba98-66cb162f0459", "comment": "Malware payload (Vidar)", "value": "1fc6bbf24c407cee39a449fc089a394521e262f235b9ecc8c5c7bccc2e8296c2d38348090a3f8ec78ffab5c4bf079591", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693525, "uuid": "f57a77d1-9efe-44d2-84a8-1d3d015f8200", "value": "T11628330769E550B8C19A4A75CABA4266FA35BC98DB3577F32E40F6701FA2BC13CB5700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693525, "uuid": "6cbf5779-4d38-4d40-bdfa-cdf49116d88b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693525, "uuid": "4e9886c9-4020-4fa9-9ab3-1805e5a4c9db", "value": "1572864:NgKfAtLg2fJGFrIGO9Tsa95rOiwRMnK31zvdE7oAQBWHXAIg/3q:iKcpfJGFrQThOiwRMnK31zVE77QBWk3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788693525, "uuid": "9c0257d8-e92c-4bca-a678-0a11d741a2f2", "value": 94699432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788693525, "uuid": "d1fea134-235b-4419-b303-5b2771dbd80e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693525, "uuid": "b7c096e5-7066-4116-88f3-04b8b3dcc0e8", "value": "988a67f7385f08bfbe51e025f2aae8d709b658d514fc257d9a2317281aec1877.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "756e91c0-a9ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1788697706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788697706, "uuid": "2ea46294-edc3-40cc-a3da-75638897275b", "comment": "Malware payload (RemusStealer)", "value": "3163c6daa508fd2ec19d44dccc6f651f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788697706, "uuid": "21b0ff1d-348c-41f3-9522-c5f2adc3e024", "comment": "Malware payload (RemusStealer)", "value": "991121ddf69079e51d2193f9146e27a6c24117dbc5b606c39a964b5759078cff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788697706, "uuid": "40f14a63-c91f-40f9-b686-9f02de10c1e2", "comment": "Malware payload (RemusStealer)", "value": "c0a974e83e553ccc30eb39e05602329296667d7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788697706, "uuid": "0ed6a7e8-61e3-4d5f-a757-a63938ae61ca", "comment": "Malware payload (RemusStealer)", "value": "cae14b97b32408d02759f61412a604fb79d7e0c49d696df74ceefb520d0d4d5e3fea171553d4d186d766533d4dd02466", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788697706, "uuid": "41f60270-f0bc-4014-b8ff-c3ef5fefe21f", "value": "T19FB708037A9506E8D0A5EB71C2A74167B66B784CC73563EB5E0073303FA5BD07ABA748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788697706, "uuid": "3891f185-5a02-4f99-a6c4-dd5cc35ffefa", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788697706, "uuid": "defc6686-88a9-45ea-98cd-6fd7405187d0", "value": "49152:QNdFjhi33bdFPDANSzx0wS4yxpHvdfJpk9FjYhwVP607zS79RGrZsWseaoQktUX7:9BVsKyxZvdR06H07zjVeR8Y9OWXse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788697706, "uuid": "b31f3102-87db-459d-96df-2db34c531e07", "value": 49448848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788697706, "uuid": "2952be3c-4567-4b58-8adf-abe170d1f668", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788697706, "uuid": "70a554db-2df7-4994-9508-dff66e627a8f", "value": "AzureSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b037142a-aa2a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788723574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723574, "uuid": "b09b36dc-e0fc-480f-8a1d-63c9c3249be0", "comment": "Malware payload", "value": "28269b27055adc2537e55a39fe161caa", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723574, "uuid": "fffcf5ae-b016-4f40-92bf-236d9bc919bd", "comment": "Malware payload", "value": "9abe595cd3595dda1a166957b16ec85fbff775904850c5f32bcdbdc26b158575", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723574, "uuid": "91090f58-9c21-4760-924e-213c37cd1a9d", "comment": "Malware payload", "value": "0ca63261d61f2fbfd882ed613549cc1c3c1afeaa", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723574, "uuid": "8abf75ed-1dd2-4484-a59b-c84ae5495136", "comment": "Malware payload", "value": "942c7198a7f7f0ed3ccc0a2cf9e41815515ce8544ab6e0fdba13b11a0fb036be9a414a19bb0127b268f78397f2b8c8b2", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723574, "uuid": "330c7957-b5ab-45d0-8c23-3032f9f24fdb", "value": "T15346E037AE9FCC28DD6344F751C2C252A45A95A5A82BD07E02F04DC5CA75ECB0366FB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723574, "uuid": "a3c4512d-9d2e-45e2-b9ce-7f9a975b7153", "value": "98304:lgArmZXtdFUUzV/nNw28LwrzR1KtRH2HpQ5NJUiBmclId3P:lgbXfFUUzH4Lw/RKHK2M0idf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788723574, "uuid": "0f818c83-5815-43c8-b2db-d66dfaa6a2b5", "value": 5618341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788723574, "uuid": "5eafcbf4-abd6-4d24-a019-c01585836ccf", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723574, "uuid": "4f1fe4d2-4195-4f2f-8263-3ca71aa648e2", "value": "scruffy-obf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77fd6180-aa2d-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788724768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724768, "uuid": "3f4fb9ba-6c29-4665-9f3a-089e770c0d4a", "comment": "Malware payload (AsyncRAT)", "value": "cdbde70e7dd779cebec7d5afb272da96", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724768, "uuid": "a2ae76ad-4559-4ec4-ab76-f51a77d1d700", "comment": "Malware payload (AsyncRAT)", "value": "9ba76ceb13a62e632b94324fc772d7921c461c6fd5e70844aadca97dcc15cb7a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724768, "uuid": "6b23bd43-0cdb-49e2-a2d4-03cea188503f", "comment": "Malware payload (AsyncRAT)", "value": "3b930db64e5478fa38d42d5c20e9efa75dbe7489", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724768, "uuid": "e00cd2f7-3365-471a-9485-c59d272c8dac", "comment": "Malware payload (AsyncRAT)", "value": "a3889c383eaa11faff83f4d82f3657fd773bcbf4adda8528721ea7a64f5dabce497fe9f0cbad85552e3c10184f10a3de", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724768, "uuid": "7f9fa861-5b1e-49c2-8206-f8d9b20e9b0d", "value": "T196C24D0873E8C572D1FE06BA883385009775D95B9913D76A6FC890AE2E237CD8A14FE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724768, "uuid": "41300e0f-834d-406f-83f3-5b3caf15cdd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724768, "uuid": "40c46786-782b-4319-bdef-2a1d9e22dd69", "value": "384:zQpwoOiZTWqSOsVa/KFHbx0yH9qbuUscCbQxnCJfJBndnjJeKWjT+:zQpVg1VDHV0wIb1BBiBnPWjT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788724768, "uuid": "146d005e-a882-48cb-b7de-3ebc9cfa37da", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788724768, "uuid": "b0d9108a-865c-4e05-863a-36c41d5eab22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724768, "uuid": "9c3be375-c77e-492b-854f-f1f9d5f0f7d8", "value": "AU88APP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3cfe1c5-aa2e-11f1-bd95-42010a9c0009", "comment": "Malware payload (VenomRAT)", "timestamp": 1788725325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725325, "uuid": "aa5e27c7-118c-4dc9-923f-09593120035e", "comment": "Malware payload (VenomRAT)", "value": "75f0d7ca7e0a6348202bf6533ea26f53", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725325, "uuid": "c258d046-68ad-441b-aa0d-061106d7a780", "comment": "Malware payload (VenomRAT)", "value": "9c8969b2fc30c395e31a4443cc691c889b309f906e69c2f98cdd92adb812b456", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725325, "uuid": "ab38edf2-d81f-47ee-b3da-57689794c2a2", "comment": "Malware payload (VenomRAT)", "value": "230ca7bbf9859c65cd1d0112f7091fce4bf46bcf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725325, "uuid": "f6b4471e-eb2e-4ac2-9d4a-b314f1035f72", "comment": "Malware payload (VenomRAT)", "value": "7ea47b207f6c354f990d997ce79598c0991224131ccb5eeaf552b3ab0e5eb568a050f8e38d97d222a5d49f0185ccba53", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725325, "uuid": "3a7b146a-49d8-45f9-a2ed-959ab54ba13d", "value": "T100735B0137D88926F2AE47B9ADF251074EF8D5576112CE5E7CC800CD6AA7BC58A037EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725325, "uuid": "a9cb11a2-df4f-4716-9a3a-f7420ee3bcd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725325, "uuid": "ed13d536-1008-4df6-ae12-d74e02d6a497", "value": "1536:tUk0cxVGlCBiPMVIsOBe+lIRH1bW/UNpQzc7QVclN:tURcxVMWiPMVzObqH1bWcvQ+KY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788725325, "uuid": "deb2268a-5eb7-4414-be72-af108df4a0c2", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788725325, "uuid": "6e0410ac-f231-4c16-9fa6-7be605e4e29e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725325, "uuid": "02fc7f5d-552e-4871-8670-23a48bf7589c", "value": "privateemu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2541485b-aa19-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788716040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716040, "uuid": "8f672b14-7080-43e7-8188-d229cbd714d3", "comment": "Malware payload (Mirai)", "value": "925d04118d18a89368c650f6f41fbd3a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716040, "uuid": "15a02365-fd45-44bd-a1d9-69aa4c23f15a", "comment": "Malware payload (Mirai)", "value": "9de5e230c7f0342f9dd202c628dd1cdff6aa0496bdca9ce468437cea19e4453a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716040, "uuid": "e1f7e011-ac98-4b0e-b730-4889a4eeb0d3", "comment": "Malware payload (Mirai)", "value": "d22c89b106e6128a757d10fc9d6b7d9b9cd47b7f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716040, "uuid": "25f61ac7-7ba2-4d26-ac19-519cebad70e5", "comment": "Malware payload (Mirai)", "value": "6e0ac5e5ab1acbfa03d00adb78ccb121315c32d5674474a52c06586fff1574edb921f5cf54bdb0e03841f9353d164a24", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716040, "uuid": "0a44cb63-89a9-47df-8f3a-b5245151a822", "value": "T198933A03B58090FCC5C6C1344B7FA636EA72F1ED1275B69A37E4EF222D4AE211E2D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716040, "uuid": "15ab918e-9508-4245-9042-18a7ca7a1316", "value": "1536:KPvjFFjrKGGg17rsyCcpUu1vzU/urovwi2V2xPSUUN4J+LhR:KvjLrKGG4syfQ2r/iBxpUN48Lh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788716040, "uuid": "dc262113-e4c5-4e2f-ac63-d5765f812b6c", "value": 89232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788716040, "uuid": "b3fef719-b844-472c-834a-10f925e0aeb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716040, "uuid": "c3e7df35-8646-48a5-aa7a-a302a3749227", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42cb8d96-a9f8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788701916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788701916, "uuid": "98993324-cb92-4800-80e9-98d3c333aa35", "comment": "Malware payload", "value": "3b913ec3017c4b10984a405ef812b91f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788701916, "uuid": "7b3dbdd5-54c0-4a0e-af7b-686a373852d8", "comment": "Malware payload", "value": "9df543281cd9b66bc4a9f6be79133ab39c12a3e750a493ce402ef28d56f09809", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788701916, "uuid": "961c0e2c-e104-440e-8ddf-10df493407a0", "comment": "Malware payload", "value": "6496caefcb534fa37ece65c9b9df5887db0565b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788701916, "uuid": "cc0f18a9-e07d-4c59-8364-8e7aaf6c28b8", "comment": "Malware payload", "value": "348069f213f581a876ea171de14b995b83ba27dfed8cac2833fb5aa75d518c46261cf175ec9ed659511fe1a4a6cd53fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788701916, "uuid": "7a99cefb-6755-4b9f-a351-53c93012d7b1", "value": "T194183384831E8955D1CFAEFDA6BE0EB2D9560CE09229F09747A25430F5F599BC1CC28F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788701916, "uuid": "6df5429f-f174-4013-8717-0ef0c4dbf98f", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788701916, "uuid": "b7b3269b-bdb9-4b43-ae2d-34b5684fedc6", "value": "1572864:uLdknCzii8JhEFakFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB7Xp:u2nCzi7qFNaABZVPArg/bXeB7Xp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788701916, "uuid": "44a7c39e-6920-4e29-bd84-f162543a0893", "value": 91040040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788701916, "uuid": "09a7ff1d-3677-4f07-a521-69244ecc96ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788701916, "uuid": "9a57022c-5faa-4fd2-92ee-7ae68505a4b7", "value": "ArcaneRBX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf3445ae-aa3f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788732646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788732646, "uuid": "50056887-c7be-4e63-ade1-ddbc72df25dc", "comment": "Malware payload", "value": "ae7f6c84267e38c08ea8776fd0d62de2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788732646, "uuid": "0d900f76-21b8-40bb-88f6-ee68dfc8bb6e", "comment": "Malware payload", "value": "a037767ff9f8496c3ff65c4d34b38d52e4f52ab6de075b03f0bd43408502087d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788732646, "uuid": "c76a0469-4461-44f3-b8a3-67d0ace586a8", "comment": "Malware payload", "value": "9a3cdd1e80920dab81aa46f2a0b4f14e6f28fa49", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788732646, "uuid": "29b6b908-d3ad-4d37-b3e3-2db8ce06d85e", "comment": "Malware payload", "value": "c4a5ea4d3d4c2b4e906a108076d7a53636dbb549e4bc8a75227bb20f5118e3c8a0a5fa3b66843b1c37411bc2a207d6ef", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788732646, "uuid": "645d011e-1993-4500-bb5b-1232124474b3", "value": "T18C236C651A857C149A99C4371D7F2F0CB9AD43E6320452DE7FCB3CF28C8AA9D920971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788732646, "uuid": "bfd8c63f-0fe1-4974-bfe7-fb375654147d", "value": "768:jVEJVIhtMo9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:5EJ2M1cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788732646, "uuid": "9abc8514-7df5-4e62-9bd0-5dcb547d47c4", "value": 50043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788732646, "uuid": "349be168-ee5e-4865-95fa-1ba84b03af1f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788732646, "uuid": "df733ecf-91b2-48d9-9c21-87dda2da7514", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f48e785e-a9c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1788679880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788679880, "uuid": "756ec0aa-3f22-403d-9378-a25174211546", "comment": "Malware payload (Stealc)", "value": "7914c967bb140672c77ca47508ab9807", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788679880, "uuid": "77a08e46-0bec-4f11-9091-f9cfa9640456", "comment": "Malware payload (Stealc)", "value": "a0a40326938bf08e6370f6227960e50458c096f55d2c645e24cc33c4274ce75c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788679880, "uuid": "a8bf8ab2-c10e-4ed0-ac70-cc1d80e6561c", "comment": "Malware payload (Stealc)", "value": "6cc156a592275753fcb30d85db072097ec7b3a7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788679880, "uuid": "13191b5e-90b0-4922-a742-9041894022a2", "comment": "Malware payload (Stealc)", "value": "51ac50e86d19f623daf2072ef5f057f083e6be76b7e4dc26abb3ca2d345f2d669c3b8072eb1083b80621b74143366d8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788679880, "uuid": "2db81689-98cc-451a-8e65-a20fcd9a6dd4", "value": "T15DA533E01AE0851AF1314BFC84E4C2C78571BDA61F74976F1698AACE1FB34E2DA74706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788679880, "uuid": "b7fadbcf-d231-4b7f-890b-43f5dd4f216e", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788679880, "uuid": "05a7c5ce-527c-487d-bcf5-f3e46f5e4e5b", "value": "49152:tMBMOatNMMdD274vzd/aBTe0Cl4Q4vKqz6AcIqI9jNmRcjL4gj6WiiF:tMBMOkMMl2UBiT9lPpz9jZ34c6WjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788679880, "uuid": "7a1473ff-05a5-4243-8ce0-cf3f780c2bf5", "value": 2225152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788679880, "uuid": "737fe615-1866-420f-a7c2-ee952e1bb888", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788679880, "uuid": "a3b29e96-cc50-43d2-aae0-149992d20ca0", "value": "7914c967bb140672c77ca47508ab9807.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa4bac2e-a9eb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788696506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788696506, "uuid": "1726a5a8-ace7-48a7-9f82-516cc51dfe13", "comment": "Malware payload (Mirai)", "value": "55bbbb81a1a42a699ac4549f00ffbeb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788696506, "uuid": "0dd2d09c-acd9-4e9d-9b9e-0a8aa503fa85", "comment": "Malware payload (Mirai)", "value": "a0d88025ce4c26af28f8634ed9008723dc906dba244f5504b4a22a83dce5135a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788696506, "uuid": "4aef9ac9-5052-4c0a-8bd4-262b475d6ab6", "comment": "Malware payload (Mirai)", "value": "33ef42fb6073818fe397bf274ae7f1dc47a37116", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788696506, "uuid": "d728dced-21dd-4bdd-96d0-c6b273e5a17e", "comment": "Malware payload (Mirai)", "value": "a45ef27425df3d6f4a598cc13ec884d0fa71baa82118864988786a57516e4d99289c08c92d9e992a36a17b4f4566b27d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788696506, "uuid": "cfb645cb-95c5-4686-bc36-eea375c0b252", "value": "T10E337C85E9A3D1F2F5934A314017EB6EAB78DE354004EE46FB197932FDB1693861B20C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788696506, "uuid": "f7b1b9e9-5d88-4898-bba8-81cba752b28b", "value": "768:vUAaeRSm8R64cLWgzmZT9W6v3MakK/A1FzaIZDksx0ZElx/Fau4JK4lhpKzEr:vpaeRhygzmbM8A/eIZjGZMHak4lhsor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788696506, "uuid": "4c30210e-431e-4c48-bff6-abec48a4f6f8", "value": 53956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788696506, "uuid": "9e4de90d-3591-4ea2-916e-64f1d4844986", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788696506, "uuid": "aa11e852-ba0f-499e-99c7-8aaf463a4d22", "value": "a0d88025ce4c26af28f8634ed9008723dc906dba244f5504b4a22a83dce5135a.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062e2a77-aa19-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788715987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715987, "uuid": "29a5d0ec-1234-4b68-9b49-913e625208e7", "comment": "Malware payload (Vidar)", "value": "806f5b9c1cd261b6d4eafefe7aab4a30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715987, "uuid": "93975899-ac39-45c2-a500-4d7caeb8cb69", "comment": "Malware payload (Vidar)", "value": "a15c52e3d4c28e0e9526c9d34bcc36335206d8f51197c108b0838b17d9a18d01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715987, "uuid": "7a318963-feba-47da-a69b-b254964d4103", "comment": "Malware payload (Vidar)", "value": "ca13c680020b6f4411ee301df85c12f26f112c95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715987, "uuid": "a9ef6b8a-6962-436f-848d-4c267a1fe549", "comment": "Malware payload (Vidar)", "value": "5f8f6da04c9f36373d136f325280fdb99778eca4d3815d9a50c077d1ef860072aaa8f9b6e24df107108a207aad42eb83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715987, "uuid": "13026578-0f82-4338-810a-46fcc7c9d8f0", "value": "T17A468D07689290A9C19A9B35C57E5662FB75FC88CB3173E32E40B6702F66BD13DB5B00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715987, "uuid": "f4eb0798-ce8a-4cb8-b9d6-8c113799aa4f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715987, "uuid": "fe7b202b-93f4-4496-a4f2-35c5484ac673", "value": "49152:9tFeXnOtz1x5fIQgH4SDHoCiIfSHUUck9JvS0MNuL8tmbyU4RRcjU8Z+PeEqEyld:9LxeJHoNIajFq000zbyD6U8ZPxKEzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788715987, "uuid": "3b39b31d-fa25-4928-bc99-8729039009ba", "value": 5607848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788715987, "uuid": "91f7cb52-8b69-4ba3-a898-a52db68fca8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715987, "uuid": "5051e5a8-26a5-4cfe-9c7b-64567b90b0e7", "value": "a15c52e3d4c28e0e9526c9d34bcc36335206d8f51197c108b0838b17d9a18d01.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f85769-aa1f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718562, "uuid": "4baa9ff4-a5fb-454b-ad07-72c8eb92f037", "comment": "Malware payload (Mirai)", "value": "4bdf1c4afa3138533bdb1397790f8fd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718562, "uuid": "9b3d759c-36d9-4ec9-9ffe-68a706148b00", "comment": "Malware payload (Mirai)", "value": "a1a30f79fb5535e4562fd77cabe716d19649871259df1e8f54b30d3e8a147acb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718562, "uuid": "da7d2587-6604-400f-bf5d-a2861fcba36e", "comment": "Malware payload (Mirai)", "value": "557664ef852387bfefdc637b74a1aa293499aed2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718562, "uuid": "aacc2bb6-e817-443a-a754-6284027a60e0", "comment": "Malware payload (Mirai)", "value": "a52f3e7c7904355c3fd2ede774c665ac47f3ba225a0f8aab4f081eaa65e51a097716c5fcbbf9a0f181d912df3acf1ee3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718562, "uuid": "4a1c77ce-d946-49cf-bfa4-aead2830795a", "value": "T17C8312671D51C2FADFED19B932D3573018759DBBE811C9086559D3C78EA30AC3016AE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718562, "uuid": "79bca930-a6a6-4a99-b167-da02218de403", "value": "1536:AkMmsl7SEsyPCnZCWhI4zdWJANMcYZOR0UcoyP/d2NkdQkVEWUu:k3TaRhCAZWvzd22BVEJu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718562, "uuid": "b65ab5a8-5cca-4044-be3d-68d9c9243fb1", "value": 84080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718562, "uuid": "a3963b56-35d6-4ef5-bcf9-6e47b1828e28", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718562, "uuid": "f2124d05-6bdb-4918-9ef6-ea91962d5f4a", "value": "wj0s.mips-dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f98dcf-aa19-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788716037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716037, "uuid": "571c0556-055d-482e-ba85-98bab4ed781a", "comment": "Malware payload (Mirai)", "value": "94a8be73212da637944ac5513c2a2f96", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716037, "uuid": "03fe157b-fefc-4691-8b2e-b5f318d5c867", "comment": "Malware payload (Mirai)", "value": "a5066658f8254df4832d9aacacd06156badab8dcdb6f4785d4a3314970e200a4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716037, "uuid": "38eb5f5e-2937-4387-bc9b-14e274dbdab4", "comment": "Malware payload (Mirai)", "value": "7404262cb7f405054fb036b42bc9649f71e393ec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716037, "uuid": "19c53d61-05b3-4be1-8066-d2f3109fdc38", "comment": "Malware payload (Mirai)", "value": "ab704bcdaefaea63754830588d0867d066767a1b9b65f8b66c169a10be45ddd6d79c181d53e39cf0b81d56ffca409e37", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716037, "uuid": "708a13a1-4d9c-4fba-9445-c3a2e07f0f4e", "value": "T1FE733B81F54B80F1D847487090BBF33FCE31D69541B5D66EEF689F36EA63202A60629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716037, "uuid": "233af6fd-b7df-4ca7-941e-473e7c59effa", "value": "1536:uVHQ0rPyMQn+JgVV/SGQ+ZsbDSfFWLIk1Q9j+Lxty4AHV:uVFrPNQn+WVQ3EOVUk29jgxOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788716037, "uuid": "5042869f-bfbc-4de1-b20b-65e7928c8a30", "value": 79232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788716037, "uuid": "7686b34f-7046-4260-9dd6-d9d3099e970a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716037, "uuid": "97b021b4-68e6-442d-85f3-1bbde0b774ed", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "579ae05d-aa2b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788723855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723855, "uuid": "f6d6cc1a-e47f-43cf-a5b1-9c115764f2cf", "comment": "Malware payload", "value": "8078c766c86c33cf22a0bce7fdab7c62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723855, "uuid": "22716cde-b081-4b15-870f-7fa3b709f269", "comment": "Malware payload", "value": "a5600569566be6e9bd1e67eabf342060b7bd2874f42b83d05045783f979576a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723855, "uuid": "e24f72d5-7c7c-4816-a315-1cf819fbdce5", "comment": "Malware payload", "value": "687e522b5fa98892641f0c37e35f754065fd4775", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723855, "uuid": "e6484956-8b26-4f8d-857e-5553f9fea8e0", "comment": "Malware payload", "value": "7e0a0311eac5345a03d8ddc7d7203f58c2b87f7ec3063883126809df8a77c93bc6afcd5b390bc518460d13ee3afa923b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723855, "uuid": "263a6f30-aa53-469e-ae8c-6f9723d6e2fa", "value": "T100453917E2A764E8C56BC0788657A773F970B85901347E6F1B98CF312F21E60972EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723855, "uuid": "7a1a112b-b4ee-4859-b9aa-fcecbc1989c3", "value": "9bc9be2eac143a21bbd0d21b05e557e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723855, "uuid": "0f210eba-1706-4266-af6d-fc46debee570", "value": "12288:af3e38YWOT5xl/K/j4ACo/0Mi2JGCc8xDfihyTWjIKcg1JEnqfvc0/PeSAmquCQQ:KDYW0//K/j4AV/0MLJdFCRLPVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788723855, "uuid": "160be564-b4ba-4092-bfbe-7ae6842ca095", "value": 1209856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788723855, "uuid": "e7f41998-21bd-435f-9d7b-1af1905e1660", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723855, "uuid": "9a37e450-a257-4a1b-b014-179d364ff9ce", "value": "006_hook_MSWEBVIEW_xor.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765f8e5b-aa11-11f1-bd95-42010a9c0009", "comment": "Malware payload (RatonRAT)", "timestamp": 1788712740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788712740, "uuid": "e3102d49-8f46-4c86-ba37-c79c655c6b01", "comment": "Malware payload (RatonRAT)", "value": "cff8ae85767707c0513f1e9d8b7cb853", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788712740, "uuid": "f7825a76-b9dd-4f7a-8f04-1aa0867f63b8", "comment": "Malware payload (RatonRAT)", "value": "a5af065f87ff970e41614cf1d5221f3801babcac25d933ba972b7814403ad821", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788712740, "uuid": "0835720a-3760-4131-864b-83dc79b72d40", "comment": "Malware payload (RatonRAT)", "value": "52ffe0e7ada97ab22f024bf9a39c898ea190b718", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788712740, "uuid": "cb8572f5-f93e-446d-aeb1-583696aa8eee", "comment": "Malware payload (RatonRAT)", "value": "e1b88315686f6d9953cd8b15ccac7c54e3efa39ba8afe197ac754cce776008806d54a003f133b7c8501a68d5a9ce8bf3", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788712740, "uuid": "e1e25b3e-3e8c-44bc-9515-5dcdaeed2e77", "value": "T12C953300AFA6CDBA4FC8CA3C316F5F663AE81F979584A4D6A1E07CC7002FE81505B95D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788712740, "uuid": "0f4ebf3e-0cf0-4753-88cd-1ebf2733b238", "value": "24576:HfIRu2RTe3HD0IhF7tLPlrwiiQUcyeRGfFbg15hAb3TNWWWtRANleow57MXjUYFY:uv0D0QzFIDTsWNI49pLDt0F7AO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788712740, "uuid": "e90fdd09-a858-4dac-8a26-852768cfb8bc", "value": 1887134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788712740, "uuid": "3969264f-28f0-4f4c-99d2-fde4663310b0", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788712740, "uuid": "12803e8c-2a46-482f-b7f4-45c0a5a51cf3", "value": "xenofix.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93201422-a9cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788684441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788684441, "uuid": "b9ce7cf3-1632-49f0-af0e-8afc48a12ece", "comment": "Malware payload (Vidar)", "value": "ae558cf3c64a0473b810b8829c49661b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788684441, "uuid": "35b0fc90-1d2c-4640-938c-9f2453ef1af3", "comment": "Malware payload (Vidar)", "value": "a62eb03d71fc258de678fbc84572db662dc05617aeb7caf192d031086e6b9feb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788684441, "uuid": "44bcf998-fe7e-4c3c-a7e5-e070daceeb43", "comment": "Malware payload (Vidar)", "value": "728f97d74de85e1c92c9c31d3626b68a74970ff0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788684441, "uuid": "00b939a8-5511-4a26-a43c-08b4555243af", "comment": "Malware payload (Vidar)", "value": "da5b9dba16ad5859123e9baed7d5c11ee3a2a92f6908771264cdc87285e33177a2a52fc9bfffd7cff7dbe0bc8f69f9bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788684441, "uuid": "0db32abc-983a-4074-97d0-dfe8e67e9c59", "value": "T1DC183307689590A8C49A9735C57E6262EB75FC88CB3173E32E54BA741F76BC27CB1B00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788684441, "uuid": "65d5d88c-3302-4508-aeff-d5be8092e15d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788684441, "uuid": "5111018c-61e3-470e-9bcf-6774e70d307d", "value": "1572864:im2+TZXpgxIyEzBpHvCUPW2F0alkIIOuYRHpQojhjg/cy7zBg0BEUgmX+ncp9evt:9HdgIX3PCU+ZalkHYxhM/h3LBxXD/e1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788684441, "uuid": "da997a71-0872-4f32-93e4-4d091fee646b", "value": 90485152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788684441, "uuid": "732f022c-6472-443f-b354-d6f54c14aee4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788684441, "uuid": "9763e18b-29d7-4ab9-bda5-ff38a89bcd68", "value": "a62eb03d71fc258de678fbc84572db662dc05617aeb7caf192d031086e6b9feb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d54aacd1-a9ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (SVCStealer)", "timestamp": 1788698296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788698296, "uuid": "8910a66f-ecd8-4b65-bca7-084bc6e3cab6", "comment": "Malware payload (SVCStealer)", "value": "15db3f4f58ffd9452314b045b75e25eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788698296, "uuid": "00e1fe0e-a322-4063-aae6-07c25e434b48", "comment": "Malware payload (SVCStealer)", "value": "a6a1598cd6713d7afbfc6d48427dd986154aa724215549477f190d10ee15bfe2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788698296, "uuid": "0e87d9ce-f4be-453a-9fa0-f8502cd8a2c6", "comment": "Malware payload (SVCStealer)", "value": "c9f24db94af5902a8da184318d259bbc9675d3cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788698296, "uuid": "ad8d4bfd-3867-4526-b0fe-206b8be4b366", "comment": "Malware payload (SVCStealer)", "value": "352bcc6c5cc3deac1e4dfc352413c847b4dae5d8e5f5fdef6922a74d2b8e0b72e897db9b231a82b9778ace12437786a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788698296, "uuid": "c3738268-7713-488d-9b2c-1e0c8a7929d4", "value": "T1AC431975A2E603B9CD5F8633DEB8D77BD168B582BA70160F0312C7282FA2151ED1DA81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788698296, "uuid": "5dcdc6a3-3b5b-4e91-872c-21fd9896cd51", "value": "1536:gVvnoW+itzMPl6P5nklcAV5DHYI7MiF6CSB3:EoozMPl6PAR5DYI7xo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788698296, "uuid": "b5af7c2f-3e00-4f63-b0be-e1927192fb10", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788698296, "uuid": "d42e1c2a-05d0-462b-8a3b-14f8f04b906f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788698296, "uuid": "2a1abd9e-e3c4-49f6-ac5c-5c44ff8b3ae5", "value": "a6a1598cd6713d7afbfc6d48427dd986154aa724215549477f190d10ee15bfe2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f605106c-aa1e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718537, "uuid": "679a7584-c02c-45a8-9572-5853447523ff", "comment": "Malware payload (Mirai)", "value": "34e699eac98b8aa2a6022fa7176fb23c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718537, "uuid": "f0882c97-2743-4a83-b56f-fbfdffb86d57", "comment": "Malware payload (Mirai)", "value": "a779c9922f024dac855461a38e01714d819ae04303814fa3d1b002ed0a2b99ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718537, "uuid": "5045b102-1614-4dd3-8d03-c8e2e1ddca88", "comment": "Malware payload (Mirai)", "value": "86aaadd4777b14c65575340fca0c1d5038e1976a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718537, "uuid": "4712101e-b362-41a8-aa86-61665bcc4c10", "comment": "Malware payload (Mirai)", "value": "a728a6adb61d544638f16e5b06670178317bdab160ac8b4b3e4315297bb4b4b6285b2f47781187111b0fb7b004661259", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718537, "uuid": "0a4e2d2c-d521-423c-8513-32285d27a826", "value": "T1507302D01E45ED9DF2F0C47CEA6402991526A8F533C2D26FA528F4D1BFEB014BE8494B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718537, "uuid": "00a33f52-0f86-4a2d-9a83-0e502c79bb87", "value": "1536:J0DxgtoK0pC9bvBR3Yc0hyyYGMfaC0cAAzl+fgSOQe:OFgtOYbvBRIRnTMXAAzYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718537, "uuid": "864b4eb8-050e-4a06-8a46-ea0390655943", "value": 79888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718537, "uuid": "efaf52d3-0f41-402f-b123-5f9278b098bd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718537, "uuid": "e15683e8-3ea2-4f35-9e01-1801727d362c", "value": "wj0s.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04269f7b-aa1f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718561, "uuid": "d035db0a-f056-41fa-ac50-badbd05ab2c7", "comment": "Malware payload (Mirai)", "value": "e0a428be3728ccad01b6877560390bbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718561, "uuid": "557062b3-7101-485f-9e37-eea429ac7d96", "comment": "Malware payload (Mirai)", "value": "aaaefce4ffe75496650ccc0c4719b3d334137e200fe426b2902eae0090ab8f97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718561, "uuid": "dab5d8b4-1490-479c-83ab-dea660f32a6b", "comment": "Malware payload (Mirai)", "value": "a296bea369567aa1f5013ce849665c2494e4a370", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718561, "uuid": "557ba073-3e97-4bba-b722-77936a80ccf9", "comment": "Malware payload (Mirai)", "value": "56747d118335248cea508b27112b362f475de36564e318070f0185c68b803dc8395abe79743f218f10e1454660d0f306", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718561, "uuid": "3efe3173-481d-4521-8786-b9aac815e2ab", "value": "T189058D367701EBAAD378D27108F387A886F122A317E345456278D32C6E6211C6D5FEF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718561, "uuid": "1acf1754-c283-400a-a135-3a55f6724c02", "value": "12288:0TQ4Tpyk8zQd8yZJvWCESSU8G2XoQgKYS1YWjpXsFJstvwOGsfB8tq:0TQ4TXR8yZJvWC1SU8G26d0iowOLfB8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718561, "uuid": "f6ae4fdd-b174-49f5-bcc5-c67f3aa89fca", "value": 862912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718561, "uuid": "a84235a5-67bb-4036-9f6c-b50eb878703f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718561, "uuid": "0303667d-b734-40f9-bdd1-df81a03b687a", "value": "mirai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0851367f-aa42-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788733600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788733600, "uuid": "d6a04023-8f76-41a8-a151-aab111ee5dca", "comment": "Malware payload", "value": "e8cbfe7bfce42787ef7810aaffd1fdd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788733600, "uuid": "a8e8672b-b989-4e49-bf86-6f356fa1c7cc", "comment": "Malware payload", "value": "aaaf5da70c09896a1527b7b32a2f9ec22184b8bdb2cca248accd48492e8a1cef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788733600, "uuid": "1a88284b-6ce6-4a66-a0a8-cdd74f9c9d74", "comment": "Malware payload", "value": "5119e15cc4e00eaece12898300bfcc239d88d46c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788733600, "uuid": "517a0bf3-a99e-45b4-aa93-aaa1c6d1a32f", "comment": "Malware payload", "value": "b91a4ce9a9ab6c2e0cc62273a66c37d01b40d2adba6142d3acbaff7a2ef0afb39ee460a270c6d7efcbfa49c7e38e6bf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788733600, "uuid": "0f797794-f628-428d-ae65-254d1a3e51aa", "value": "T1EE67EA46B605C98AE0265274D8878FF4A722ECB1C6B1976733A93F1D7FFA30C4E92454", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788733600, "uuid": "f3172c5b-c462-4e0c-ac23-5d8e14265186", "value": "c329cfdce996b315359260e710fbdc76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788733600, "uuid": "e7da2d87-13bc-4087-add6-addd13e3ef94", "value": "98304:7ClvSImXQ9EkE6uzJdQ2Orf8wsGF4tVjibVpOMOaci583EGsGFCJNlvj:GlvSIkQu5TcT4PILhAxTCxvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788733600, "uuid": "d4efd9f4-0f36-444a-8e79-ec99375d5705", "value": 31746464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788733600, "uuid": "90cfbac1-6395-4ec6-99ed-984bcad84020", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788733600, "uuid": "feb16670-d5b9-4529-a2b1-1fc066b54a2f", "value": "installer_r2.0.18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf85183c-a9e4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788693535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693535, "uuid": "790fe0e3-57ff-4f41-9120-972a220d5a4c", "comment": "Malware payload (Vidar)", "value": "0f5044bf9ec71903789cc08d5ae81309", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693535, "uuid": "2acf0b61-e88a-41c6-bfc1-20db72270492", "comment": "Malware payload (Vidar)", "value": "ab1136acbc2373a858962fd4ef69549b02e9f4ab171cb052095e52f2344b9bf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693535, "uuid": "d7dc78de-e210-45c8-a981-cf0ecddc7e5d", "comment": "Malware payload (Vidar)", "value": "abd9c4c17d3a169f83389d8710801096202917ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693535, "uuid": "4ec551e5-2247-4719-9daa-10511ab6efcb", "comment": "Malware payload (Vidar)", "value": "76740c22fa8b753d154813feb94ac1d4764c9ba548ae64855e9d64f17428ae397f4bce3536df0a5fa32347d610aa9fbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693535, "uuid": "762823de-61bb-4109-a079-b5216f1e019d", "value": "T19228330769E590B8C0965A75C5BA5666FB75BC98CB3073F32E44BA302F66BC13DB2700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693535, "uuid": "15adec46-0b99-4244-b8c7-6cdecf6cb1c4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693535, "uuid": "2ef637a4-e6d5-48d9-ad34-6442198cecbe", "value": "1572864:NxYYu86s6rBw165TpPkK3OFkJr9O7hJVWxCOVxgvDKYZupud79WGtj:DYYaw85Tp8MFJ2DtCKu/pOcaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788693535, "uuid": "25e90402-0e79-4430-9f96-5796e6e8916c", "value": 96796584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788693535, "uuid": "9d964aad-7bc6-4d14-8d83-eabc26c6ae45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693535, "uuid": "a6ee7a7c-8800-407d-8cbd-abfe61b8ca30", "value": "ab1136acbc2373a858962fd4ef69549b02e9f4ab171cb052095e52f2344b9bf4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1558e03-a9d3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788686264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788686264, "uuid": "8fbdec19-62b2-48c2-bc33-d655c03d3593", "comment": "Malware payload", "value": "01373caaee0032714f94fa5d7a98881d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788686264, "uuid": "383663c2-003b-47c0-a510-630633b670c7", "comment": "Malware payload", "value": "acc9ba9e31c225dec1bbce29a049ccf3500c1631ad3f4fb9d52d1a03cb557cfb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788686264, "uuid": "22efa84a-50a8-4480-bfe7-4a3952ce0755", "comment": "Malware payload", "value": "3f4cfcf5fc4161874f46c929a7d7ce226ca3f6fb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788686264, "uuid": "db6e4ab3-3d0a-4934-8528-b32ab9aab09d", "comment": "Malware payload", "value": "c1108c29ba3b4369c612d40eca39a7e736a906d849f1691f81d93813d213fcaa632071f7785897f4b3e7a5dcf70bf563", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788686264, "uuid": "fa79db8d-00ec-45e1-87b9-af08c0339dd8", "value": "T165C27D956A867C44BEC94A3E4CBD2B0D6DF5C3D1324942AC3D8B3C719C12FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788686264, "uuid": "8c86c417-dd48-4ead-9114-b3876051adf7", "value": "768:er8vCB+25j6es8R69FYpMSUpi+20qUpi+20YQX:O8l25Jsd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788686264, "uuid": "a7bd3a61-484a-4be0-bb60-a95be77db9b7", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788686264, "uuid": "5c6a3bb7-e224-4955-ad72-3fdcdc54fbb2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788686264, "uuid": "1d3212ce-a2d2-4dcd-b753-0c5796043849", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a6de67-aa20-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788719255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719255, "uuid": "776fb15f-f668-4dae-9778-97df3583faa8", "comment": "Malware payload (Mirai)", "value": "c0cea50d6a749eb0a7ae9dbe17d74c6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719255, "uuid": "c162e835-b07e-433c-8de3-f75f3b88150d", "comment": "Malware payload (Mirai)", "value": "ad6c1101983bf19f3ed46e99f9b20f5a3eae933cf23db0c63bba2b20390df39f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719255, "uuid": "a0695b04-94b4-49d6-94ac-b25eba731403", "comment": "Malware payload (Mirai)", "value": "0c10d815ff81d4c450f81ea0eebc6934d7f7bb96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719255, "uuid": "4a3b7e3c-797d-4bf4-8984-556df5c2adc9", "comment": "Malware payload (Mirai)", "value": "481304b8636a12c836fffdfdd42bdde37d5f2262b6aaeb51a1e154b4a1e8331fdfcf4dca980189744cae928bd75a8772", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719255, "uuid": "f8730992-4e89-487a-829d-b276c1f5b2ea", "value": "T15B04392F358191F0F6411B746BCBD3976C390BBF51A9909F6B416329B6E0B7BA02C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719255, "uuid": "fe3acc19-a709-4ae0-9341-2d74971c573c", "value": "3072:7mPX5bl7RDfPIX5eG/L1AL0SFU66gOSNL9CnNgRdgJi55w0UXS:7eJpJUVD1A8n0YNgEJi5a1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788719255, "uuid": "a358645d-35e1-4f27-9b5a-d8436b0f6d38", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788719255, "uuid": "c706e27d-b009-4c92-88ab-4d82a3ce3384", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719255, "uuid": "253e9a39-6286-40e7-a012-df225907fd4b", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86fa345-aa20-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788719266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719266, "uuid": "bb87c700-82e8-42ac-8b95-a3675c96441b", "comment": "Malware payload (Mirai)", "value": "24f8206fb5731707ab3947153d7af98f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719266, "uuid": "6d68b910-f4d5-41d1-b06c-1ec78a1bd452", "comment": "Malware payload (Mirai)", "value": "adbf9790d22483a598fd08d1f388a6d054a0b97aa36818c541088a1477018286", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719266, "uuid": "a8dda293-b9d1-4bb1-b752-e3431acd8472", "comment": "Malware payload (Mirai)", "value": "3eeb50a347ef5b01931d6156c59c856b5463e7a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719266, "uuid": "0b76f0f2-8532-4eae-bceb-15e9b5e2f609", "comment": "Malware payload (Mirai)", "value": "d364d06eaeb6c60da0c5ed1946c8c6b0886c168375896bd0ce98557294d4b63bd5cd3ad7372730a738db6c86cddc1807", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719266, "uuid": "735a6b19-acad-4c98-8ec7-0f22368e0c79", "value": "T1CBD3C021E4006DD1EC2129F578BA97B80350EE700BDE1582EFFDF95E647BD9438AD2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719266, "uuid": "3f334e1f-1d2a-4736-802c-f34edab1d570", "value": "3072:PnicTtkAg7FSGp+VJE6AqUjq+c7zAbpb9/xX:PiySSGp+PMmT7zMplZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788719266, "uuid": "25c6b7df-50a0-464f-8349-1907600c8a68", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788719266, "uuid": "22b5a459-ef05-4396-8b51-4b663bf0df42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719266, "uuid": "6e749595-fe42-4c1b-b9ed-29337d4f2f2d", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcde7d22-aa20-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788719300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719300, "uuid": "d4924ba8-43e4-4b31-adb7-91131eca23dc", "comment": "Malware payload (Mirai)", "value": "c8d6756cf1ece6468a7ab38e59ee4714", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719300, "uuid": "eb39b03d-6de5-41bf-8280-6cebea84b053", "comment": "Malware payload (Mirai)", "value": "ae5aaea1320eaa2fe959fde5fb8684548527fa7edf984fd050e2f3cc92fb9529", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719300, "uuid": "05b93e16-a3cd-4426-805e-d79fb49b84ed", "comment": "Malware payload (Mirai)", "value": "7ce482290861d107aedb5732b48889e07ae52077", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719300, "uuid": "e956915c-6c37-427d-9821-4097adf9c039", "comment": "Malware payload (Mirai)", "value": "a1719d1191166cc583e50279648d345e9cd2ccc430a4c3919e49296959f48a8f18258b247031b8d792ae288dd943aa03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719300, "uuid": "85b7339e-eb41-495d-bb38-46d66b3a3c1a", "value": "T107148D68FE4F78D2D2C7E37DAE4A0FA2312779749565C0B51A00A29FD5EAFD488C0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719300, "uuid": "d05a9c7f-3291-41ba-9c6a-c4d74f792e6b", "value": "3072:badBpAIWIfbEdOcdY3rZiigZ2eNRzPx0:bOVfbEdxm4iube", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788719300, "uuid": "90f1cb48-49e7-4f88-9ca0-4cae6e3f9ced", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788719300, "uuid": "46f441a9-28bc-4d1b-b6b7-f3d93ba95c8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719300, "uuid": "c846a440-d4ce-41ff-a362-f27c664946bb", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67655653-aa38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788729465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788729465, "uuid": "8de86050-9280-4215-8f21-5486e15fd677", "comment": "Malware payload (Mirai)", "value": "fc3cbd4dda5db4a985585232050f0829", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788729465, "uuid": "2095f986-7b6a-4ae7-a384-9dbae554c0d0", "comment": "Malware payload (Mirai)", "value": "aec8af25da16b46753cafb08e8311e21adc072c2b442b7c56f7ddb91197f6c39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788729465, "uuid": "70834a72-b697-44b6-b8a5-34fcdcdba897", "comment": "Malware payload (Mirai)", "value": "ddebb09311760b856b0709d92f0d734858b91083", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788729465, "uuid": "0eef40e4-20c9-417b-9917-fc3ea0cee69b", "comment": "Malware payload (Mirai)", "value": "04397ff5e63457416f02a16f3a4a82b3b50ef6565d50f8718f64ff26b3a0a577e9c68c967d2c73c6771df4b5cf454883", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788729465, "uuid": "5b319b95-df5b-45a5-8ba2-5edf8d10a4e6", "value": "T114742A8CA2F1E3CEE158EE745321BC1A5D72463B3093728A619EB97313BB19449F9D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788729465, "uuid": "14c8baa9-4c73-4da8-9958-78fa649f5f20", "value": "6144:qyv340X2YpbcbwajL4LgUNmv1kPLoOqqa90u:R5miwUYXUNw1kTTa90u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788729465, "uuid": "8959048e-91f7-4202-a9b4-e08a9abb0154", "value": 348068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788729465, "uuid": "35fb1690-cd13-4876-ac37-55ec68f08040", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788729465, "uuid": "91e057d8-8684-4c90-a916-436bda80bf9c", "value": "riscv32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d8285e-a9bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788675698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675698, "uuid": "510907bb-c37b-4009-89bf-8e15be5fd9af", "comment": "Malware payload (Vidar)", "value": "8a7d6f695e9ed0aecd02a88973cafa3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675698, "uuid": "51b47a12-56d0-4560-b0d3-0c05f421b1c1", "comment": "Malware payload (Vidar)", "value": "af8bc148eccabfa26795abff990f4cdf2dcace007af277c69d672fae76ac0f11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675698, "uuid": "52a57911-a6dd-4528-9993-e4b537135d04", "comment": "Malware payload (Vidar)", "value": "e66268079ec8369257d6a33efafcc9f359ef9f82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675698, "uuid": "ed1d86c6-68ed-4e22-9493-dd55c1cb0048", "comment": "Malware payload (Vidar)", "value": "1edb22b4b9af4e113e8707fd883e1605f5fd15c8a8771a86195e211c90ac458787d24678b86866f385f791fc47e6e547", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675698, "uuid": "306a2049-b2e0-442f-b9a9-3f7f3d77605b", "value": "T17D666B03785512E0D49A9E38C4BB9353AA2DB8CCDB3932971D40A5782F7A7C17EF9B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675698, "uuid": "728971b8-f26c-4f29-96fc-20e076f65717", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675698, "uuid": "01e7ddfb-5b3e-4aa9-af8e-1ca60f5dabe8", "value": "49152:/cELARJIq8BKPJp8nMOabll6BXumjPJLpF+kLLj9kQZFEvfuy642SY+riBLlD0:gZTlvmjfQkLLjtFE20XY+GS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788675698, "uuid": "b8a19784-5488-48c0-8f52-d5c2b96539d8", "value": 6907792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788675698, "uuid": "e9cb972f-4a1c-474e-bb01-7686edd6a9ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675698, "uuid": "e6aaa163-f01e-4024-9ade-c8bd08031588", "value": "af8bc148eccabfa26795abff990f4cdf2dcace007af277c69d672fae76ac0f11.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e5ade3-a9c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788681139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788681139, "uuid": "a6cb431a-e7aa-4c8f-9ad9-4ae7f5305fb8", "comment": "Malware payload (AsyncRAT)", "value": "88e1ce04ea6e2756a666426ae2707554", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788681139, "uuid": "e3123280-cbef-4c25-a01c-8a441229634b", "comment": "Malware payload (AsyncRAT)", "value": "b00fcf214a199fb283ed375e76a30e4b9d3a268739e4960d0ac07ac8a780421c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788681139, "uuid": "fee5a38b-7946-47b6-81d0-e159eaf866b0", "comment": "Malware payload (AsyncRAT)", "value": "3d319e9bb2b5304e5bfbca9e9b402047449a5f3a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788681139, "uuid": "f2d59f53-cbfe-4fb5-8683-e3c93ee619a6", "comment": "Malware payload (AsyncRAT)", "value": "349305d85e4922f3808c6ee28193d26bef7754e3e4fcb6cef3b637395a1b94cf4c3dbdf6f63323f78ce7886ea1ee2684", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788681139, "uuid": "5bdfdc17-12d3-44da-ba93-0a78b9efdb75", "value": "T19524E014B381753B27622C3EF89CFBCA94813658D928EADEC198DCD65D0C699C4B9DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788681139, "uuid": "5ae1660d-cb6a-4ffc-b734-a3902db1979b", "value": "3072:vW/XCHYZ3veKD6twvQtzlGaRKqwLie36a9HRSF7I1wTHR++0jYFJbK743W:vIXCHifVVvm3RK+qL9w7oUH6yu73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788681139, "uuid": "2ef663d9-999b-4be6-b6d3-11cee89aa46b", "value": 212292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788681139, "uuid": "93493f54-4548-4616-add3-f4482d8e90fd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788681139, "uuid": "56da7453-0b8f-4791-88e3-53c370696e2d", "value": "COMPROBANTE DE PAGO MOMATT.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24896ae8-aa19-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788716038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716038, "uuid": "ed2c098b-1126-4532-aee5-fac726f48e8f", "comment": "Malware payload (Mirai)", "value": "8e935207b1cdda15fc59d71521237f72", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716038, "uuid": "ab492fbd-636f-4999-8914-2a9215924a46", "comment": "Malware payload (Mirai)", "value": "b02da73120fd68f7f32f857857515f22546420d4fbdc248c40329a25b76eb95c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716038, "uuid": "05cf641a-4559-42bf-bf5c-04b64eb1b426", "comment": "Malware payload (Mirai)", "value": "67b34be31747d74dba9ddc823f7ed54a2ec1f831", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716038, "uuid": "d8ce97a9-4589-47d2-abe4-d42174dc8143", "comment": "Malware payload (Mirai)", "value": "1b9c76d7ca8a2f47e00c70ac8531b1270c9112aaf8c9f0dc408a30f6d53a6417680524d4edafeebda2e191beb9ecd678", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716038, "uuid": "af64ae53-e739-482c-8fd6-f267718d0412", "value": "T143C3E81E7E258F7DF2AD833447BB8E31A75923C626E1D585D2ACD6102F6024E141FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716038, "uuid": "f2979e9f-0c5c-4880-8487-dc0e60f330e3", "value": "1536:py5aBqP7MSCKrylSUIf1+luP0+tWOlg0yEkv1BvMEWCdWEealLbP+h3I0j:IaOulLUUogcQ9BvMEWSWC2h3I0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788716038, "uuid": "bcef4276-ed5a-4db5-b0f3-812a542cb50c", "value": 120404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788716038, "uuid": "125a7a9d-d7fe-4e04-a37a-1b4adebba8d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716038, "uuid": "f070c7b2-285b-4ba8-b6c6-17db860eb844", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "410aa0ca-aa18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788715657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715657, "uuid": "7f6a9e2b-b88a-43c9-a891-9dfcb2eec414", "comment": "Malware payload", "value": "31f84a35cadd99c85b453450e9005902", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715657, "uuid": "56bc95ee-e846-4f70-b77c-45f2ebc61475", "comment": "Malware payload", "value": "b21acf2fda542f09c52e5efa6a2118fcf260f32fb9abc01304e7120ec44c7436", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715657, "uuid": "53a4c6a4-0ea5-4545-8290-3db6bff8774f", "comment": "Malware payload", "value": "1a70f80ebe41476afd65b2e496c7d935944f0be4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715657, "uuid": "0d4f2bc3-d4bb-4f19-b198-49a782079f6c", "comment": "Malware payload", "value": "e4b6169be958534fa4dd829e0e9d48673c5511edbdb999f988eb58d467a24e3cc6782be66f9b2a06c8ff53df91c4ff6d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715657, "uuid": "9c4d92af-3a7a-4bfb-a84c-8767e653bf6c", "value": "T14DF523DAA98719B4C05BF771825B673EF12E379586608C1777CCAA005F23209AA77F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715657, "uuid": "b5803f3b-0d8f-4d33-a60f-d7f6485f6ae1", "value": "f533902cd2644b38d89e30366bc7040c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715657, "uuid": "618e4f6a-122f-4031-8611-bfef2fadced9", "value": "98304:G5Fs6rudorfP1AqbhoN2z5Bi1+NtmrfNBTT:kFZqdo7dAAn5c+NtKFBTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788715657, "uuid": "193eaddd-cf07-40b9-9a5c-340c78af42dd", "value": 3417272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788715657, "uuid": "3e309972-f492-438a-9a1a-fb1bd3c415ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715657, "uuid": "8610aa4b-917e-4275-9902-3b517aecc738", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8409aa56-a9c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1788680550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680550, "uuid": "ea946823-9591-4130-9787-3390d5954662", "comment": "Malware payload (Stealc)", "value": "275102d202213af0f41143e551a070f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680550, "uuid": "dbddfaa8-820d-41ee-972c-9d1d6d7e7f58", "comment": "Malware payload (Stealc)", "value": "b2504aeadd83e5773c191779d131fa7f19299d9b76bed50375364be56cc17fc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680550, "uuid": "bc965209-8035-4ede-be66-1ee8f1523633", "comment": "Malware payload (Stealc)", "value": "4d8ee05728299a9943f1817f49dac54cb52d8d8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680550, "uuid": "4b047f8e-5af8-4139-8e9f-64624f142de8", "comment": "Malware payload (Stealc)", "value": "ad756427562507825d36955910b1220a754aec5f0ba7ab4d0485418a4d51a868671507fe4137716adec9e95a3ba0baa3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680550, "uuid": "819b535a-a4b2-4116-909f-8c9d177591d3", "value": "T153B513193BA95116EC615E35BDF5C9ABD6343C884E60978B72A53EFF3E31384B421388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680550, "uuid": "6c8cd035-09b2-457d-975b-58234f416491", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680550, "uuid": "cc3f5077-9722-4c3c-a022-b22a673003e9", "value": "49152:ajJffKhIKjSw7Q8XUGlnmu434RSbHBUx2zLza+H5VSoSGuHw:H357HCzr+x2z3a8nSGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788680550, "uuid": "6b112983-c0fb-450b-8d19-3a5da12ea146", "value": 2332160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788680550, "uuid": "f55b7f40-5b31-44db-98a8-151a149798a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680550, "uuid": "394e5a07-267b-49a2-8dfd-f82bfff009d6", "value": "275102d202213af0f41143e551a070f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f696b0-a9eb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788696309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788696309, "uuid": "4cc65558-e7c4-4cd1-b395-f163b0bfc8db", "comment": "Malware payload", "value": "34385a2d3c70c669b4d026ec0b15a26e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788696309, "uuid": "320a9ced-d2a5-445c-a205-a047de6f6a3d", "comment": "Malware payload", "value": "b27f9bcdb02431ed558b9629835881186ad71b6e68bb9bc581905c4d45af2117", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788696309, "uuid": "dd635830-f70a-46c3-b0ac-0bc4622b20e2", "comment": "Malware payload", "value": "fe2db118920cf85cdf651275b0110d870de51f87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788696309, "uuid": "a451e5e8-6897-4de1-b9a1-f5f2f6510cde", "comment": "Malware payload", "value": "69d2a6b09eb3c79ccf1af7955d67d10172b6c6649bfa8c43e5a8fdcadcd6e47d67119301e3ac5f6bde2b9edc7c7c2d25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788696309, "uuid": "72f2959a-ccfa-4e16-93da-f91d76885e69", "value": "T1579502C442E1F8FDE4710DBECEF50EE87B01ECE9133295CB461C55997E1A2188EB6986", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788696309, "uuid": "0205dfec-9f25-4185-aef7-57e681a4e3dc", "value": "c557afab7ef1607ab852b85203270ddb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788696309, "uuid": "cf4bbbbc-8158-4ecd-af0e-1f0f02a2eb72", "value": "49152:450oy9VkqQ2L71T2XmMhHalGPiZpoZZH8:yyTk/2LpgZwkPS0ZH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788696309, "uuid": "6d19aa8b-8200-4ddc-b0e4-31eceb8eff75", "value": 2018304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788696309, "uuid": "e4c92dfd-64d0-4efc-8ce4-20f6666512c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788696309, "uuid": "1649bb82-3851-4800-82ed-17083462199f", "value": "Xeno Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f5479e6-a9cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788684462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788684462, "uuid": "4595a735-f515-45f2-aae8-ae96f5de88de", "comment": "Malware payload (Vidar)", "value": "158267ea5a3864ab1fce3d301e61c619", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788684462, "uuid": "b56155bf-3369-4096-9cc0-950a0b38a427", "comment": "Malware payload (Vidar)", "value": "b4771127ab1f2e8b4a3a3d0f6d3c26b500322f1a1dac8d60d3fc78caeaa9b6e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788684462, "uuid": "4cdaee1d-8194-46d2-af70-7924257cf41e", "comment": "Malware payload (Vidar)", "value": "5907418ef00db87b618b237e852a544c6fb41988", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788684462, "uuid": "b5b9757e-2260-4293-9015-1e85fd2fd399", "comment": "Malware payload (Vidar)", "value": "c670dd3abbfa1b6a324d905a60a7dc2a8e924cb0bfe479fc32349a9e04122ef479a1444a4665719f4a4ee8aec950abd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788684462, "uuid": "c28e57a6-1df6-4cfc-a355-ed7fa5d3b535", "value": "T1B528330739A950B8C09A8B35C97A4266BA75BC98CB3173F32E44EA702F76BC13D75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788684462, "uuid": "31af1e73-161b-4615-845f-a5e4d27f68de", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788684462, "uuid": "d40d26c1-19dc-4d31-ae02-1b0a7556b95b", "value": "1572864:NexnKiQ0lnzNHsCSuvy7kNVNoA2VkFpEUwL7SOf7BcnAH7tJkzYGcQBUmB9woNiy:cPQ0lnzNFSuvqkRy6PEUxvA7Qc1IdB9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788684462, "uuid": "2679f456-d448-48ad-b594-b602567d3658", "value": 97845160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788684462, "uuid": "d9e969a3-da5f-4b64-a628-2c1ea5621050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788684462, "uuid": "197289d7-0f48-41ca-9dd5-0b202c586d1f", "value": "b4771127ab1f2e8b4a3a3d0f6d3c26b500322f1a1dac8d60d3fc78caeaa9b6e9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26eb4b47-aa2b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788723773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723773, "uuid": "ad59e818-ad8f-49cf-912e-253a1c734c21", "comment": "Malware payload", "value": "e2a65323384e7e9438399530d46b4d0f", "object_relation": "md5", "Tag": [ { "name": "coco", "colour": "#4DCF69", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723773, "uuid": "2a01a4e0-3ba2-4cb6-a913-0750678a440a", "comment": "Malware payload", "value": "b4d7420741314f1a8df959a70afe2da8f78924e9e1a83b42b0d897744f086f61", "object_relation": "sha256", "Tag": [ { "name": "coco", "colour": "#4DCF69", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723773, "uuid": "060684b0-7dc8-464b-88ab-0c1c7e574714", "comment": "Malware payload", "value": "6ae148284bebd7600243fd6fa7a2c4994f7a61a1", "object_relation": "sha1", "Tag": [ { "name": "coco", "colour": "#4DCF69", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723773, "uuid": "1c9970be-6c7e-4529-86cc-28c953481ed2", "comment": "Malware payload", "value": "48be2e7c72e42421b59f2bb58cbbb1f4b54ea1f9ba0cb930d2432d6f0e9d744ee598e7bf5c858bb560208fa95e9e77f1", "object_relation": "sha3-384", "Tag": [ { "name": "coco", "colour": "#4DCF69", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723773, "uuid": "de86810d-794c-4c9d-aa19-85972b6c9a25", "value": "T1C1B1710E764671A0457703A19E695988E71F4077092B20D0B9FCC3C84FB1A25C39ADBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723773, "uuid": "431c6a18-11af-40fc-95ed-d52730ef8df0", "value": "96:nVEx3n1OTk1sC1/kmBz8KvqSza8yMXNEW24Jy7MJ:nSt1O41j1MmBYIqx8yMdrs7MJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788723773, "uuid": "f3e873e9-744e-4c93-82fd-e74cc1360bd5", "value": 5434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788723773, "uuid": "d652d072-d1ba-47a6-a482-a7fd29e751b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723773, "uuid": "ead9d3bd-9691-42c3-ab67-4f507969ab2c", "value": "gg.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "645134c2-a9bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788675773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675773, "uuid": "5649edcd-5b03-4ab6-834f-94ca55941c6d", "comment": "Malware payload (Vidar)", "value": "64cb0749ab029571b9ebef8eac5d2cc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675773, "uuid": "bb809df9-6e3a-4c90-a1e0-bb2c5de46e32", "comment": "Malware payload (Vidar)", "value": "b5f7d1d7e1ebc9dbbea74f2544bf99be9891b6925ba0c2d9f56f68170328f9a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675773, "uuid": "9b22e182-b885-4618-a942-bb6465013cc7", "comment": "Malware payload (Vidar)", "value": "72a759a56a7c0ee85f88749a44eb3c4c8b40b1c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675773, "uuid": "d94f3890-1e05-46b5-863f-13daf7871760", "comment": "Malware payload (Vidar)", "value": "4080876eb0670dc36743fcd78ac152a02cc2ffa0762532d4def02bdf783dd916703a5cff1653411d4f3451cda218913e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675773, "uuid": "8e04e09f-6d5f-45a9-87c2-728a1f625187", "value": "T1A8283343BC818599C469D63AC86A8252FBB5BC044F3177D77E40B6783E3BBE0553AB18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675773, "uuid": "bad1d95a-7212-44dc-bce0-c38cf4831bf0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675773, "uuid": "362ec1ec-c10b-4149-bf19-55677c5133a9", "value": "1572864:4Gk4VXw6bftEJ318/VB5HIsDbecpEY5OE6204Hx6kygc+W6ECVk3Riq:XnXP+cX5HXDbekm4Hxi+WMLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788675773, "uuid": "6017af6b-976e-40c7-b789-29b4c47ed6f0", "value": 98996592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788675773, "uuid": "2be29224-c18a-4ea9-acfe-9aa7d9c17431", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675773, "uuid": "d670c284-255d-4c9b-9d10-8f6958779312", "value": "b5f7d1d7e1ebc9dbbea74f2544bf99be9891b6925ba0c2d9f56f68170328f9a0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02bd0c3d-aa1f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718559, "uuid": "dd1ba791-b55c-4633-adf7-16e1e82cacbe", "comment": "Malware payload (Mirai)", "value": "b59be98ba0e9128f3195f63a9ca7ea14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718559, "uuid": "6cdbf2bd-b936-4d2d-ab02-bb59d73d5066", "comment": "Malware payload (Mirai)", "value": "b6ec41f42082fac1acbfd4c01ab7ef24b45368deb79d0b1a3b0e86f773b8f106", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718559, "uuid": "063099bb-8d23-4910-bbe4-f1ba6079b5ad", "comment": "Malware payload (Mirai)", "value": "52e474340dd3f1e782f598eb2c92341463db1168", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718559, "uuid": "ddab124e-d0d0-42a9-80b1-0d95c9163240", "comment": "Malware payload (Mirai)", "value": "729ac3b1f126294b072f724005fcbc74ca3e6aaf0b9ad159c7179ed29ffe92fd092590e47723eca76818b7c6ddfa0a14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718559, "uuid": "9dac6047-cc52-4269-ac2f-fa6874b4251a", "value": "T17DF44A45F841AB26C6D136BAFA2F424D732747A9D3EE71059D2447383BC796A8F3B201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718559, "uuid": "fd3f8423-7ebc-4729-9144-6520c8f80add", "value": "12288:C0bGQzlnWMf0hbcCNisG85n33P6UxggXNwOjpV4LIqaaUN2bw+IN4Py0:C0bGSWMf0h8gdwmwfWqw+q4Py", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718559, "uuid": "b329ed5e-dbce-419f-86c5-07a6219f4500", "value": 731068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718559, "uuid": "35649963-82de-4ef8-9166-17e496f4cbea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718559, "uuid": "2d171226-1382-4071-a6df-604ff93ed6ff", "value": "mirai.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c66392b-aa2d-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788724749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724749, "uuid": "fe32e578-f846-44bb-8d79-401c0e19a90f", "comment": "Malware payload (AsyncRAT)", "value": "57566bc0003ee4be731e2d585755a489", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724749, "uuid": "ab6bf088-9459-4ee6-b5e7-8e9e28b7dd67", "comment": "Malware payload (AsyncRAT)", "value": "b6f9fc16a92bb2e422f20db1a4c32018e070a20d50adde6742cd066b0c9aa870", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724749, "uuid": "f3e76cdf-206f-417d-a5a7-1efdbb09710f", "comment": "Malware payload (AsyncRAT)", "value": "8547fb670fb27b98b25a20e8a4c2ae5bae563bd2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724749, "uuid": "b6a92917-5ff9-4e1f-bba4-77019edc317c", "comment": "Malware payload (AsyncRAT)", "value": "b9568b679a05521dba0ade73f436aef4f7bea15a4b86da99c02c0ed2d65239f30f36c2f714a78fb0de6cb06bfb56035b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724749, "uuid": "450a799a-e09c-4a92-bc2c-6546f022ddd4", "value": "T1C4937D007BD88529F6BEDB38A8B2434507B5BD576802DA9D0DD439AF0A737C099067FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724749, "uuid": "96de19cc-8e50-4d9f-9d03-3f1a809cbdd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724749, "uuid": "c55c9b07-6bd0-44b5-b62e-a32ea4395ca7", "value": "1536:uffVRqlAkAqN4z/klApuDv1EbDsB+r4qthvddR8V3wDu3Y6Uk9jg+rr6GbOsKpeN:uXjqW89NDNEbDW+UqtpnPDud7r6GiX8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788724749, "uuid": "ce350461-20cf-461b-8c8a-16cda506f93b", "value": 92672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788724749, "uuid": "3e91f8fd-23e7-4927-bec2-63fa321fe758", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724749, "uuid": "7d17b122-7004-4f2a-9ea5-657d6a7b78f5", "value": "from_kiwi_okvip_with_love.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17540dea-a9c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1788677791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677791, "uuid": "79d82622-0c42-41c5-8ec9-4c9f598ecdc5", "comment": "Malware payload (SalatStealer)", "value": "23e81c0ecf3e241baf6c7bcfb63af0a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677791, "uuid": "4e26c772-fa24-411e-865c-f58c67e0e738", "comment": "Malware payload (SalatStealer)", "value": "b7296d12b4f455e6063c72f3e3355e7e29c2b3c8b613074bc74d9da119fffdf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677791, "uuid": "5df8f8b2-b66c-4fa3-97d4-f9526bc5e919", "comment": "Malware payload (SalatStealer)", "value": "174e9cc0f830ca5d05cd6f86a13837dfaad39133", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677791, "uuid": "3a7d376c-c78a-42a4-a2aa-da9bffe46f0c", "comment": "Malware payload (SalatStealer)", "value": "26e3c85167bad0b07a7abb2a7981696bc7400737ee45c422c1c1396e14a2cc35a2e984000159269c2b14496236270452", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677791, "uuid": "31d5ebd7-b161-40d2-8c4f-179db6c250c8", "value": "T1B1F53313328FA9B5E025B1B331B570C8938A87C3B9435DE05ED6AEB4A61BF3343569D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677791, "uuid": "45b54eec-8abc-48f3-b505-d47f4815c07a", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677791, "uuid": "36ee2ea8-0dcd-4885-b913-30afcdcdbbef", "value": "49152:r8K9ESpWUH+JQpqn6UKUDlScqvYCuUsu9FDWUD0AHpLPxp8lIqbntcZc/6XfIQn8:jG0vegqn6LGljqmUsydPAPS2sIQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788677791, "uuid": "46c4b234-4a91-49be-8126-7b18c19128be", "value": 3592192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788677791, "uuid": "f0c3cae5-a6f2-4650-a1d3-033020bf96e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677791, "uuid": "20573927-89a5-4a6f-8de0-4aa9309d4d0f", "value": "liv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb27d875-a9bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788675918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675918, "uuid": "7e5bf355-0a81-46d4-911a-94896cc4bf04", "comment": "Malware payload (Vidar)", "value": "6c6d5e8d54ded30b239e07f13c8076e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675918, "uuid": "cd92ec02-cb89-4590-a991-0855204fdf65", "comment": "Malware payload (Vidar)", "value": "b85c30396a616272976efbab3d8ded686d29639c43b5c9d459483d856c892545", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675918, "uuid": "74bfb305-26a6-4ccf-a848-a33197a662bc", "comment": "Malware payload (Vidar)", "value": "f5d3560e9e23192b67988147c21bdb75a3491a5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675918, "uuid": "ee61cb19-5bfd-4dfc-9225-c433ede5a328", "comment": "Malware payload (Vidar)", "value": "ac5a9ef3f09dc80d89404e2b22b8289739a9f046feca5197238717355c4fe72aadde59a212ab7d5bb0c25b11248b20e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675918, "uuid": "8d424cd8-ccc1-4774-927b-bf3edc4a22e4", "value": "T163283343FC9484A9C57AD67A89668252FBB4BC040F3177E77E11B6782E37BE0113A718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675918, "uuid": "b2e49666-681b-4dca-9a70-11320e3264fa", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675918, "uuid": "4665d17d-bf89-4a88-a92d-cfda4fd86f0e", "value": "1572864:4yO1FBKmXkRf24jjhxmNAQ673byasNOIggz56ut55NklVMGX11CKqzuZvQ:Z2bKDRfRji6ZsNSgo655C1w6ZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788675918, "uuid": "de54522b-7930-464d-9e8b-a38c52f9f829", "value": 96899440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788675918, "uuid": "caa34960-37e5-491d-b91a-2f966c968140", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675918, "uuid": "897d7a52-1577-44d0-88f8-87160208766c", "value": "b85c30396a616272976efbab3d8ded686d29639c43b5c9d459483d856c892545.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ccce0dc-a9da-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788688994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788688994, "uuid": "deaf45ba-7f93-4f75-8a24-1cb7c5541c93", "comment": "Malware payload", "value": "3b76fa45781a61cdc135f648433f0e8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788688994, "uuid": "928f23fd-cabe-4b03-91a7-14e738a28b9f", "comment": "Malware payload", "value": "b8c39ef80596011b98ab2476043ae979367580832888716d2fc624c989934e4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788688994, "uuid": "bfb425ec-7abc-41e8-a5b9-7e46a02c2428", "comment": "Malware payload", "value": "3fc361846fa7635c1a007c567f74c8bdfecc0ac2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788688994, "uuid": "64eed86d-76ff-4304-ade6-bef93605e2e5", "comment": "Malware payload", "value": "074ed44b88109bb7b687efae27ed57019c0dfc862680aaed83335415dd0ff2bf48dcbafbf9af347db4ec646e489de488", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788688994, "uuid": "16772321-1567-4f88-9fd8-7ed61544ae4e", "value": "T1DCD5239E79F61974D87BC3F68F82F43DB02D3B814A218E977ACC56404E21AA46C39735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788688994, "uuid": "48d6b43a-7d0c-4d7b-a628-a6eae14e882f", "value": "fe230628262faec735b6f015758b7519", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788688994, "uuid": "c0ebce39-19ad-4e50-9026-e2209232ad5a", "value": "49152:mhiVvz96+afgUc/MBbqGqCQEJkNb/6I+H//T0T6rXqmhcWT3SFJ6:m2A+anAAb79JoSI+H/o2rXTcS3SH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788688994, "uuid": "57460b27-443d-446b-835e-540b96632f7c", "value": 2953728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788688994, "uuid": "13d44308-6460-4e74-8db5-74c74a8c1ed5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788688994, "uuid": "7990911e-9dfb-4582-986f-a035973ac507", "value": "b8c39ef80596011b98ab2476043ae979367580832888716d2fc624c989934e4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b6519b-a9c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788680234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680234, "uuid": "41d0460e-7d1f-48e0-a9b2-88ba67626c53", "comment": "Malware payload (Vidar)", "value": "84be66381e01699377f98b486abc3bd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680234, "uuid": "56a16bb2-083b-4d3c-98fa-e4c9b458eec8", "comment": "Malware payload (Vidar)", "value": "b8e4dde0ff9acada30152b31e014d564ffe35ab5d30678113e6a5a511dbc3b53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680234, "uuid": "52ff9a8b-072c-4857-b334-ef70f51c43bd", "comment": "Malware payload (Vidar)", "value": "2d0736fbca07fccede2b7499032aaf93d728dfa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680234, "uuid": "8b0585e2-ed7b-4de6-bcf8-d1e7f2f46ebe", "comment": "Malware payload (Vidar)", "value": "8119c9b1a916fcb49c145ace3f8f71d4b8442193fa2f6bb716240bff08928b3a40e3b1f427e1c5c61ce7c4bb2ee016db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680234, "uuid": "88e18cee-6b64-4bb1-8a66-ae9419eaa504", "value": "T1A0283303689580A9C4569B35C67F2626AA75FC88DB3173E33E44BA341F76BD27CB5B00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680234, "uuid": "161c523c-eeb8-4419-9e0c-315eab541564", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680234, "uuid": "8b427375-ad79-425d-8348-55297643adf3", "value": "1572864:im2B+YzntAl2/aaPidpcNYkZ+6MQP4LeKqF1FhLc7uOTh4UzVPYCBJvV18Wb:92Blz0aqdpe+QrKGPJ2VbYCj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788680234, "uuid": "66a213cf-cd11-4a50-bd76-b2f8397a3213", "value": 98873760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788680234, "uuid": "ab8d0f8f-1793-47fa-9567-eb71d18fc618", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680234, "uuid": "34c9e98e-b3b3-4795-953b-3439b9df86b2", "value": "b8e4dde0ff9acada30152b31e014d564ffe35ab5d30678113e6a5a511dbc3b53.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3510e67-aa1e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718533, "uuid": "eed1d404-4bcb-4423-9775-3ac9cf08c38a", "comment": "Malware payload (Mirai)", "value": "5a519aa1a37be075b6740c818cfbf3d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718533, "uuid": "f92d81b2-fada-4ab7-816a-9f592021d0b7", "comment": "Malware payload (Mirai)", "value": "b9cc33b49ba30d93ff85198cf94966830a65bfa343cc1bd195629ad3f837bdde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718533, "uuid": "29ca91f7-14d8-4b9b-8955-d0451bb06ca0", "comment": "Malware payload (Mirai)", "value": "df5c03ab1ecadcf4f1113b935ce42d44091bfa53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718533, "uuid": "077cf54b-f928-496b-aa11-bb48da260df0", "comment": "Malware payload (Mirai)", "value": "44d305247e5164b913799bedf96eaf4f7dd0f9400eebfb7e0d02df3dc706d1a16a52c8869ec140d74751035c23f0a797", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718533, "uuid": "cbefeec8-a949-49ad-96b8-93d1d9283101", "value": "T132D36B17F687F2B0E0520C722326DB7A5631F9344111C88AF7A43FB5EDF56858A0A76E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718533, "uuid": "df0c9741-e800-44fb-82ff-16dcdb215f6a", "value": "3072:kWpzREcgsGKNuy59zH197RS/SzW5GiaTsOqPkRITy37jcn:rhREQGKNuMzVF8K15gk+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718533, "uuid": "9e63dd67-35c5-46cb-be2a-35aab954a0b3", "value": 132652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718533, "uuid": "64b70512-c8fe-44d7-bf4f-67336176b0d3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718533, "uuid": "5b2cb89f-5190-43d4-a2f1-394ece2b596a", "value": "wj0s.i686-dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01331cea-aa25-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788721133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788721133, "uuid": "17bdfc53-ddc0-4788-9bc9-2fcad6b3da7c", "comment": "Malware payload", "value": "53e09b4acaed09754ef3db56bc0067f9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "credential-stealer", "colour": "#7B6F8D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "firebase-c2", "colour": "#75CD01", "exportable": true, "hide_tag": false }, { "name": "india", "colour": "#1F00DD", "exportable": true, "hide_tag": false }, { "name": "PNB", "colour": "#1CAFAA", "exportable": true, "hide_tag": false }, { "name": "sam-panel", "colour": "#3E822E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms-stealer", "colour": "#84A8A5", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "telegram-exfil", "colour": "#68BEFE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788721133, "uuid": "c4ff9732-7d5f-4d5e-ab83-b1a80207cf4d", "comment": "Malware payload", "value": "b9fd307d5a43dec31b053d3061920cfe73935900482f95049bbe6fbdf022aeb9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "credential-stealer", "colour": "#7B6F8D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "firebase-c2", "colour": "#75CD01", "exportable": true, "hide_tag": false }, { "name": "india", "colour": "#1F00DD", "exportable": true, "hide_tag": false }, { "name": "PNB", "colour": "#1CAFAA", "exportable": true, "hide_tag": false }, { "name": "sam-panel", "colour": "#3E822E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms-stealer", "colour": "#84A8A5", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "telegram-exfil", "colour": "#68BEFE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788721133, "uuid": "1998a456-ddca-4835-9742-e905dce2bb65", "comment": "Malware payload", "value": "a5a1029f93d2d8824ecd041e1ca5622b5f189c75", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "credential-stealer", "colour": "#7B6F8D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "firebase-c2", "colour": "#75CD01", "exportable": true, "hide_tag": false }, { "name": "india", "colour": "#1F00DD", "exportable": true, "hide_tag": false }, { "name": "PNB", "colour": "#1CAFAA", "exportable": true, "hide_tag": false }, { "name": "sam-panel", "colour": "#3E822E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms-stealer", "colour": "#84A8A5", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "telegram-exfil", "colour": "#68BEFE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788721133, "uuid": "91b967d8-93c1-4c47-8085-dcf02b1dc0f1", "comment": "Malware payload", "value": "f4c53460fbefffac7faacd9539c9d402cc52289dc4bbfae31d62ddb43e67c9473a54cd3b5c9c5dca7d625dc54b5eaa47", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "credential-stealer", "colour": "#7B6F8D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "firebase-c2", "colour": "#75CD01", "exportable": true, "hide_tag": false }, { "name": "india", "colour": "#1F00DD", "exportable": true, "hide_tag": false }, { "name": "PNB", "colour": "#1CAFAA", "exportable": true, "hide_tag": false }, { "name": "sam-panel", "colour": "#3E822E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms-stealer", "colour": "#84A8A5", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "telegram-exfil", "colour": "#68BEFE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788721133, "uuid": "843e7362-2f4f-470e-b5b0-979374e237b0", "value": "T1CFB63310C523BD01D9075DF822A959A37E62CDD683989BCCA255E3A8FFFD124185C2EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788721133, "uuid": "9d75bc69-5e8a-4f50-9630-570cc2224b3f", "value": "196608:e1TJCdTZFUapjDdjCOc0v9f0lC0cS+1Ay/t9DmxWcjp+T5vKE1cw8rkNgNB25Fc/:e1GTZdDoE9fn0cNj/3akcd/S7IkNgNBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788721133, "uuid": "73bb2bf1-04cf-460b-803a-ed3a5343e6df", "value": 11098134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788721133, "uuid": "43e6d731-5f7c-43d1-abb5-9ce58dfe588b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788721133, "uuid": "c90b0e5f-3913-4aeb-a184-02dc7431c2b7", "value": "wrapper.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d1d1c0-a9bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788675728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675728, "uuid": "e8f74b6c-74ac-4154-8231-8c3a59ee47a1", "comment": "Malware payload (Vidar)", "value": "13217093db647aaa85a1db7c417c7b6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675728, "uuid": "d1919094-c260-40c3-b3e3-fb569a424b04", "comment": "Malware payload (Vidar)", "value": "b9fe4eb683f73621bf55f2161860b8e08af16238961e8948001a4b3c97862396", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675728, "uuid": "ef2be62c-e59e-4d29-a815-934a3505f2d0", "comment": "Malware payload (Vidar)", "value": "2fa012dc5d5287bebafce71773736dbe7a38fc70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675728, "uuid": "256355b1-6529-4700-b3e2-1a5298dd9b43", "comment": "Malware payload (Vidar)", "value": "8d9644b5a00dfc5578c7583bd8e227fdb3a484cdc572c4d074e5d4add493da7cff8cb6b324b3a6e10930f364192207cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675728, "uuid": "841c4e3b-d7df-42d7-b720-86e6d1468cf9", "value": "T1DB18330B689680A8C49A8735C67E6252FA75FC88DB3177E32E54B9341F76BD13CB4B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675728, "uuid": "c873b4d1-742f-47b9-aa2b-f555a11bdef9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675728, "uuid": "8257708c-1450-4e33-8ca9-3bea8974c6e6", "value": "1572864:imUtGpU2MCj/Hq8QvjSXwWXaXa20C9vYmLOt6KbuIpYhqbmxX2q1jMK:9UyMCz0LSXwwaXa7EvYmiMIuIOhqqxX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788675728, "uuid": "07f8ec11-684d-4ea3-a9e3-9f663aec2949", "value": 90485152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788675728, "uuid": "5341a0ca-e4ec-4352-92a3-4c76e7f43774", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675728, "uuid": "40c08bb8-9c6f-4d46-97f9-7aeeea3bdf16", "value": "b9fe4eb683f73621bf55f2161860b8e08af16238961e8948001a4b3c97862396.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275f9807-aa19-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788716043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716043, "uuid": "a33eaef4-a8e0-4c26-8022-7151a3e99f5a", "comment": "Malware payload (Mirai)", "value": "d3fcc34ebcc678840d5db7ad4cff1cc0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716043, "uuid": "5f3884f5-19b6-4378-b3c6-f61bea45d823", "comment": "Malware payload (Mirai)", "value": "bbf510397df62189791b2b3d8d1b16b90c5d5ddcf224fc6e2afa13436b5b92b1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716043, "uuid": "3ade8632-4e56-4ee2-9608-6a86b1023778", "comment": "Malware payload (Mirai)", "value": "dc12b3b6c04990725ce395d143f1984ef4f34100", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716043, "uuid": "fc9cc517-9dd6-4b0a-9aef-6ce1ee3e89c4", "comment": "Malware payload (Mirai)", "value": "ba789ec21311928acde56b0ee33e3682dc205427f82e1f2ff1d28be62290a6d49399a8c61c7ed613cc420ae0e3642fca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716043, "uuid": "cf46f2ff-fd11-404c-8af9-e2444cd60c61", "value": "T163933894B8419B13C6C612BBFA6E428E372663E8E2EB3213D9215F2137C756F0D77941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716043, "uuid": "482c9a3d-1ecd-4800-b419-60761169ca4c", "value": "1536:AGvMOjmOItNB8ny3D5wxroRiDkronyd7vdnQYv5H4uGGR1JKvvs28:AGUJtkyYEE/nw7vCYvN/wns3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788716043, "uuid": "40aed3f4-85d6-4ffb-b23a-86bd7315cda5", "value": 95764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788716043, "uuid": "56c244c6-46cb-425c-9106-9c170c66e020", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716043, "uuid": "a805bbc5-d82f-411c-983c-c3212f689848", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16a80c7f-a9ed-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788697117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788697117, "uuid": "1a0211ca-a3b4-4781-b5ff-b2d8815121b0", "comment": "Malware payload (Vidar)", "value": "145036f17f5949a7b336e791fd40b89b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788697117, "uuid": "c8ca095e-6a56-4709-bd97-46074ccc7b5c", "comment": "Malware payload (Vidar)", "value": "bcb14670733753d21ade4cd764835b9eba779f023e7ccb03d6b6e64d94e1a151", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788697117, "uuid": "31eea891-b258-4def-8697-222c5e68afe5", "comment": "Malware payload (Vidar)", "value": "be2debd2fee670cc3bad25fee871decd3bf56cfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788697117, "uuid": "bbf25154-481a-4a68-8ad7-ecb47cef563e", "comment": "Malware payload (Vidar)", "value": "a45fc7c466ed4d9cdb2efc5028d32b9dbc468e72e2ef5299e176f5f7a50c107f2587323a53114d91514918c92e96141c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788697117, "uuid": "ba4f7512-aee4-4251-b1f7-6de4cc2ac900", "value": "T190667B07789941E0D89A9F38C0BB9213A655F8CDDB3A32D71D50A2742F6A7C17EF6B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788697117, "uuid": "5dc2d8ce-7bbe-4135-ac3d-3ba408741707", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788697117, "uuid": "f7ce2779-1c34-4c91-bf36-b9a535a0dfc5", "value": "49152:2+5UfcTNry6H4Bdnh08yX2o7iKkIQYr/lPGN2x3+peS8pNCS15HDlQtn0QGLlWs:ZoNx2tmeSo/5jc0QgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788697117, "uuid": "cf2aebe4-1c95-4c98-aba9-7ae4ddd73520", "value": 6870928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788697117, "uuid": "70b41054-d979-4893-8701-6c94d64f12aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788697117, "uuid": "5e2612b7-9763-4a4c-98ac-c0986b769d62", "value": "Sancci-BootV2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d332e291-a9e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (MythStealer)", "timestamp": 1788692709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788692709, "uuid": "6e77fba4-f1d0-4107-b2b8-0e8facc4fd84", "comment": "Malware payload (MythStealer)", "value": "8cde6d916b90f261ea981529d7417d3e", "object_relation": "md5", "Tag": [ { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "MythStealer", "colour": "#562656", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788692709, "uuid": "2c79829f-8054-43ee-94fd-bff6089ac4c3", "comment": "Malware payload (MythStealer)", "value": "bd4eb81a12526daa040ceccc14135006dfd9792e7c21ec5fab9c2cb0400f6718", "object_relation": "sha256", "Tag": [ { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "MythStealer", "colour": "#562656", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788692709, "uuid": "0c9e79ff-8d10-497d-907e-8f6fa6f9d470", "comment": "Malware payload (MythStealer)", "value": "8619e69da1f0920aa5fe850de2d6c4599f2f1f29", "object_relation": "sha1", "Tag": [ { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "MythStealer", "colour": "#562656", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788692709, "uuid": "302cc0eb-6e40-4bdb-b458-75c937f84022", "comment": "Malware payload (MythStealer)", "value": "ce30cb5a2248dadca0b8fad5c5de5345805072b29fee464c110f41d7c55385b689de702f04dcd6018ba71338becb8415", "object_relation": "sha3-384", "Tag": [ { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "MythStealer", "colour": "#562656", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788692709, "uuid": "c060694a-be81-45aa-9f61-a9db7994c3da", "value": "T1FE873313D6BFC435C63B98B350C70305FA221295DD1BD27F13F868914EA6AD60BB1BA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788692709, "uuid": "a8532216-a8d8-423b-8499-d4b53aefdaac", "value": "786432:GTjtg0jdHKbEwQd/mmqopWZGkzVxikYUpxxI6n+zfS/5Q5sEdgqx8OjP:GHfHKbEwQdumqopW5zVxikYEQhf8eRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788692709, "uuid": "16de2baf-e7ca-46a6-adb7-cee99ea97b49", "value": 36324338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788692709, "uuid": "f7934de3-b8f1-4c39-8081-fb4d55dace2c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788692709, "uuid": "bf9b7cf2-2a2f-4285-8d65-50c328b52928", "value": "client.jar_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c849f6-aa2b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788723934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723934, "uuid": "29fef26f-8ce3-46d4-8773-ec5b67acd2ec", "comment": "Malware payload", "value": "388b9fdaed3877ff39ee9a24622b3f9b", "object_relation": "md5", "Tag": [ { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723934, "uuid": "40b0e8a5-2367-4495-a0e6-90d1c076512e", "comment": "Malware payload", "value": "bd5976c72f95a7cc2ff2f54ac1376cf608305a097561c1fa9ecd06ab89047a1f", "object_relation": "sha256", "Tag": [ { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723934, "uuid": "26f82c48-4706-48df-84ba-eaf0c1a045ed", "comment": "Malware payload", "value": "fb03c005df2719dcc4c803913a28e9428be6274c", "object_relation": "sha1", "Tag": [ { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723934, "uuid": "bdfa9aca-8eb2-40a8-8dc2-393e67cd414f", "comment": "Malware payload", "value": "c13cc4cda90d48364b6a9a48d67659e1da07182d5b861d2d39645a93c3253db1dc3bafc12161309a35e5619266c3e72f", "object_relation": "sha3-384", "Tag": [ { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723934, "uuid": "4cfc244f-3c62-4cb0-bfce-67620d3f421a", "value": "T17081446FFFBCD3330453408361B6E93AA4162B97295078868A5C87A91A707B3E5E1589", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723934, "uuid": "b4fa8c10-2d6f-45f5-b876-2c42b652a014", "value": "96:E+eDXYvNcxsrhdPFzV/x8HsrEzwzsC8rakuCSgO0cUmomIL/LL1cLXSW7Nk5ULP9:/cxsrhdPFJ/x8MIsMrakAgO0cPbI7LhY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788723934, "uuid": "4eb0c960-8ca8-47f9-9424-076ebb4ec8c5", "value": 3952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788723934, "uuid": "cd300888-feb2-4d37-8cb0-e86aa3a8d371", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723934, "uuid": "676ac9c0-21e6-462d-a22e-5ba48ad37d05", "value": "script.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8288e7dd-aa01-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788705888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705888, "uuid": "171406dc-a26a-4569-b2b0-2279f8448099", "comment": "Malware payload (AsyncRAT)", "value": "427b859b3f5964071bbbd958b5edc286", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705888, "uuid": "b42f73bb-aaff-4ace-b1e4-974a82b41bc7", "comment": "Malware payload (AsyncRAT)", "value": "be53d6c09079555c7a098a73908692ac8373ef4be31e5f230495c03b6ac1c9db", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705888, "uuid": "d73ad2e4-d903-4c54-ad71-90b5051529da", "comment": "Malware payload (AsyncRAT)", "value": "134592b75872d6d7eb9d950813f25b93e9fe52b9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705888, "uuid": "432b5e9d-ab08-4a16-a24b-91c1cf511510", "comment": "Malware payload (AsyncRAT)", "value": "f2012bae126f474b582ba4c4489eb807435293aafb934bf0378f6e2c12ee6c15e2ca32d179e73963839058ab4bf1cbf9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705888, "uuid": "8e091dca-af93-4ede-835a-80e0ab85ef92", "value": "T1A3C24C0873E4C572E2FE0ABAC83385009775D55B9913D76A6FC890AE2E237CD8A14FD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705888, "uuid": "31f49e6f-7e4a-47f5-be7d-49878199a0c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705888, "uuid": "d7664a89-ea09-4287-8289-02e541b52787", "value": "384:4N3SaTSXW9bVWwSOsVa/KFHbxiH9qbuUsqbQxnCJfJBndnjJkKeg+:4N3SaT5K1VDHVgIbwBiBn9eg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788705888, "uuid": "eefe0a10-2a1c-4e98-9d24-458eff6c9811", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788705888, "uuid": "be259fc9-a74b-4109-920f-da40f91ef0cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705888, "uuid": "1e898d7c-c47f-4cf8-a9a7-6e7a4c0a2621", "value": "TK88APP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa7ae9a6-a9bd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788676884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788676884, "uuid": "f603a463-0305-402e-922c-877f54d64b0b", "comment": "Malware payload", "value": "827b71c5d01c4bcbf881352a81bc5219", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788676884, "uuid": "23e820ad-5027-46f7-96fb-ccb7b5629853", "comment": "Malware payload", "value": "be9558150e4d50b188909b1eeb1bb053845e9d2b13c9eedefc682831ca777242", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788676884, "uuid": "2429f278-0fc7-42b9-b85d-6ee1497069f2", "comment": "Malware payload", "value": "7faaf9bb502952c25e4d68a015548d80d1e58c8b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788676884, "uuid": "2cc709bd-a3b1-4d5e-b2b8-bcea889de3b0", "comment": "Malware payload", "value": "265a0927318088e4f283be6695f35746d5eba8bc7a41a3392036d1f6842863b9c105a0571461e5062a0aa05f9c9bc98c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788676884, "uuid": "d7b0f31c-2fc8-4c53-bc22-a8e13e06f667", "value": "T11B3186B1FCA99335A49E44387E7E828EEA45443F342378D4326B763160599F4E0D84A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788676884, "uuid": "af05929e-a37e-4827-aa77-f4797e1c1cc2", "value": "24:fDFzzwcrzvDwSeWCXfU3w05Yq5lZDbw5lE9utnRRILgmVukB0UUH848Keyf785td:twcTNeWhwFq9sAWPHLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788676884, "uuid": "b2228b8f-3296-47b8-8e20-61982158bd8f", "value": 1835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788676884, "uuid": "20f90b65-0c94-430a-8ee8-3593e5a8fd3f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788676884, "uuid": "587c5ff5-e378-434c-afe7-1262bc1a7d21", "value": "setup.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2cca593-a9c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788681461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788681461, "uuid": "46552137-4a50-44a1-8913-8666960cd13d", "comment": "Malware payload", "value": "d9baaea2720a6c18ebe04c234073734d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788681461, "uuid": "ee231a7f-5b8f-4fec-96ac-e45fa1c1fe5e", "comment": "Malware payload", "value": "be9a9c68f05283ad23f38395c24130f7476b2a0d24e5fbcb9eb0cefbf4e71253", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788681461, "uuid": "1a86f951-70e8-4768-8731-e8d02073cd7c", "comment": "Malware payload", "value": "dd12c24ea53500cfe191ed5e79029953814fd6af", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788681461, "uuid": "67822b18-2a34-453c-8520-f7f6b2d6784a", "comment": "Malware payload", "value": "516c30ceae8378de76dbed4a847abe118b6eecee4c36d832d207ed9d590e426fdfc1d0c8551a78a1955cb4501321827e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788681461, "uuid": "78299a75-8e3d-45da-a3b8-f7c1098c660d", "value": "T1293156EE05601A311046CD9E77E2301DB3CEA1F72C5BD7D4EC094FE98288688F2A1B8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788681461, "uuid": "9d82053f-3c08-491d-8329-80181fe651f1", "value": "24:V6KBv9v56UU8cVfTCCCQILJX7oVQ8pVyK:km9UUoVfmbQEX7oVeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788681461, "uuid": "89405511-a07b-480b-9d78-f68dc7a3ea57", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788681461, "uuid": "17684b47-cc98-4fdc-a947-632f9adb1a0a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788681461, "uuid": "c47944cc-51f1-4cef-8621-47e9b888069d", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de88921-a9e9-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1788695465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788695465, "uuid": "0a904dad-0247-44bc-9373-87c7ddc9a986", "comment": "Malware payload (SalatStealer)", "value": "0b34a14bfaff3b4da4b4d5130811aad7", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788695465, "uuid": "8a1700fb-4c52-4f7f-a163-39dc4412acef", "comment": "Malware payload (SalatStealer)", "value": "beb6c8932196b0ca9c3c71b2a394feef961b281caf386758a684b7be1fe68650", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788695465, "uuid": "8d7f3b98-b0f5-4991-a72d-aa0813515ac4", "comment": "Malware payload (SalatStealer)", "value": "c2a3380ac33c2c3bf90b7eef04c60e9e16ef15a4", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788695465, "uuid": "964ba50f-f8e8-411e-871f-929561172456", "comment": "Malware payload (SalatStealer)", "value": "a2fa216615b7cb3f321e573dc28ef83fef203342a499d72f2bafd28ac6b617906090ec126f649ab17f817fd4bcd714a4", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788695465, "uuid": "97096cce-9279-44c2-b8ce-9474e91762eb", "value": "T1F746F1077FAEB45ED97B97B0846DA3608620FC370C52845B75CC58965F5BB003EBC2AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788695465, "uuid": "4ce3ba79-e1e7-4bde-a8e5-e0d8c69fc9c7", "value": "11bc17e556193a41b17d904c7d7dbe54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788695465, "uuid": "1a2498ec-8399-4043-bf17-c47d6040196b", "value": "98304:fl44jX64mimnAjTbviEr8M0csd6EUsZdzGEnwVCYd/HT56aNl06zkfUN:feimn8bviEX0cs8AyEnwV1Hl6afdzkfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788695465, "uuid": "019c5f30-1411-4468-a630-b12812876c3a", "value": 5439360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788695465, "uuid": "98de0a11-952a-4815-8bd8-f4b0c6a15782", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788695465, "uuid": "f979d28a-3e75-4b60-9f53-7f0eb8853bfb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d256224e-a9e4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788693567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693567, "uuid": "ccbeca07-72fb-4c65-91f5-571d49aea47e", "comment": "Malware payload (Vidar)", "value": "dcd1198ebf6d0337c1eb8c23084fc466", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693567, "uuid": "f24d88b4-e4ac-485b-941a-375df9452b2e", "comment": "Malware payload (Vidar)", "value": "bf1bf5d10a8df73860922cf0441505c8a79e014a4801e77a5af5d4ae94f9605a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693567, "uuid": "d115831a-794e-4c30-acb4-779ecc639157", "comment": "Malware payload (Vidar)", "value": "68c4b8af6ed3a5707349f52e6c2e05f3237d40b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693567, "uuid": "c7df7faf-2daf-44fa-b0fc-83c73813ac73", "comment": "Malware payload (Vidar)", "value": "255d6019a7c768f3c6303c0696bdf0ab86edb78b2f676af92bfbdd9d308e62ff2f75a4d736cc7331410f8865f2327095", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693567, "uuid": "90be9273-ec0b-4513-8399-3215bf5839f3", "value": "T14028330729A590B8C0978B71CA7B4666BA74BC98CB3177F32E54B6702F66BC13CB5704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693567, "uuid": "5dc484d2-c342-46d4-b324-c313f86faf8e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693567, "uuid": "3c6e5402-b5dd-4675-8c7d-c3b6ba3575d8", "value": "3145728:RP4u04qoF+5x2EIEpPQc1RScw6PC2e54A:RPgMF+5x2EppYQccNPPYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788693567, "uuid": "7b9c5d94-a5c5-4be7-ac45-a38db5e0d3bd", "value": 100990888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788693567, "uuid": "b1db2036-07e8-4353-8673-969e48c8d697", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693567, "uuid": "4faaff8c-9f95-4008-930a-c6e6b6142677", "value": "bf1bf5d10a8df73860922cf0441505c8a79e014a4801e77a5af5d4ae94f9605a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6b254b5-aa00-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788705573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705573, "uuid": "7b153bff-1553-4b57-97c9-01c96eb1978d", "comment": "Malware payload (AsyncRAT)", "value": "8e443090226ff1c96097f8f7d3244a16", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705573, "uuid": "3eb9ddc8-690d-4bc3-b291-b2e6da28cbee", "comment": "Malware payload (AsyncRAT)", "value": "bf4971bdab54fabdda136b5f03b93476256bbd6d35fe6e7947961b3d6a20aa48", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705573, "uuid": "f875fc1f-8beb-4d6d-a311-7eb947f81e60", "comment": "Malware payload (AsyncRAT)", "value": "d28c82edea3da8e598f8955950ea8bf46e6aaa8b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788705573, "uuid": "7cfae75b-08e8-4608-aa0e-89d0af8d66ac", "comment": "Malware payload (AsyncRAT)", "value": "f2a39cace8e33ac52c932024450ea132dfecb35beadb0ab99336abc9f8f808a2b6573f8884fea65cf21ac506bd2414eb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705573, "uuid": "4035bf63-b387-4061-951f-95feec169c15", "value": "T1BC431B1037E88127F1BE5F7999F26141877AF6236913DA8E2C8411CB1623BC59D427EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705573, "uuid": "858e2279-e930-4e08-94ed-148fffaad5bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705573, "uuid": "14fadeee-1df7-4ece-b07a-2d3e4ad44b25", "value": "1536:pDjzbxoVZi8rvDoOqwldtsQUbcHdeKvckr7pPx:pz+7oOltZUbc9eKv/7hx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788705573, "uuid": "7f62ce39-b929-4046-8b0a-5d1f584585a3", "value": 56832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788705573, "uuid": "52380a38-7793-4888-8af9-5356ac8115f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788705573, "uuid": "558f9d78-a98a-405c-b0bd-2a61b56d8a94", "value": "Telegram.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c22316-a9e4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788693499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693499, "uuid": "54fe4d1d-38c9-4458-ad39-fa8ee233770e", "comment": "Malware payload (Vidar)", "value": "edc21e3aef3e860d150589f476fb9737", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693499, "uuid": "ca278e77-ba5d-4479-9bf0-acc90d86ead4", "comment": "Malware payload (Vidar)", "value": "c0623c52acd652d4d39611d7609786a224ab0380ff6a7c322319aca2e1b2285a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693499, "uuid": "dc3bce3f-1f3b-421c-8bec-b73278af7fe3", "comment": "Malware payload (Vidar)", "value": "202402897261f6686df27b1e573e8586de2ada36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693499, "uuid": "def0866c-a7fe-47b5-bbbb-179e8efaa227", "comment": "Malware payload (Vidar)", "value": "b9f8c6a471d0b6de7f559c52f3c7ef530f627d25431671613fb371a593d8ab9535c978da4e75cbb8c7581f7412f54fe7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693499, "uuid": "ea651888-b9b5-46bb-9321-a7098d2dc360", "value": "T1DB283307799550F8C58A8B71CA7A4266BA75BC98CB3173E32E40B6341F76BC23DB6704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693499, "uuid": "0f53006a-6b26-454a-bfaa-ceb82d07f5e6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693499, "uuid": "dbc3a4f7-3d05-4627-bdf2-9a39e8aa204f", "value": "1572864:NB5IQ64uCe3tKRpR0rKNzkNeGSQJruqqSXxRgdbJnQyx06J48SJvqjU+sDkyIIlW:ucpe3tQ0uUduTL1QO0W48SkyIajlKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788693499, "uuid": "673d20fb-232b-4585-9b8f-6152e7fd9d00", "value": 96796584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788693499, "uuid": "53a8e93f-8bf1-40b1-8353-5dfb8805288b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693499, "uuid": "f1aedcab-26c4-4436-84c9-9c372c1f07ea", "value": "c0623c52acd652d4d39611d7609786a224ab0380ff6a7c322319aca2e1b2285a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce1ac61f-aa1c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788717611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788717611, "uuid": "8f1b96b8-8aac-4a09-bb0d-6bf1c1f972bf", "comment": "Malware payload (Mirai)", "value": "b66697c8121a1b31b76612a82529fe50", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788717611, "uuid": "3a4ceca9-2d14-4d6b-9dc2-8cd83124e41c", "comment": "Malware payload (Mirai)", "value": "c07cc1803d7375bd9cd99096db4ed7b2abcb85f1beb142fb508bcf7d761b955b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788717611, "uuid": "b4f948df-51df-4635-ae26-fc38dffcbc49", "comment": "Malware payload (Mirai)", "value": "c960646e5550c37575684ec222d933f534b7fd80", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788717611, "uuid": "443da52a-a828-47e1-ac02-14a005effb85", "comment": "Malware payload (Mirai)", "value": "3e7e033d0f07f7ad248f69215496a55df05e48c39f8cf28e97f7925acae2a29472bcf6702be82ae1c742eeca55b736ee", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788717611, "uuid": "debd939a-81c8-40b9-9e85-dfb8563dc7f0", "value": "T19A54B70E9F710EFBE8AFDE3302E90652298C6516229D3F363674D528F549A4F49D3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788717611, "uuid": "855444b6-d639-4efa-a250-5fe3276d9063", "value": "6144:JM8eiLP/g9GY2SLWsZcJc7sLnfMp0w9DH3:13g9GW1ILnfyv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788717611, "uuid": "36095f04-1513-4dca-ae10-b2112e68546e", "value": 290044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788717611, "uuid": "9cecdd1c-44a8-4c91-8ed3-7479ca4d0533", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788717611, "uuid": "60c4d0f5-fcc1-4463-862c-e78843cfbb1f", "value": "c07cc1803d7375bd9cd99096db4ed7b2abcb85f1beb142fb508bcf7d761b955b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18efb13f-a9d9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788688531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788688531, "uuid": "48524247-0184-4053-a576-9ed6896f7b14", "comment": "Malware payload", "value": "e759e86596eeac93a89d427797d26a8f", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788688531, "uuid": "1b68eaa2-275e-49ee-8546-30bd2f4e8a39", "comment": "Malware payload", "value": "c08d449dd2d9c903e3f7051ca56604bfe3f3be86c1ac86f1173ebca57538b3d6", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788688531, "uuid": "f35939df-8784-4c72-ac9a-3660b4af093b", "comment": "Malware payload", "value": "ee2c484b54c937c932496d9b4cf81e921b963639", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788688531, "uuid": "a944682c-86c4-49f7-b229-64c4ff077d40", "comment": "Malware payload", "value": "65e2a6ef171f0a8e4afda9d77712fd76ddbb6728b94a4e123d9aacf8be9b8e785983e8f3f787ed683f9965d45d32d76c", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788688531, "uuid": "79afe40c-458d-4049-a5c4-519da129420a", "value": "T1A7F0544294A04D25523016146EC0FA055E9ADB4757497D48759651B94FC47C1CDCF87C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788688531, "uuid": "5965c384-9c97-4f2e-95ce-2a061a873703", "value": "6:qTIuJzhqIwGiY63fAbplilAl3t11/+SR0AqIbR2AWHwl0vV4LKTjawlauF0NAEdZ:qTp0JYyg9193R5qsPWrVeuqAEd2QL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788688531, "uuid": "186af045-b3dc-42bc-859c-43f8a80c6ba1", "value": 446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788688531, "uuid": "97e8ab56-8f57-423d-b75b-de6bf68df706", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788688531, "uuid": "cefbe09c-02a3-45e6-892d-9a5c192266b6", "value": "goodthingsforbestpersonforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f8b62a2-a9bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788675872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675872, "uuid": "d6fb32bf-1858-484b-ab39-2056f16b5413", "comment": "Malware payload (Vidar)", "value": "8ba0d6b34e938ba59d287a57bf1fdcf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675872, "uuid": "91683924-73ba-4925-a155-1b7c25db8dd6", "comment": "Malware payload (Vidar)", "value": "c0b081bf38620a95208ffe34f3783c67e8937acf37b013c7a098824fb7b55f7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675872, "uuid": "b1ca0ff4-baf5-44c6-ac6d-16680b1bb951", "comment": "Malware payload (Vidar)", "value": "09c6e7ca0d09ee1246542832c4d2c5988a43e4e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675872, "uuid": "ef9fc6a1-48cd-43c1-80cc-0ce127afda6e", "comment": "Malware payload (Vidar)", "value": "5834ce89d7a357ef79fcfcaa403c787d65c74959cec8197fcaf8abc74c9f9cf828cc08a8fac4c2e404ae81be1be68cbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675872, "uuid": "b13ccdf1-2793-440f-9d91-2c44fc6c7ea0", "value": "T10A283343FC5044A9C469D67AC56A82A2FBB5BC040F31B3E77E50B6742E37BE1513A728", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675872, "uuid": "15eba697-778b-48e4-8fd0-56a562dc1b62", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675872, "uuid": "f6f64f99-27a7-4845-8ee2-262c03f63a40", "value": "1572864:4HoZRsMk6oMweijhmQE3de6TbU/j3SGv65ajCNTrsINzI6EdaCDYZlKAqTa3J+rn:wovsD6D3ioQE3863m3SGvsaigINzIrdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788675872, "uuid": "907a8cf4-8b94-4973-b4ca-888546a557c2", "value": 96899440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788675872, "uuid": "18a67b8a-5158-402d-b4ea-06d9d37cec5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675872, "uuid": "4715a7e7-edb1-4803-902e-c744b9c00503", "value": "c0b081bf38620a95208ffe34f3783c67e8937acf37b013c7a098824fb7b55f7c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e176ed-aa19-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788716034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716034, "uuid": "05e6b851-66e0-4554-9e5a-2d9ecb7cb273", "comment": "Malware payload (Mirai)", "value": "3a6c273dd1fdcd3dc75dbc28199f5ef2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716034, "uuid": "5d4345f0-332a-410f-8c93-f1ec4d45ebc1", "comment": "Malware payload (Mirai)", "value": "c2fffabcab2068622fab9d1f8eae2aec8231ec59e4618dd8748b53148fbec568", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716034, "uuid": "e829c22e-6907-4033-a1a9-a436f769c157", "comment": "Malware payload (Mirai)", "value": "5d314eba1688aa13eb873647a4eb5b2190eab693", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716034, "uuid": "4139d5c9-b7e4-45b7-a15a-d00e7340e54b", "comment": "Malware payload (Mirai)", "value": "567ad7e2246848eeef3121ab2f81ca7d9ca42b20925264173143efb619b31a215e74a444c17e1dab90b3806a839d2c71", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716034, "uuid": "ff79529c-5e5b-4d52-aae9-2847d73b0a60", "value": "T14F933994BC419B16C6C6227BFB6E428E372663E8D2EB32139D215F2137C785B0D77A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716034, "uuid": "7bdf2ff7-bf2b-4a41-bcac-373e3f3720a8", "value": "1536:2yHZPRmL+JFIWIQlVWKG+VnlHjo6sjWronSADAJ37vIGooX9NPWlzz0iT82:2y5BbWKGuHMZdn1DAJ3kGl7WJhT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788716034, "uuid": "502e4106-1c4f-424a-9458-cbe7ecc5f607", "value": 91748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788716034, "uuid": "cf076a63-9e59-4c0d-8fd4-18376a913ff5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716034, "uuid": "26f0bb09-b0cc-4ac1-a8cb-ea387dc29e87", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d319f280-a9c1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788678536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788678536, "uuid": "3aa7fb2d-820a-4de6-b10d-6d34ff8d58c7", "comment": "Malware payload", "value": "52b640e0fd53e6181af6fd4bf4ecb1ef", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788678536, "uuid": "081ee934-45ea-4ec2-9136-d68682605dab", "comment": "Malware payload", "value": "c38d59f56db01db33779c02359f5e8e2792cfa4a2a6ba0020ed8fadbadecc0da", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788678536, "uuid": "37ba83f5-bc01-4d20-9c81-f135dceebd64", "comment": "Malware payload", "value": "36118785e4fce71a5adbf80df362f2e2b8c16fd4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788678536, "uuid": "32febbb1-d309-41cd-861b-9d0d7aa05ec1", "comment": "Malware payload", "value": "26180fcc78c9334ebae6ef9507fd8d1a01c29e48018a9f764e07a40aac85600a3efc4d39128e3b9102c105a878168c20", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788678536, "uuid": "4a198e51-6197-4729-9863-e43f629eab61", "value": "T1C9C27D956A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788678536, "uuid": "a1208b50-375c-4706-abcd-c13cf655f7b5", "value": "768:z8vCB+25j6es8RU9FYpMSUpi+20qUpi+20YQX:z8l25Jyd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788678536, "uuid": "f294eb9e-caf2-4f10-9bee-c09502862478", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788678536, "uuid": "8416c8b6-2c0b-468f-a4e7-12621d69ab0f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788678536, "uuid": "70784f98-f83f-4146-a44d-623eb018f207", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97199dd8-a9fe-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788704634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788704634, "uuid": "fa63af51-7a5f-4b7c-bc37-dd5173099fa2", "comment": "Malware payload", "value": "e1145bcd1c61012827aa48f9ba4c78c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788704634, "uuid": "0468cd81-39cc-4cdd-b0ef-e240422f8e9a", "comment": "Malware payload", "value": "c4d180c8dc7fdb6a7edaddfebf23e966a7aba195f4650898a92851003a13cf93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788704634, "uuid": "7b049eb8-89bb-4a67-91ca-ffb5ec1ce038", "comment": "Malware payload", "value": "d322fc9bb01e493bd5b77c6cf0a08c984ab0746c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788704634, "uuid": "e45ebcf3-e4e7-4d57-8d7a-efdb9ee100ee", "comment": "Malware payload", "value": "5721a1289366c806f481ea8a09096efce9596ff83c283b0537226cbee5fa67073c06301dcdd902fa8744051ef1ef9f46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788704634, "uuid": "5f0ffc1b-a010-4901-8a85-8092ea3d4bf9", "value": "T1E5A64A07ECA509E5C0E9E17489669253BB71BC495B3123D32B60F7782F73BD0AAB9350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788704634, "uuid": "3e791bc8-aabd-4ccf-bd94-c0ffb83e7346", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788704634, "uuid": "c9c23c94-bc48-4071-a41f-bf6ffbc84d48", "value": "49152:fUnUzVOD4HPtHpqrvKuERQtBGp82zlMH8WG+MZmu0kcEkttXiJtwSKHubBc6ZNHk:fjH1HK2mM+cYPytNKOHhiEM5kSwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788704634, "uuid": "1455a8e9-04f8-4478-a28b-941569f727f0", "value": 9867776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788704634, "uuid": "18fcf3fd-50eb-4bb3-9764-e9a4fcf080c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788704634, "uuid": "1add6e07-8a38-4d4d-8df3-1a8fe9b2ac80", "value": "c4d180c8dc7fdb6a7edaddfebf23e966a7aba195f4650898a92851003a13cf93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e228049-aa02-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788706337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788706337, "uuid": "aa9b61c5-4def-4e70-be17-14a82245f5c7", "comment": "Malware payload", "value": "208531c08f65603882caba8b86b469de", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788706337, "uuid": "118577ea-5025-443b-bad7-e91e9eae8a15", "comment": "Malware payload", "value": "c51158fa2bc3a6264074fc4e3428f47e24b07245db0285ed6341b6cb41c6db08", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788706337, "uuid": "9f364cb6-6908-44a9-b97c-09bcce43ca01", "comment": "Malware payload", "value": "e71ca2d6c75ef2c6eef62fd45358e2151c742f51", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788706337, "uuid": "8fa9292f-e23c-4a97-b30c-6ef9d8b324fb", "comment": "Malware payload", "value": "06fd7e604b592a7f49e0dfeae49508f60228154c89b02d66e638c3d9b12a67a024ec39258ec38c31c25b3129d84513d5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788706337, "uuid": "f9b69da6-c2ed-4c0a-ad26-2ef6968a024e", "value": "T114236C6516857C14AE99C4365C7F2F0CB9AD43E6314492EE7FCE3CF28C4AAAD920871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788706337, "uuid": "6c52c908-200d-417a-b5f4-4b55c109a618", "value": "768:6r9NyXsZztCMh9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:EHusZ2cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788706337, "uuid": "1563f5a2-85f1-42be-8b22-e11dabfc80b7", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788706337, "uuid": "f5d60cde-6950-4eb3-ad59-8b21f6a0dc61", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788706337, "uuid": "d545320e-e312-496e-93bb-be50fadb3e38", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f5358d-aa2e-11f1-bd95-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1788725354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725354, "uuid": "47ef2810-a69b-4d08-8b21-bbb0ae8a6763", "comment": "Malware payload (SilentNet)", "value": "e0ea64b46e5d2a3e10893116b6d20e0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725354, "uuid": "5dad6371-861a-4c92-b32c-41da6cf72b42", "comment": "Malware payload (SilentNet)", "value": "c6a2648e2fb73c593025ad77df99644d0404997bf01d65466f6b2e38411ebf1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725354, "uuid": "bd9eba2e-5af4-4f22-9bfa-461c352fa32b", "comment": "Malware payload (SilentNet)", "value": "f8aa772130e1bdad51e3fd52c4f776c46ce36784", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725354, "uuid": "6954544a-c9b7-4cb5-a3c6-50904f9a5521", "comment": "Malware payload (SilentNet)", "value": "c91f30e08eee2f8b484a5df2e6416d5202b1cccbb0fa668034c7ec0546915adc9e987a1ae39454b05a9dea3e90d19e30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725354, "uuid": "90fd119d-77c7-4ca0-9410-80683fcc883e", "value": "T1BC357C83E7A385D8C116C9B5534BF137F9627C8E4B157197ABC41E633A67BA4E22CB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725354, "uuid": "2c97100b-5b3a-479d-a293-c1e8790b4b4b", "value": "73f461c771aef77ec43d53a0c54f0c8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725354, "uuid": "dc42a26c-20fc-4c1d-a0d3-388a08a3472e", "value": "12288:Dbs/m0E54jwaFXGc8lEBBBHGBKq2IZwDlCvfqItNqdg:DbOVE5ifGPRZwhCvf3fd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788725354, "uuid": "8631d9dd-58c4-4434-9ea9-09e10948d52c", "value": 1139712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788725354, "uuid": "4137a0ea-5e3b-4e2c-83f8-0651f4fcc8c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725354, "uuid": "c58cf22c-0020-43ee-ac84-a89dda394ddf", "value": "index_all_french_db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b44f4da7-a9e4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788693516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693516, "uuid": "a132b0f4-8dbf-4fc1-965e-c7732d3130c4", "comment": "Malware payload (Vidar)", "value": "a2dc314d755635c47fc0462e8866da8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693516, "uuid": "276cf49e-d748-40a2-b590-432bd2e65527", "comment": "Malware payload (Vidar)", "value": "c6c047c78ed546654afe9b3ef3a15aea6bb5a031b17588a63f6de136ee6d781c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693516, "uuid": "e867b675-e4d0-40a3-ba5a-e664f02f232d", "comment": "Malware payload (Vidar)", "value": "54a7d16c2cb303e53608961c4083e97fcd4eceb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693516, "uuid": "cdace043-184c-4846-a1b6-226e5521bbf2", "comment": "Malware payload (Vidar)", "value": "f662249e4948d441ac1b2309bf9956ac18964eaf63d97667687da5a5d65f8279bd290aa3f1250d48b7ef651b461a8683", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693516, "uuid": "907f89c8-759d-4481-9c25-bd187e493d7c", "value": "T10F2833077A9590E8C19A4B35C67A4266BA75BC98DB3537F32E44FA701F66BC23CB5300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693516, "uuid": "686b3838-3136-4a83-bff9-de16da93057a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693516, "uuid": "144662e8-8c1a-49ce-a75f-812f9bdc85a1", "value": "1572864:NLiCYsr2y29eonYaULd2mZ7dDfk/G+dsVLsZhO8Hq2bEMPJVpYYq0cGZl0x3LSwY:h2y2yaULrxVXVgZYMRVp3cGZESwyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788693516, "uuid": "2a3958a0-367c-4620-8b9f-abe5d8d13609", "value": 97845160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788693516, "uuid": "f301393b-ca77-4f88-97a6-6c4bca2e0cd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693516, "uuid": "77bb0193-8fdf-4c56-a10d-1e433c17e2fd", "value": "c6c047c78ed546654afe9b3ef3a15aea6bb5a031b17588a63f6de136ee6d781c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d2581a-aa19-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1788716368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716368, "uuid": "9ad04d47-e214-4e66-bbdc-a5af100580fd", "comment": "Malware payload (Gafgyt)", "value": "a3af5d183b0b6779c84d7dfac3cc5ec8", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716368, "uuid": "9b8594e1-e1aa-41c4-95de-ff920cd29d39", "comment": "Malware payload (Gafgyt)", "value": "c745fd914b8865211c7844b032731ee79b7244047d2b12a38a0504b70e710e60", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716368, "uuid": "91514247-b1f2-4594-b0c4-cb7ebf189f06", "comment": "Malware payload (Gafgyt)", "value": "c5f215ac0696ce2300b4b2ac14d63f77fad1bdf5", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716368, "uuid": "fda0ea8f-5b17-479d-ae3b-2644fd48e913", "comment": "Malware payload (Gafgyt)", "value": "86c018bc034c79515d940fc3551e7355a2ed584bc2cf9bec404a16a610163f33cb7f0e8c3ee597f21b03fb495a7dace6", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716368, "uuid": "3af35f89-13c8-4066-9743-84b22679b2c0", "value": "T142F32945F9519B53C6D322BBFB5E428D772617A8D3EE72039D216F20378685B0E3B242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716368, "uuid": "a4dfe2ca-e711-4ccc-8395-b6c8a60a9426", "value": "3072:4fC74YbFdfB+bxpRV1t4DlYfHhVKe70pSRE:4fkFdfBKxpHz4D6fHhw5pSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788716368, "uuid": "9ab759c0-e31e-48f5-93e6-20cc52cf6c99", "value": 167648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788716368, "uuid": "ae7f25a5-8609-4524-abb7-43080ee39ac5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716368, "uuid": "c5ace343-a068-444a-9f71-36f1d9d2b92d", "value": "qtm.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4961e88-aa29-11f1-bd95-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1788723125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723125, "uuid": "10060f3f-55e4-4f4b-a1c0-19a1fbcbd78b", "comment": "Malware payload (RustyStealer)", "value": "99ab45e817e227bc8f619db8dfea1af8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723125, "uuid": "921fe202-3830-4840-932c-3a82ae7d8807", "comment": "Malware payload (RustyStealer)", "value": "c764cc7a95459747a569274c4de38802ebc77e9930502aae634d21505c047ee2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723125, "uuid": "f9f43106-4e3f-4ac3-85da-0157a24ee3cb", "comment": "Malware payload (RustyStealer)", "value": "13c916ea604ef5b03cedb383d961173930537054", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723125, "uuid": "74e0ed66-8aff-4ab7-8205-8f4ebd4f0568", "comment": "Malware payload (RustyStealer)", "value": "6f21475b07460145c4f1dcf130b4de5bacde0b8dad08d7ef8e014cae7559d9d2e26473ca70db2db80c40b62ab550fd33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723125, "uuid": "d85b5236-fca1-4031-bbf8-82648ac98ed4", "value": "T1D2B57D03FA9285E8C0DDC07883579732AB36F88D4A20B7DB2FD44A112E66F605F9D759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723125, "uuid": "8eda9155-5dc2-4f18-9c9f-20b62ad7ac37", "value": "8e08a4ff3bc080f0516fb97a501625ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723125, "uuid": "0921fc36-0943-46e8-94ae-96ee80c27eb8", "value": "49152:ZulH8Vi+zEok6pE03pHG2pN3PRc2eYIU6i:Z5ic9Nvc3n+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788723125, "uuid": "f5ef4530-beee-4f16-903e-87b616f0482a", "value": 2408960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788723125, "uuid": "943166e5-0d1e-4f65-a056-ae574cf2d784", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723125, "uuid": "f15661bc-0b15-4e9d-9225-16ae7bea7cb1", "value": "Seed_Balance_Checker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b795fe-aa16-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788715052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715052, "uuid": "f7b7b35a-e4da-4658-b64c-37877c705d55", "comment": "Malware payload", "value": "1dfd479eae3837b00479e7d0b1ab056a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715052, "uuid": "3356aa79-86bb-4e59-84e2-7c2c4e65daa1", "comment": "Malware payload", "value": "ca41b551c62debb4408111bbb89342e20117a47d857c435cc3951f9680d6ccdb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715052, "uuid": "acc2fa2c-be8b-41d2-bdb9-53f5ac2600fd", "comment": "Malware payload", "value": "6b98069bef2120dfb1f07871c7aa3c3145a2d57e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715052, "uuid": "56e2c8fb-a648-4e23-8dc2-8f3b0b503625", "comment": "Malware payload", "value": "2a84c150615f8d8131abdfe284552bc18c075403ed7fe646acec7c26255dda35ebcb7bc74ad491d1ccf244f49ae97403", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715052, "uuid": "72027446-a748-4920-a93b-b774ab76f7ec", "value": "T1782142CD31283B32C484EB18B1A18F6C600796D6B6CA85D5D24B0A1AF9497D0BD17570", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715052, "uuid": "a1cfd35c-2a64-418e-89a2-a81df07d2e0d", "value": "12:qVT5VFG/VlVF9VT5VFAVlvq/jVGYLChh5LAesVOlAjcjA:qWHMYKLc3VOl+6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788715052, "uuid": "aebcb2f0-8ebd-4f38-9131-5b88eac702ab", "value": 1165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788715052, "uuid": "bf94da0c-def4-45b7-9031-014aad699cd4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715052, "uuid": "3b15cf3c-0f9a-4f27-baad-625a7de24c55", "value": "ca41b551c62debb4408111bbb89342e20117a47d857c435cc3951f9680d6ccdb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c72d15fb-a9bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788675939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675939, "uuid": "f01e2962-5972-4800-9ef8-88d5e4888ed2", "comment": "Malware payload (Vidar)", "value": "a9b04146108b39ed694de7a1b5566ffb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675939, "uuid": "3db0ad52-c546-490f-bcb1-0ac1bfc4703c", "comment": "Malware payload (Vidar)", "value": "cb0670487e5f0fe7f68566f26467c6158e6c6863eb92cc00e8d5f7ed7848c8c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675939, "uuid": "f0b84021-191d-4b70-aed3-f3f52b0d872c", "comment": "Malware payload (Vidar)", "value": "39376d1722bc5b2f32a8017f2f306417be636c9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675939, "uuid": "5a01a9d2-461a-4e34-bad3-d898e2b410d2", "comment": "Malware payload (Vidar)", "value": "ec29951a37faf2f2f38c0faef77be1bbad55b15f5c43611e7b27d87b0fc41a20cbe73ee1c5d5467731d680b3208f762c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675939, "uuid": "3ec5db48-f6b3-4be1-ae28-5a3d324d5529", "value": "T1AA283343FC5645A5C46EDA7A89698252FBB0BC040F31B7D73E40BA782E37BD1513AB18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675939, "uuid": "dd280b58-6f69-4c3b-bb7e-bcf55d9d3c3e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675939, "uuid": "971cbf05-6780-42b7-ac77-947089d8dd9c", "value": "1572864:4modmXB67CtUcUXg9nHgGZw7dMWXhntBvjzVCdwoRUi33ofMw6CupwIvp:LodslAHdMetBnVYuinJpwIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788675939, "uuid": "526e4492-f1ce-4e7f-a97f-d8ac2296446e", "value": 98996592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788675939, "uuid": "768637e3-4295-47bc-a094-b9150b5c0226", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675939, "uuid": "5e807542-1e66-4b01-828e-66b702f8fdc1", "value": "cb0670487e5f0fe7f68566f26467c6158e6c6863eb92cc00e8d5f7ed7848c8c2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4b1b485-aa41-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788733541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788733541, "uuid": "432a26ed-3cd5-48d7-982c-0c7afb68d324", "comment": "Malware payload", "value": "a333f4fa28043d3461d1ce1f813960c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788733541, "uuid": "820fa2fe-6965-496b-b796-e0a4bf4c0fc1", "comment": "Malware payload", "value": "cb348c4b941018399a9e1e3172bf43872849d511927bd42f81008b2a53c344ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788733541, "uuid": "8f1e4498-c2dc-432d-a193-79f20edefd58", "comment": "Malware payload", "value": "46817aebd934617a30347195e2eee257e9d3b57a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788733541, "uuid": "793fdbaa-26d7-4126-826e-ca4e0fb2d261", "comment": "Malware payload", "value": "e3f3721b72b1c563b304b2c1ac77df84fa1c1868077b05d83e62f212adcba36b24c73fc31470b075398937d0980ca6aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788733541, "uuid": "ff181c20-a0cd-4b30-ad3d-18dcb8ce86c0", "value": "T1B767EA46B605C98AE0265274D8878FF4A722ECB1C6B1976733A93F1D7FFA30C4E92454", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788733541, "uuid": "102f9f0e-b43e-4d27-aedc-d555874f23b4", "value": "c329cfdce996b315359260e710fbdc76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788733541, "uuid": "baaa2528-2010-44e8-a221-60fddb8dc748", "value": "98304:kClvSImXQ9EkE6uzJdQ2Orf8wsGF4tVjibVpOMOaci583EGsGFCJNlvm:plvSIkQu5TcT4PILhAxTCxvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788733541, "uuid": "e09eb113-55ad-4149-a0d5-d65a17190578", "value": 31746464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788733541, "uuid": "e95f9130-0391-482c-a629-7901f8e497e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788733541, "uuid": "119db792-9c31-4fb3-a632-3ba30bb5c0fb", "value": "installer_r2.0.03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "415a170e-aa2b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788723818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723818, "uuid": "2996bbc9-2a66-40fb-b053-ac72cd370ab8", "comment": "Malware payload", "value": "04cf8ed27fda75791687996240553825", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723818, "uuid": "8029d823-4714-42f8-8ac1-b4df076b6792", "comment": "Malware payload", "value": "cb4c83bd44f797058370a385794dc8084fae10a69d765bc247058d68771b8547", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723818, "uuid": "8d5df42a-dd5d-4ccf-8e64-155d3e916e84", "comment": "Malware payload", "value": "c22f2eb110c4e43f23d63a1923502e3efaee36fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788723818, "uuid": "56b3d00a-85ef-45bb-9dc2-97064a1e4036", "comment": "Malware payload", "value": "a143487446bfb8b0360fb435b5ec911c703ea8a8cdada68cb5a1771f784d6bab850a380c5a9194c592704252eff57d00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neonstriker99", "colour": "#802B64", "exportable": true, "hide_tag": false }, { "name": "NeonVanguard", "colour": "#E820D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723818, "uuid": "f7eac0ab-b6e2-4cbd-81a4-7af91fdde2d2", "value": "T15A454A07E26354EDC16BC17486679772F970B89901347F7E1B98CB322F21E6097AEB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723818, "uuid": "db9ebf70-c5e9-4eb9-afa8-fb39a857e467", "value": "9bc9be2eac143a21bbd0d21b05e557e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723818, "uuid": "2e80cd64-71d4-422e-9327-a4604658eea5", "value": "12288:rf3e38wIOJ5xl/K/j4ACo/0Mi2JGCc8xDfihyTWjIKcg1JEnqfvc0/PP1wm+eCQz:rDwIO//K/j4AV/0MLJdFCRLP9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788723818, "uuid": "4df1a43d-bd5b-4cd8-902e-ffad31aa3db6", "value": 1209856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788723818, "uuid": "92ca17dc-8b40-4364-a53c-9e8814c752e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788723818, "uuid": "4b1fe09c-8943-4fb3-aa37-97ef16fd6c8d", "value": "002_hook_CEF_xor.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93176dc-aa20-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788719267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719267, "uuid": "25639555-db43-446e-8ca2-2079fe719766", "comment": "Malware payload (Mirai)", "value": "735c46dd23e994a024e75e8c949b3c98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719267, "uuid": "139c0c64-a7d4-4bd4-8c94-ed00287a3805", "comment": "Malware payload (Mirai)", "value": "cc29f42cbbbafc70d98d5438d9d6ade3e3a16c4c1023b521dc8443ff7c16087e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719267, "uuid": "255125c2-cf3e-41c6-81d9-0791b42b7b91", "comment": "Malware payload (Mirai)", "value": "f98e646d412e67e025f179938e76b8b07543c5c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719267, "uuid": "32233c5c-1813-4cd0-aa06-dc5d535206f8", "comment": "Malware payload (Mirai)", "value": "9ee6545a2cf12b4d288d0f567a7069cd5936c3e1e58896f639002251635e16e9b0aa0c3634295a67fa930273143b8b33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719267, "uuid": "02ca8bd3-4cd4-4bc3-af95-cc78f5913cd1", "value": "T1A4631247FFCC0BD8FCD91BFD07AE65C722929431907681A40DE64D96816F9B1219B8CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719267, "uuid": "60cbd1df-854b-4fe0-904d-4cf91e2c0ca5", "value": "1536:Jr7MbwKNGjjH+Xq34n/q8Zu41zmX3sDgNxrPD:J7Mbp2L+Xqdfoz2ssrPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788719267, "uuid": "cc306b8c-3ed1-464a-8559-caf3e1513acb", "value": 70852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788719267, "uuid": "4e2eef8d-8491-45f2-8a69-78923c92b115", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719267, "uuid": "9776c067-3076-4422-922d-b6a65ab78dcd", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "670f1e6b-aa2d-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788724740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724740, "uuid": "e10b333b-c2cc-404c-9f47-71a5d3888b27", "comment": "Malware payload (AsyncRAT)", "value": "41b60b889c0a403674131e69880e8f9c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724740, "uuid": "f89f5b75-9544-465b-baaa-d80e92f03144", "comment": "Malware payload (AsyncRAT)", "value": "cccce5d5491d76a7aef09599c91b10bd109c03b307095be10ed85a95ce54ad8e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724740, "uuid": "91b9211f-85e0-4390-b8c4-21865e6af11b", "comment": "Malware payload (AsyncRAT)", "value": "c88e2b991983883e668dd8fbfb1d99d3a73d322e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724740, "uuid": "83b67fdf-605c-4f52-a48e-bb610d2e5ba3", "comment": "Malware payload (AsyncRAT)", "value": "e9a9ee154dbec9f29fe1ab21a0b0b00b305c554d95ec56c0df3f0267de5ea5e2645395bb5d345a1954319b3d19d67d9e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724740, "uuid": "b2adff0f-4d2e-47da-985d-70a8c289e236", "value": "T1BD937D007BD88529F6BEDB38A8B2434507B4BD572812D68D0DD439AF1A73BC099427BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724740, "uuid": "a3a86e12-0712-4d1f-890a-5d32b2ee9660", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724740, "uuid": "606c0dff-4e8d-4876-a382-1523541cd3ae", "value": "1536:ef4RqLgUAGnKnIhtMhjbysJJfj2bvwb8l3wDu3Y6Uk9jg+rr6GbOsKpeQiQKW1S:ecqcgnshjby2JW6Dud7r6GiX8QiQ/1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788724740, "uuid": "54769b49-02b4-4bb8-9c2c-2fb7882e0744", "value": 92672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788724740, "uuid": "b6680752-3f49-4487-b2bc-986bf580d5c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724740, "uuid": "77a6f30b-7eba-4306-9fc3-fb3de252a925", "value": "from_kiwi_okvip_with_love_hehe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f7d8ce-aa2d-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788724731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724731, "uuid": "005f6d65-77f4-48e8-8311-09710e1314e5", "comment": "Malware payload (AsyncRAT)", "value": "7656295a11fb1016e9eddb71cfb4f24e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724731, "uuid": "23cf5ce3-8403-4504-8c98-1bf1f7fafc81", "comment": "Malware payload (AsyncRAT)", "value": "cdaf86deee5042744424ed5990b91db92e964ff3d139ec6bf4c07b42ca659952", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724731, "uuid": "862f1064-f88d-4074-acbc-306e71595fac", "comment": "Malware payload (AsyncRAT)", "value": "a2001f8ccc298375a90f468b650fd6cbd788b2cb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724731, "uuid": "b423472d-177b-4bef-929f-af7400d41514", "comment": "Malware payload (AsyncRAT)", "value": "6542ea1f67d5420838c1c61e1a9087705ded43abcdb351bc44d9f63092697484d3f2e9f0633045d1f0f3c62f01f3a5f3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724731, "uuid": "187bd2fe-8178-4f40-bbbd-6f70acabc043", "value": "T1A1C23B0833F4C571E2FD4ABA9833D6008B75E55B9913D76A6FC890AD2E2378D8A14FD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724731, "uuid": "f5ac84c2-04e4-429c-8182-3823ba34b6c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724731, "uuid": "4591c24b-19e6-4299-9e01-c6107d9ba03a", "value": "384:/N3SaTSXW9bVWw7HtZARPn9jeH9qbuUszbQxnCJfJBndnjJ2Kh/+:/N3SaT5Lt+QIb3BiBn3h/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788724731, "uuid": "339b14db-530f-4096-9252-7c6473230578", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788724731, "uuid": "dbd04bd0-efa2-43d5-ad68-bd661a95df3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724731, "uuid": "1344799c-7395-4ae5-a531-ba8201a68c60", "value": "SHBETAPP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa2bedb-aa2d-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788724808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724808, "uuid": "200459d5-1784-47dd-b6d8-0cf9ffef6719", "comment": "Malware payload (AsyncRAT)", "value": "ac45ee03c99ed2769e9aa75c2bf95a18", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724808, "uuid": "bf4ad172-e544-4609-a328-3b6f3dfca145", "comment": "Malware payload (AsyncRAT)", "value": "cdb73efc6808026585e0268ee4396c6ffc1d4d0288abff967c23c94057fc2ab0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724808, "uuid": "56927f1f-bfe2-4023-8fa9-a565dcdd92f0", "comment": "Malware payload (AsyncRAT)", "value": "ec66c3675d27dba0324d7b6f4ad1499059f0c593", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724808, "uuid": "3c204719-513b-4c81-8184-9c75a8917931", "comment": "Malware payload (AsyncRAT)", "value": "e584e744e361f84db84a86fbcfe6eedf27c13ab5d29cf14bf2ae2d26ee0d199ddac0bcde40135432e19d2e4e06b44a7a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724808, "uuid": "523721ea-eb4a-473f-a396-1a0b43226e38", "value": "T10C231A003BE9822BF2BE4FB89DF26145867AF5636603D64E1CC441D71613FC69642AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724808, "uuid": "e818b883-f5f9-40c1-95ce-1c1c4fffb136", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724808, "uuid": "efe18ae9-ec19-48f0-ab05-2df006dd958a", "value": "768:/u63N5T7w8vSWUkDuzmo2qQ9Aq7rhFysWvzjbFgXCiWh04+w5zOMdcDZLz+:/u63N5T7Pg2tA2tFy3v3bCXrG+w9OdLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788724808, "uuid": "f7a00e9a-29b9-4352-a0de-0e964428937a", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788724808, "uuid": "5ff563e2-99a8-4ed9-86be-60df31bee09f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724808, "uuid": "32829ce4-54b7-4bc5-96fa-00887009856d", "value": "ChromeSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d5d7ab-a9ac-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788669435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788669435, "uuid": "b9b5209c-f22a-412d-bb38-e4bb33d15781", "comment": "Malware payload", "value": "7fe2508565aab7eaff3897c7f9200f32", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788669435, "uuid": "16c58a06-4413-47fc-a6be-b99be175cdd9", "comment": "Malware payload", "value": "ce23bc6e1ad29a3277e6845f321adf6c210744465d8274031bd33421814bfd26", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788669435, "uuid": "68d634fc-cb64-4bb9-a030-467f27eac162", "comment": "Malware payload", "value": "90c4fa596f2387b6035a24364f8f62fc865fc09a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788669435, "uuid": "f18286f5-c101-420a-895e-43f87be6efe9", "comment": "Malware payload", "value": "f2293a452da9d01608ce06cb00697a8703227b0e8898853003aa71795ea6fc089941715088fb53f261d6197cd563d146", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788669435, "uuid": "4be9e37b-26de-489c-bcb9-d6f490c0bd4f", "value": "T14A235C651A857C24AE98C4361C7E2F0CB9AD43E6324452EE7FCB3CF68C4A69DD109B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788669435, "uuid": "3bc20523-fc7d-46c4-87a4-7ee294840219", "value": "768:P+W9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:P+Tcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788669435, "uuid": "e86340e9-6da4-4fb3-823f-b6e408542b3f", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788669435, "uuid": "7e38f4fb-d7d2-45c0-a6e3-faa08dad8eac", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788669435, "uuid": "018730a4-6058-49ea-b1cc-733e1400eeac", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d283e2c5-aa28-11f1-bd95-42010a9c0009", "comment": "Malware payload (Sfuzuan)", "timestamp": 1788722773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788722773, "uuid": "b77289ae-2ad7-41c1-8d2d-1b0c47f4dcf4", "comment": "Malware payload (Sfuzuan)", "value": "ecf3207a0ac9fe95889e6c52b293d3cb", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sfuzuan", "colour": "#01B03B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788722773, "uuid": "e79bae11-2a1b-4901-a888-61824de4b671", "comment": "Malware payload (Sfuzuan)", "value": "cf75fc50d7252d2a07194fb685533521c3d6e1cc96dd197ef211a490f94a401f", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sfuzuan", "colour": "#01B03B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788722773, "uuid": "6d9cf4b1-3b93-4681-91f1-1d6374a7712d", "comment": "Malware payload (Sfuzuan)", "value": "e45fdff73bcaff457293b7a8dddce2ba567e4d30", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sfuzuan", "colour": "#01B03B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788722773, "uuid": "82dd4207-0dbe-4e93-ae1d-4c2865d380a8", "comment": "Malware payload (Sfuzuan)", "value": "f9d7aa0bf87177166d1088f4dc53bcee9650a1db9b1ab4bd6951447a92c74e020cac4f133bea8d5dca7b44c3204d7c3b", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sfuzuan", "colour": "#01B03B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788722773, "uuid": "369cff3e-7968-42f5-924c-dbe89aec4932", "value": "T157C46C26B6A0D076C4B79574C4A28BA6FFB1742227244BCFA39047561F637E2BE3530D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788722773, "uuid": "e593d036-b181-4736-8a2d-2e1e5358de9c", "value": "5af7b7a29b6ca9cf4b52f600adcaa68b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788722773, "uuid": "7a294f75-5a8c-4f8d-b83b-503af759e732", "value": "6144:A6UE71cqQEoMr5C2iKLJChYSvL+8xPFxirGcEOkCybEaQRXr9HNdvOa+y8K:AO7OqQs42iKFChYSvL+8AsOkx2LIa+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788722773, "uuid": "08eab053-c205-45e4-8357-ce9f202d77f2", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788722773, "uuid": "54fe5759-7b6e-41be-ac96-7825ef560522", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788722773, "uuid": "c20ae348-708f-4316-8515-ebe18a8243a7", "value": "13bf5386.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6cc44c-a9c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788679952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788679952, "uuid": "99d1df45-469d-4888-8b11-c59a228761bc", "comment": "Malware payload (Vidar)", "value": "46f77e3deac560c6eb74a5607550315d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788679952, "uuid": "ff32c013-d9f1-4a88-b4b0-52911414bd72", "comment": "Malware payload (Vidar)", "value": "cffef18f1ab5c16c09a1bc889810624b24f63b408225865abd411613fce01955", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788679952, "uuid": "3d3f2349-4738-4430-9200-d32d39d84b93", "comment": "Malware payload (Vidar)", "value": "a5155d74a35fd4cbe1d8fc51862bbd123922bb92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788679952, "uuid": "dcab6b41-7118-44df-9ea3-caac8e29d7dd", "comment": "Malware payload (Vidar)", "value": "83dfecc707bb9b3545cdec20fa37447b87e4d217f16bf2ffae751ea2c021a27848d71b3ec67a96f3e9f36f44ec9a4525", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788679952, "uuid": "5b26a4c5-ea75-428f-b93e-c638b8468952", "value": "T1BCF59D0B7C9109EAC0AE933185766651BB35BC094F3133D72FA0BA792E727D09D76B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788679952, "uuid": "b696f541-6f1a-47a4-901c-de9348ae9685", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788679952, "uuid": "116bcd3c-a606-4e01-a102-76b6bf975d5c", "value": "49152:zX58SEKcIpWx+JSAPW6FLt0Fp7R3iBF65vp7Vy:zRdAA2p7cF65xU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788679952, "uuid": "be8d07e0-0819-4496-ad65-c49e88d23322", "value": 3339632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788679952, "uuid": "9293f756-9061-4cb4-a3e2-19624cd84964", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788679952, "uuid": "ae02ca38-311c-4c61-a3e6-6735c397c643", "value": "46f77e3deac560c6eb74a5607550315d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a7506d-a9e4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788693577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693577, "uuid": "63a7f2a4-e668-4b48-bd67-d18a4104e5ec", "comment": "Malware payload (Vidar)", "value": "0cdb7082cb5693494aa33fb652e7eca2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693577, "uuid": "33ba090d-6cf6-42f2-8410-5c77c08d3565", "comment": "Malware payload (Vidar)", "value": "d08b7a755e3606050156cd2834e588c02f1c945b6ee3ee7b567f70dd24b10c92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693577, "uuid": "37784539-5b2a-44ec-abdf-f3e89b329d13", "comment": "Malware payload (Vidar)", "value": "78ab90e59bcf31be213cb43bd1fce22267fe2085", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693577, "uuid": "9a8efe6c-01e2-4889-b018-1ce35e40d13b", "comment": "Malware payload (Vidar)", "value": "14404cf029df93550d7c626b5ef548805cefce02a706d1ac41fd627aa11876a26cb5547807bc90b6cdd65c2c9dc0cf88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693577, "uuid": "c570ea87-066e-43b7-b01e-41ecc0fb2dc7", "value": "T1751833076AD950F8C19A8A75C6BA4256BA74BC98CB3177F32E40B6701F67BC27CB5700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693577, "uuid": "2e85ad18-cf07-40e2-8d47-63ec4f45c60d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693577, "uuid": "ba43eb7c-efcf-4fb6-980e-e23bdfb9807f", "value": "1572864:NsAHCIuItOvGtlQgTi1a6Ax9YdOgT05TPoJyuordvMSAHN1XSS:eEtFtq2x9m4PNhNAniS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788693577, "uuid": "1f381211-3ac6-4269-aac4-d69dd9681279", "value": 91553704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788693577, "uuid": "edf33adc-228c-4f51-be3b-2bf45460665b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693577, "uuid": "c39568c9-43c6-4341-b91a-2182e4d42340", "value": "d08b7a755e3606050156cd2834e588c02f1c945b6ee3ee7b567f70dd24b10c92.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a07cb795-a9c1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788678451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788678451, "uuid": "69ec2e88-f178-4e56-9600-3c85a458f348", "comment": "Malware payload", "value": "2ff8ad6d097475654fb7b835cab452b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788678451, "uuid": "e4eace92-f905-445b-befb-d2d9927fbb98", "comment": "Malware payload", "value": "d21bd3d35a440b59d7bffc3111dae5db43895d09d6d33caa47ca6fb205bc07fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788678451, "uuid": "782e9961-66aa-499d-88ac-fc635fedc6cd", "comment": "Malware payload", "value": "1662803110f6a728d37c8dab4d78bf4ffca7a7b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788678451, "uuid": "29388ea7-4534-4159-adcb-33ae545aff81", "comment": "Malware payload", "value": "f676c6f381fee4a32a041f62a60c4328aa027f5152f53221fc2803f2ff0dc8199a211c43f76995b3fb0d3eab24e030eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788678451, "uuid": "43ee6eaf-aa15-40d3-ad99-3514654c5aec", "value": "T151564A07EDA545E9C0AAE23089679252BB717C485F3123D72B90F7382F72BD06EB9750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788678451, "uuid": "2acc9c5d-23e9-4552-a022-42fa5d54c0dc", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788678451, "uuid": "31890f02-0823-4af7-aed2-d2936e0e57ac", "value": "49152:6tOk40I/U+ueafJ9uRSrGb9snz7lX+EXjW9PViFlT5T/58C1DubVr6LAkIOJCfK/:6EUpGdEXnjWmpBj26cmQb/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788678451, "uuid": "7f3d9c46-7550-41ca-93c7-c12b258772f3", "value": 6328832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788678451, "uuid": "a5ce3952-c40f-44d7-beb4-f0bb05ec883c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788678451, "uuid": "aed5ec51-a91e-434e-a966-12c631866fe7", "value": "2ff8ad6d097475654fb7b835cab452b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fcbbf07-aa0d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788710903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788710903, "uuid": "457b5b9a-184b-4adb-b74b-57321b388abd", "comment": "Malware payload", "value": "8c8e0a04ef8562a9014373013e8dab6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788710903, "uuid": "9f7f035c-2829-4f95-946a-17ad110f9fc8", "comment": "Malware payload", "value": "d23005958aaa42b28ff2ebfe60186e4dc09d2f04029bcbf5b4695318c44f0900", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788710903, "uuid": "93bbb252-6d5a-42dd-ba22-005bb29bea58", "comment": "Malware payload", "value": "77c36983b00c7d571bc5d8229cacfc248494e02e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788710903, "uuid": "0d45c420-950f-46bd-82d3-bc9377fe6908", "comment": "Malware payload", "value": "5abc2df1f453276641b5d9cab28ffce5eec1ca30056c1def193922dcb3ccad1f3a771037ae8ecd1bb749c90113af5ce9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788710903, "uuid": "5ce8427f-421c-4e6e-91d1-76905dbb3dcd", "value": "T1C0D52386BCF615B1D837C7B5DD82F85CB02E7B8107A14E5E72CD2E504E12A986C3A3B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788710903, "uuid": "422c3620-1a0c-4f94-805b-1fe0dde89005", "value": "fe230628262faec735b6f015758b7519", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788710903, "uuid": "75cb50ff-f098-4cc2-8418-291e5aa345f0", "value": "49152:As9iA9+NQ5/LW8GvnysmS4X7BgPJjTREZpRNjXt8i7ggz0bO3jzNOBNZV4SOUZh:lEEOS/LKyHdg5uh7Xz6i/NOB54Sf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788710903, "uuid": "6ec565dc-da5d-456e-948d-81cb9bffa7c3", "value": 2979840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788710903, "uuid": "f170be12-126b-447e-a05f-29802d4217e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788710903, "uuid": "5d96c99c-f6b6-445b-9eff-9d6f9d7cd1b9", "value": "d23005958aaa42b28ff2ebfe60186e4dc09d2f04029bcbf5b4695318c44f0900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e92d584f-aa19-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788716368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716368, "uuid": "ff32a37e-3a66-4c44-baef-4e28a9b6b121", "comment": "Malware payload (Mirai)", "value": "20055ccec74bf7a4e6b3cb7b214c2bb1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716368, "uuid": "ac9084d1-766b-4d7a-9246-5eccc2290ee1", "comment": "Malware payload (Mirai)", "value": "d2470b7043e0ff6f8199a3b335811cefaee2d5a2e9e996f066a368eb470808d1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716368, "uuid": "d9934ed5-55c0-49b5-909f-5b57d76393f1", "comment": "Malware payload (Mirai)", "value": "0a77109856080feb4b882403ea5017bea5aa904d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716368, "uuid": "93c5e3e4-0fcc-4362-aa20-a97ef05f039c", "comment": "Malware payload (Mirai)", "value": "70aa8cfc9d79601afc74189ab967a44eacb2a77a59700daa27e10d49504f7a25f4a7235bf132e69986a025051f3631f1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716368, "uuid": "9c02b190-6005-485a-90b9-f601bfa3833b", "value": "T19124C71E5E228F7DF668873447F78A20A75C33D627E1D685E1ACC2155E2038E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716368, "uuid": "59458c57-47ba-44c6-b0a5-4f8d060db7b3", "value": "3072:Rf9eF83xW7UoxsrN55IZoe+ZVn7YoPqI7wffpEQAbK+0ze3S3a:aFAxW7UvrN55IZh21PqiwmQAr0zz3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788716368, "uuid": "c5c3cba9-d1a6-4868-9013-28a092a1a75f", "value": 225248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788716368, "uuid": "6a551cbf-616e-4202-a6db-42cdc0acaf55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716368, "uuid": "09d210d3-97fc-4ff5-a487-cc7f8d40150f", "value": "qtm.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b45c4b-aa19-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788715992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715992, "uuid": "dd3a1361-144b-46e1-8f88-503c9d6111f8", "comment": "Malware payload (Vidar)", "value": "3d2a66cddeb9b1bb7de6e5728f605eb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715992, "uuid": "0d98e185-0089-4e6c-b490-74257adaf5e9", "comment": "Malware payload (Vidar)", "value": "d2bb79b4953c5847db8c5b4071dfb62c0b710357ebb526e9932cec4b1025ed46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715992, "uuid": "66fa4b3a-b330-4db4-869d-376befa14a67", "comment": "Malware payload (Vidar)", "value": "3bd151c515420215a163b29c603c4481f8ab6ccc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715992, "uuid": "90db70c5-3420-4bd9-90d8-0983ad22789c", "comment": "Malware payload (Vidar)", "value": "3d572c76a87e59dfa243e2543494060979e6ae7a755f2c5ffbd2391661694624382aa5f1140e91b3e41f39fc96fd7b52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715992, "uuid": "308fe055-1053-4578-b571-480f1e73f2a5", "value": "T138A65B03BA5441A4D498DE39C4BB425377387C8C8B3273EB6E20BA386F757C069B9B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715992, "uuid": "655097df-5e8b-4413-bc0e-70d63fa472e1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715992, "uuid": "6ffc956e-ccaa-43a6-8d80-588711056b5f", "value": "49152:F+PIise5UsEjc8ai+QsbIT41JBtlW9mZqofRKCzG4Ipfbg9+Z2JznLdpQp5Hyw0h:Fay96AIYXS6nwu66rP6rtEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788715992, "uuid": "22e4db79-b2c6-45aa-b69d-07a604d98b84", "value": 9503128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788715992, "uuid": "7daeaee8-9712-433a-9f2b-4dc39b9e0ced", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715992, "uuid": "9ffa8f46-4796-47fc-9e19-8a8c3b483c5e", "value": "d2bb79b4953c5847db8c5b4071dfb62c0b710357ebb526e9932cec4b1025ed46.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcbf86d8-aa1e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718549, "uuid": "db1f0196-02f4-48e4-92f6-34a8cc7130c6", "comment": "Malware payload (Mirai)", "value": "0bb371d48b42bde7afd587aebb63904f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718549, "uuid": "5004b0ee-d528-4e7f-b704-7653de65d52b", "comment": "Malware payload (Mirai)", "value": "d30bd7b8a4dcedf23b11c807f6ff1e83f278ba4a311601ef5a16a730b949ba58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718549, "uuid": "b4580f3e-f1c5-4cce-8cd8-c735611805fe", "comment": "Malware payload (Mirai)", "value": "69037031359d110bc3d7281721770894ed4b7a08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718549, "uuid": "1a95b9ad-1e89-4ae2-8357-11ae44dffc9e", "comment": "Malware payload (Mirai)", "value": "75ac99b38c3a57c37b75fb83e78269be987c09f76409560afff7efdaa28b0bbca62a8abadf6e1c8c3a7803a32bd3d348", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718549, "uuid": "79ddb5a9-7fd9-4ed4-b83f-a67d6f923662", "value": "T1B283029EC68669CFC67D0F2D71518A60BACDA489770867ED2641AF0C507F50F0B09B79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718549, "uuid": "ff786b0d-79c0-4891-ad45-86fe6a2bc7e0", "value": "1536:bjmqQxRq/mjMR9nfUx2Q3l4NjHVviKeanTf4KCO1HQoKwGfCpNyu:bbIamjC9n50UjHhiKDfVL1w7f6p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718549, "uuid": "857ecf19-69ce-414b-8e87-ac1a512df8fa", "value": 84696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718549, "uuid": "3480ec68-2d1e-45ab-aa3e-78bfc353014a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718549, "uuid": "d4ee9dd8-85da-4cbe-9a51-9953eb1db24c", "value": "wj0s.mipsel-dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9349d9a4-aa2e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Amadey)", "timestamp": 1788725244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725244, "uuid": "194a8e2a-4b33-4fc7-93be-bca227b79257", "comment": "Malware payload (Amadey)", "value": "0521b02f1494d62f04e78eb4435443eb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725244, "uuid": "cca971a1-df65-4c8e-aa71-f6ac78c4e361", "comment": "Malware payload (Amadey)", "value": "d38f4c8fe3deb6338c561bebe8e7751c97e926907515128a4e579cccebee5ff5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725244, "uuid": "36a5a458-514c-4dfb-b8cc-92bb5e1c3328", "comment": "Malware payload (Amadey)", "value": "93e5f586ae99c7da4731b29f845af42294a04a87", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725244, "uuid": "e2968112-bb93-49f5-9496-e0f505efc4bb", "comment": "Malware payload (Amadey)", "value": "45a932f0afe5c4bf40e8085de47e386f7c615ebb889fc22f9e4c3f3ca90278860ef93d899cd2836c452b334887297233", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725244, "uuid": "ba7f07cc-5ceb-4469-8715-443a21d013e8", "value": "T1AB944C213817C032D56091715E7AFFF685AD6D258B7149EBBBC40E375E202D2AA31F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725244, "uuid": "6b76e37d-c7c0-4275-84a9-064edf0298fc", "value": "9de6be7a4c44b3d12f5f66ec980c3dfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725244, "uuid": "6c654043-f4c9-4b52-b101-df593aec96a9", "value": "6144:RJfjr/kDxy8zp5VBzrxa9+aTgQLQjB+a7d0fmkmZKasmGWzqFE5BUgAOU/vK5S4:RJfjr/kDx3z09xiga7d97hwgh5S4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788725244, "uuid": "754829ea-8106-41aa-bc81-10429505807c", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788725244, "uuid": "2ad5a107-757b-42b9-89db-3971076e51d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725244, "uuid": "4dfcdb70-5600-4f6a-8b35-0d0bbb49fd88", "value": "taskmanager.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0848e7d6-aa05-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788707401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788707401, "uuid": "ba38b5ef-2767-4b35-b1f9-bd371b4ebe62", "comment": "Malware payload (Mirai)", "value": "1203701a7686f121845372b2bd565f74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788707401, "uuid": "bb2a0aed-a4a9-46a8-a9fd-31b69d749906", "comment": "Malware payload (Mirai)", "value": "d45f1b24905f5f0639798524c8aa2e150e2ef65839bd30b7c015deac8032a13c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788707401, "uuid": "39eaa79c-5261-4bbc-b673-a8500fc4e024", "comment": "Malware payload (Mirai)", "value": "a2b263523df7d9129b122a05b7683088a58a44c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788707401, "uuid": "0051d257-1164-4d22-bedf-03f6f65c003b", "comment": "Malware payload (Mirai)", "value": "86bf6bec3b546c65f8c6bac133f0a67ee2f41414210b53be4c9c87a4d6df2b53c2c07d3b1f0e68d8b683423169c724e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788707401, "uuid": "05130e3e-84d6-44c9-bd07-5944ef73201d", "value": "T10CD32B01F9508767C2D213BAFB9E429D37336F68939B33255A347AB42FC17891E39621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788707401, "uuid": "f852351b-c27e-443f-abc6-1fccc70001f8", "value": "3072:Y/SSVnaFgzy3i1tc7VaSp+ixgihELVsRcqb70gjyKzmsQTi7aHgp:Yp1tuVaSsiELaKqWKzmsQTi+Hgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788707401, "uuid": "8fc88700-eba0-4fbd-80b3-48b6d45fc93a", "value": 131108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788707401, "uuid": "f9683910-0295-46f7-b155-6d7cb60c5bfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788707401, "uuid": "ca88d205-e9c8-461e-93ff-81f4f6724047", "value": "kworker", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a41beab9-aa46-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788735580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788735580, "uuid": "4a42acd1-69a9-49d9-ad26-e723b3088795", "comment": "Malware payload (AsyncRAT)", "value": "4293df021391096798350408310c5787", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788735580, "uuid": "5f523b8b-96fb-47c7-89a8-bf081f99fbcb", "comment": "Malware payload (AsyncRAT)", "value": "d53bfb43671e23ef1f925166938a2f4fb28ad163f88e92a26505aa2d56cf8977", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788735580, "uuid": "2bdaa0a5-d8a5-44a8-952c-3605f0221962", "comment": "Malware payload (AsyncRAT)", "value": "144d9363edbd6e354d14ed17ef2f04b60aa6f23a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788735580, "uuid": "d9de255f-bd65-4eb8-9cc2-97d42f2ed17a", "comment": "Malware payload (AsyncRAT)", "value": "fd8c0c88e8a23d4a1477560d0757e7189974281bb1072c706de2dfbbf4ec4b1dbff49cc45c6ad8523e9bb287082bb819", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788735580, "uuid": "90c29029-376e-4606-95a5-cb33d758955a", "value": "T104E2F1AFD70A872BA2F2917CC061335D332F248ED2F725016A284787B8C655F656CDC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788735580, "uuid": "76944d98-da31-4200-aa47-89e3cf3baa16", "value": "768:J4bfo5SafnBsbLufB8f0G+CLD+R5CAOs6E2jZycASFcwfc/:J95SequfB8fICyZ2jAcAoc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788735580, "uuid": "ae27b19a-6e87-4b67-b3db-67fa93d7f078", "value": 31474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788735580, "uuid": "d1dd648e-a1e1-4fcf-b1cb-0b03718f91c1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788735580, "uuid": "1e2cfc94-bf4c-4da8-baef-56e5465ba35f", "value": "d53bfb43671e23ef1f925166938a2f4fb28ad163f88e92a26505aa2d56cf8977.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56ac094-aa20-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788719261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719261, "uuid": "58b606ee-eb61-4fb1-932f-ef3706cbde45", "comment": "Malware payload (Mirai)", "value": "ee99a4a205086c847ce635220667c985", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719261, "uuid": "a4a9c123-f6f0-4505-bb65-13f5f2681ea1", "comment": "Malware payload (Mirai)", "value": "d5438e0eeff8ed567271a8624c4bd8787fe7aebb14fdbd48eecca3b5a30ac787", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719261, "uuid": "f20a83cb-0894-4821-acf0-2a03a94272e8", "comment": "Malware payload (Mirai)", "value": "186e1ea65e363e8af87db46b2f47b058259cb11e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719261, "uuid": "064807b4-f9ff-4245-95e8-366b5cae248c", "comment": "Malware payload (Mirai)", "value": "6c5f9a7c11febf11ddb87e8eed61165d1695f6be18f6897b0d4b4e39c3ade9109c9d9d8400734ec4536348eba144a559", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719261, "uuid": "d80aa9c0-4dd9-462a-a6a1-ec92f0d6e8a8", "value": "T101C3E185BB6369D1C0A242BDA4C01AC387916E318FE317080699F674387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719261, "uuid": "7e04c6ae-f6c9-4dfc-8807-00a5bbe70d57", "value": "3072:OBb4K+nqsnSjZldbaUXGSgqTWo1OWqEwztlMMTn9:0OCDjXG9qTWywxlxTn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788719261, "uuid": "34f52fd7-61c9-4dc6-a8f3-649d6581574d", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788719261, "uuid": "b0342ba5-fffd-44d9-97e0-7144ea7c6616", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719261, "uuid": "b51f8178-f02b-49c6-af65-e2dc28093413", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27045df-aa20-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788719256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719256, "uuid": "a0c82124-bdf7-4161-8c81-fee3100291d5", "comment": "Malware payload (Mirai)", "value": "168a18c1f210d04461e4927d56702e62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719256, "uuid": "3d3096d4-c63c-4dee-a177-f522562bcc47", "comment": "Malware payload (Mirai)", "value": "d57fcae50b51afee1980b663887103a7909b5633f15a8f20bf88bcabf2e39aa6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719256, "uuid": "8189be7c-e447-47ac-8621-5b1aba7476d8", "comment": "Malware payload (Mirai)", "value": "e1ca88a45109177cd8195189a5f7572873a26273", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719256, "uuid": "e07bcac9-48c7-4d08-acad-e9864a37b1d5", "comment": "Malware payload (Mirai)", "value": "a36a1a6e47c62e5ce58667090c046194da7870ddc42b33107588477ba2efaadef18d05a5195a9bae491020303add1b18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719256, "uuid": "5309eacf-7cdf-4366-be6e-555058537990", "value": "T1DB73127221A7DEA1D572803363877E8DBD22847A037853BDBC78A72FB4C2E15580D55E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719256, "uuid": "d992c6e2-c158-40fb-9af9-e8a8fe763572", "value": "1536:n8zRnwvX0/jMQwZuOPFPijvDMwhQi1rYGhQZ9zWmforO:8zRnwP0bMQ2RijvDZZ1rYGhG13fSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788719256, "uuid": "fb35c804-4f82-471c-a353-337b3cd41ffc", "value": 74772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788719256, "uuid": "5c820ab8-1e73-4498-9b42-d025772f838e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719256, "uuid": "dfda24e7-7a2c-4925-8e30-dada98d6a087", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1a25910-aa06-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788708195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788708195, "uuid": "e46e2757-f78a-4ced-9531-6cc5ac407ce8", "comment": "Malware payload", "value": "27e8406b7fa2f1fd0b2c68f8661753e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788708195, "uuid": "2f978acd-942f-4006-8f59-b2a1f1028dad", "comment": "Malware payload", "value": "d62c9df41e46a933a2e279b95c22e5c2ce9cbe348dc8ddb6fd0165dac6ff6de0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788708195, "uuid": "0c7e8ea1-a37b-4484-8c03-c1ba82ecdfa1", "comment": "Malware payload", "value": "489de9588ef0d01fda902ca75aedf4e6a80c475f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788708195, "uuid": "bcc91647-914a-4f80-8b1f-4a14a8563d39", "comment": "Malware payload", "value": "88ae88cdc16bc1b31fafd15cfbb10b72253f9e75169719753a2b97844f8ee160b74ec38b311344a8ecb95f0b07c6a5c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788708195, "uuid": "57797c8d-9ff5-4768-bf68-0a33b0d669e4", "value": "T15ED523C965F22A35C83BC7B48F46F47CB02D7B824AA45C4BBBD97D405D620A4AC363B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788708195, "uuid": "8bb64602-4ea0-41bc-853b-e5d3fab56489", "value": "58f4b17816a07f7a36dd14e504d515e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788708195, "uuid": "6fb20941-36bb-43f1-80a8-175887f1c37f", "value": "49152:N7oTJVFH/dZKn5wztxWjdN9HVaVqvIxaFcQSz4cqw1tTdWYcXlop:N78JVFH/rKSaje0Qxq81xA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788708195, "uuid": "f9c802d9-745c-45a2-b71e-21136af9cd02", "value": 2925568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788708195, "uuid": "65110f51-ddd4-4ba0-9c15-9b626eee3307", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788708195, "uuid": "d8d920fa-4ecd-44ca-bd8f-1f5a240b615e", "value": "d62c9df41e46a933a2e279b95c22e5c2ce9cbe348dc8ddb6fd0165dac6ff6de0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc89db4-aa1e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718527, "uuid": "6d9127be-2b47-4769-a2de-c84f1f6d49df", "comment": "Malware payload (Mirai)", "value": "c72e046c9ff0cec3dc877f9464edf7a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718527, "uuid": "1f769dfe-9856-4b46-a752-f445968e5356", "comment": "Malware payload (Mirai)", "value": "d77dc5c7c6f4e8afb7713f09164ec720c689bce019c0bf5d2bcc5fafebe11a43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718527, "uuid": "a79c3ad1-8a56-455e-8f91-2003c44d1402", "comment": "Malware payload (Mirai)", "value": "ce7e071c2960c34b876e65e5811cb9c274a4fd0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718527, "uuid": "f2d947fe-7725-4b33-b51f-a9a21aca93f1", "comment": "Malware payload (Mirai)", "value": "d82f8faaf3d50c855cfc284fdf8793c0d90afb6cb687aacf6d6259ccf022d5b87306c5784820d96e9f8c7c4cb142440e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718527, "uuid": "ecdb3471-e9c6-465c-91ec-72afc6e54441", "value": "T1B0258D6BB2B374BDC157C1314BABCBB56934F07501226D7B22C496382D16EA04F1BBA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718527, "uuid": "ae28290c-dff8-45df-a77a-df38cfe5a9ec", "value": "24576:s17JR17Jq17JR17JM17J917J917Jl17Jv17JT17Jg17JI17J317JBAb4uMQQ+8Oj:AAb4TQQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718527, "uuid": "33d2de6e-b750-40ed-8cbd-fc80fb72afcd", "value": 969480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718527, "uuid": "0b900512-d6e8-498b-bdf1-65c57afb0c1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718527, "uuid": "2152f39f-483c-4ef1-966b-746929c0420e", "value": "mirai.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14071f32-aa20-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788719017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719017, "uuid": "60cb12f2-1737-4af1-a7f1-797fca0253d9", "comment": "Malware payload", "value": "f2b1a5669d4c490f47e5d2eea8a4b065", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719017, "uuid": "96c35219-56a0-4a9d-99d8-09851f0c134e", "comment": "Malware payload", "value": "d7e457c2d482a6a78deddf86ff373e3ecbfaa22c2ea28837cae5d1c40863a3bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719017, "uuid": "bcc50566-d93e-4cf8-bea1-95568a267a54", "comment": "Malware payload", "value": "2a7e66d223d12324d1851138b95cc5720f270bf7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719017, "uuid": "ff716a6e-3931-44a8-b777-8436cc31af70", "comment": "Malware payload", "value": "9aa9321185ab0512d1162c26b757b019df71dab7ffea33168087a0c78409d10009a500c571df48c5bb8d0d2c30d68bdb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719017, "uuid": "f6f17dba-e715-4d83-a3be-37082b756157", "value": "T1E7338EC7D643D4BCE9D200B12026A7B3C772EA2955AFEB66D358A931DC2393096173DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719017, "uuid": "e7073c38-ad4f-4d39-b9d4-cb6462d70d0e", "value": "768:2t95PUoE2QZ+o0XNaewNHtiW3H7JdxT3ObxU+83KutytBWEK+d0am7TQnXI/:iLy4XNa9ltrXRT3OlU4+ynWELTmYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788719017, "uuid": "966b0eb8-b2ba-4be6-859a-99ac3cd28bc0", "value": 50316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788719017, "uuid": "c45b0e00-84d9-4c2f-b18e-4f30b3d3b467", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719017, "uuid": "c88022a0-5e48-456e-bd4d-e6a7eb3ca9d9", "value": "rbot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bdc1111-aa1f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718601, "uuid": "9d4a6e83-08da-401d-923b-a3c6f53f324f", "comment": "Malware payload (Mirai)", "value": "51aad67cfd0df567cc23880668fdbedd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718601, "uuid": "bdce74eb-8fbc-48ed-b510-5401f1775425", "comment": "Malware payload (Mirai)", "value": "d93ce655674b4ed6ef3b7f1ac339ade597f2757da42851dd3515e3c4396f7423", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718601, "uuid": "6523fedd-a7cd-4bfb-a9e5-5d7e698d312e", "comment": "Malware payload (Mirai)", "value": "b3adddbce7bfaac742e86781f9fe6c7a871c286f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718601, "uuid": "1355cce0-8d2d-47cc-b12b-91f4d3525558", "comment": "Malware payload (Mirai)", "value": "784f6d91df7602644511453c718d6abf90d47f3aad32f632df1596794827b4823156b7f5d1b8949a9e4c23633e846c10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718601, "uuid": "adef4243-4450-4530-9a6d-bae89bd6add3", "value": "T145C37C02B69080FDD4D5D674832F9936D737BC4591207BAE27D07EB02E3AE292F0A790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718601, "uuid": "8b54e034-0659-4e28-ac7a-e1e57194d63a", "value": "1536:WdV0elRwFWGUx01RgMxPJYeEHTSANHc3Ovh8bqy2vvRy/QTeKwrmjoub79toorU:20evRJUPJczSANH3+uyav7Te3mb7vB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718601, "uuid": "2306c8e5-1325-446e-8e5b-94877461bb52", "value": 125232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718601, "uuid": "13db97e0-6abc-4ec5-9c48-64567e73ec20", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718601, "uuid": "6d1626ec-a766-4174-837c-310142b85c14", "value": "wj0s.x86_64-dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2786cd77-aa2e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788725063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725063, "uuid": "a5a3990b-361d-4db0-97f8-28eced328f1c", "comment": "Malware payload", "value": "15e582e08ab23708f6bd790335ef050f", "object_relation": "md5", "Tag": [ { "name": "Uacbypass", "colour": "#0960B6", "exportable": true, "hide_tag": false }, { "name": "vulnerable-driver", "colour": "#6E0B99", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725063, "uuid": "50a933e0-36dd-47fe-b7ef-5678748b88ef", "comment": "Malware payload", "value": "da074ef5707b4d685734dea298bf5ced3bcc0dbf38f7242f7e50ab4585b61d55", "object_relation": "sha256", "Tag": [ { "name": "Uacbypass", "colour": "#0960B6", "exportable": true, "hide_tag": false }, { "name": "vulnerable-driver", "colour": "#6E0B99", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725063, "uuid": "5945e77d-1a42-4062-b5cb-340163f37848", "comment": "Malware payload", "value": "886a790c5845f349e719fa1ac7b38d5be7dc1a76", "object_relation": "sha1", "Tag": [ { "name": "Uacbypass", "colour": "#0960B6", "exportable": true, "hide_tag": false }, { "name": "vulnerable-driver", "colour": "#6E0B99", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725063, "uuid": "94c70336-0252-4915-93ca-f27f5a966c60", "comment": "Malware payload", "value": "6540f52473279c70a9f3402b85e64e48f9f92217d5b5104ceb4f916b4201259e18de800a4f8727c475961bf3aac3cf0d", "object_relation": "sha3-384", "Tag": [ { "name": "Uacbypass", "colour": "#0960B6", "exportable": true, "hide_tag": false }, { "name": "vulnerable-driver", "colour": "#6E0B99", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725063, "uuid": "eaad1fb9-f99c-4b8f-97bc-6da21bff2ef7", "value": "T18C36338BF14F25AB0F8F4D412994899728B1626DF396F8AFB6C00F874B54D19342B4F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725063, "uuid": "dedc7b50-7b47-40c7-8511-efd33f595533", "value": "98304:JZIC3yxsnjMyxQLyP/oWEX9QtyEZQl271ysdl1Z6boYghC1ZdFj2:JZZixQjMyeyP/ZA9QLZQk7pdmoZhC1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788725063, "uuid": "05db69e9-32c7-4f7c-955d-3637c7d6b67b", "value": 5137722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788725063, "uuid": "3d214767-8fcc-4bba-a153-936d96f548b3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725063, "uuid": "ca05f0c0-8a1b-4726-a551-c6dc1b022072", "value": "656b90c4553ec077f0ff60bf35edee765dffa4d63d4e2148221f9ef1171bb437.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35abb10c-aa41-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788733247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788733247, "uuid": "a2077eb5-73e9-498c-baf7-22925b8623e6", "comment": "Malware payload", "value": "cb8e2842a2cb9ab155be0fb726f169c2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788733247, "uuid": "4edff1ec-7da8-4356-8bf3-86d6966c581b", "comment": "Malware payload", "value": "daff0b9de30438bb1578bb35e6c4388187ea6e7c9cc4a14ee3a0b9eb45a22c46", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788733247, "uuid": "2c13006f-504d-4db2-a7c6-b2920db80f3d", "comment": "Malware payload", "value": "d0d7aa5c4ed883f445108c906278e5393024c1cc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788733247, "uuid": "2be174f2-e9d9-49cc-85c2-86273c654cec", "comment": "Malware payload", "value": "fc03ae3059a86a321a7e517a2da238a3fc89764cac593bc77b718509ccf63dd62a5eef7ce720b8eb7cdb3bbf1252cd14", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788733247, "uuid": "61cd0e7a-e148-4fbb-930b-f41289b66fd0", "value": "T1EA236D6516857C24AA98C4371D7E2F0CBDAD43E6320492EE7FCB3CF28C5A69D910971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788733247, "uuid": "00e1a84d-acba-49df-9b99-06427a81979a", "value": "768:NXRWNGxV49GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:3lx7cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788733247, "uuid": "4513bdab-b9f5-4548-92fa-9a4c1edd6cf5", "value": 50063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788733247, "uuid": "2bc805fb-f0c8-4efe-a673-0146091e505c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788733247, "uuid": "e9b3bf5e-d841-4c86-bac0-17324b0db4e3", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4f517d-a9bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1788677501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677501, "uuid": "dc35a72b-e3d3-44cb-864b-c961cfcb1e05", "comment": "Malware payload (RustyStealer)", "value": "5ffaf6bba943919f085971df58c44490", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677501, "uuid": "55443413-68e3-46c9-8f10-48b49821a216", "comment": "Malware payload (RustyStealer)", "value": "db3b61268cd19ac28ef9ec9ea77074a0f2ad04b63bbbd41614bf9cea0f25be60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677501, "uuid": "7e9ca0fe-95fe-4bc4-8e30-0062322ef531", "comment": "Malware payload (RustyStealer)", "value": "faaa1ae159c977a418876b58b219b4591c9f363c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677501, "uuid": "f23e8eeb-59ac-493a-829f-58d89ae39e9f", "comment": "Malware payload (RustyStealer)", "value": "ba380a1dbba12d9c17acc3c79e465aadec24467b77f80379c1dda4006ccaa617c9c0721635774e2f817798cf6ab2550b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677501, "uuid": "6de4dc98-902a-42f7-b3b5-f0043084cd4b", "value": "T12CA6D231A682B07EC9C337BF3376E4EE2EFCDB01411979094E8EA958E7181C67395946", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677501, "uuid": "69ccaa7a-fc0f-4605-92b0-5c5a2af1cdab", "value": "5033788a2988669130d0dde48620bdad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677501, "uuid": "a17e6bf7-5adb-48f9-b8f2-a74d69a18bc7", "value": "196608:XTDf//FCpGb/r5fxaPKFbss73IRuKrXTJXMRSTkt0YdoebFCW7aLqP:XTDf//FCpGb/r5Jos7VKD1w/JbAWeGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788677501, "uuid": "a1853371-3c50-4bf8-80ad-57b2f60d6748", "value": 10206028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788677501, "uuid": "fe9a1900-f279-4e8d-adf6-d74300842089", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677501, "uuid": "6694e1f9-eb76-49b7-bb3c-bb0f4d7c9cac", "value": "crypted_SmartAgent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f16a72-aa20-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788719259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719259, "uuid": "39d07469-ff4b-415d-8439-80900e1bef72", "comment": "Malware payload (Mirai)", "value": "27572e7c40c6452a39fa924a50fb59e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719259, "uuid": "d4107e57-7296-4027-8ad9-afdbc99a5ddb", "comment": "Malware payload (Mirai)", "value": "de9af8c3eaa0c8e287f2d6269708f2141112e37c02d2b2ec72b7e10ec1db9940", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719259, "uuid": "29e1a76b-812d-448c-a13a-fcfcf6a21699", "comment": "Malware payload (Mirai)", "value": "38a675ff8ed8ef3472987565e8cd7d3af9d8deae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719259, "uuid": "23ac4f89-8a22-4cd8-8534-b03050790c4a", "comment": "Malware payload (Mirai)", "value": "12d7916c17d479152188fb0f37a42547a289c743ce6c3587e704acdb6f7e2bd263f94653b506bd55e53b06a04ae004b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719259, "uuid": "e3a597cf-86a0-4d2b-aa05-c34eecb6596f", "value": "T15EB3BF87B2907ABEF0A45E3FC4135E26A6259F705583273D71FDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719259, "uuid": "c6974489-4791-407d-9ce5-41b180c016d8", "value": "1536:tdNSXAeuUGWnKYUqwaJ1Xq/3A5hcB57laZeCNjHWBOdiyWT15Ov6fHzG8rSR:t3SrlGWnKTU83AQB5A5Liy36fCUSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788719259, "uuid": "f04a2098-c28a-4a41-a3f4-3952b59c6637", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788719259, "uuid": "11f5184a-97c6-4aa5-b604-d51db1d80361", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719259, "uuid": "8686cc38-0516-4203-8070-e90aff000805", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04fbe85d-aa19-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788715985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715985, "uuid": "bdeb144e-3433-473b-8177-3a6e90471271", "comment": "Malware payload (Vidar)", "value": "b9b07cbd302645d8046e681ad0a619c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715985, "uuid": "176df167-8638-4a7e-9ca0-1f6d5e9dafcf", "comment": "Malware payload (Vidar)", "value": "dea88bd77141defa1002ca8d454529ad3b7f6e41f78ee1a659d861c605aba836", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715985, "uuid": "747f5ccf-68a5-46b8-a2ac-2cb5ba8cd065", "comment": "Malware payload (Vidar)", "value": "dd5b16387ef13c00a3c348123a991006018cbd81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715985, "uuid": "ab309482-aa67-403a-862e-a5971af27ebf", "comment": "Malware payload (Vidar)", "value": "cc20bae102f4006c4a1e54207f9c6e361f3edb5619d7771fb517a7a9d4ff296ad59b04b1f6baef8a7a13824642f4a863", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715985, "uuid": "a7249e47-fa60-4a0c-b1a5-2bc464d3ff14", "value": "T183283343BC958499C46EC67AC96A83A2FBB1BC050F30B3E77E50B6642E777E01539718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715985, "uuid": "5daa954e-9c1c-4012-9a17-4f7d2aae820f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715985, "uuid": "546ca49f-af76-4f8d-a748-2948be7ff28d", "value": "1572864:42YEHfNcq9VcJVHpqygmhjbzfYF3y6M9hKgWY18NC8sjoY2ug1yRHxpmUEzzgLkr:i1qfAVoIhjbMF3pMLKG+CDo3u8yxvH4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788715985, "uuid": "a0e0eeb3-49c8-4eed-90ea-33af3c43f94b", "value": 97948016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788715985, "uuid": "39f4fa64-02d6-4250-97ff-eb65fc82fba2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715985, "uuid": "273693db-af46-4d79-b745-dac437f16f03", "value": "dea88bd77141defa1002ca8d454529ad3b7f6e41f78ee1a659d861c605aba836.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f9d7bba-aa2d-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788724835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724835, "uuid": "90aad3ef-7eb6-4fe9-a67b-e9e58596e8b6", "comment": "Malware payload (AsyncRAT)", "value": "118becc8a86008e134a5dacfa038768d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724835, "uuid": "900d9263-a373-45be-af12-15caafe2ef48", "comment": "Malware payload (AsyncRAT)", "value": "e17581ec73d1c5a0d2849b6ba44dc59117f41b0d490860bfbe556271635775d2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724835, "uuid": "28868246-b017-4115-9c0c-cf0d68567de8", "comment": "Malware payload (AsyncRAT)", "value": "fa4be7026002c36bc71c9b8e1fffa83dc5437180", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724835, "uuid": "1288258e-8757-4b72-9d0e-39d2b1017067", "comment": "Malware payload (AsyncRAT)", "value": "d603a287792f0e765975636d0a696ef999527a814a2ccb5ba81dababd58b99af212cd4e3859411061ea85caa28627395", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724835, "uuid": "8493e39d-2daa-4b89-be2b-833a0f5966ac", "value": "T14A232A003BE9C22BF2BE4FB8ACF26145467AF6736603D54E1CC451961613FC69A42AFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724835, "uuid": "11da03a1-ed49-4c5c-af7a-24d6a4b82a91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724835, "uuid": "5a6b290f-240a-408c-9371-10a4788b6d33", "value": "768:JuFfATEszatAWUqJaYmmo2q95+UOfSScWTzjbngXCiHDkxr9F4t4HPXaGcDZif+:JuFfATEd62K+llHT3bgXrgxZFmwXKdim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788724835, "uuid": "cd7b677c-dd13-43e9-a161-3de0538ce4e4", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788724835, "uuid": "3af4768b-3e2f-4d1a-a1c1-604fbb442e0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724835, "uuid": "34b4c3f3-9909-4969-afbd-e796c0dbefdb", "value": "GoogleInstaller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fbfbe53-a989-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788654183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788654183, "uuid": "2f53c159-3040-45c5-b446-f8b2bc09817e", "comment": "Malware payload", "value": "5e94a7bbfdcb5cb6e1b0e93f0d1d2303", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788654183, "uuid": "361e9214-0678-4186-8965-6df69d8e9e26", "comment": "Malware payload", "value": "e193de3508af192528cb2372ac4986909b39cd5c52a8cc219eda2fe55e421d1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788654183, "uuid": "48103e6b-783d-40ae-bce5-08ef3202891f", "comment": "Malware payload", "value": "2a79ae9ccf3e12d3f9c23e9db2f219aa98c0b373", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788654183, "uuid": "69ebfad6-682b-4622-a1e5-d0a11ba86b56", "comment": "Malware payload", "value": "28ffdb7669bd44ba92c013247dfc0dbcfa1578fed06346127b11bdeb52a7bfb2eb07c29557f1ab260b69ba732540d3ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788654183, "uuid": "dc353f4a-4b0e-4f20-83e2-2ce55adf584b", "value": "T1D4E523A6BDC23AB2F006C7F756A3A0BE35293F49D6528D0E77C96B015D136282D37349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788654183, "uuid": "330002f5-4ec5-428d-95f5-2c7a4964c250", "value": "5a2ed47d8c6c6433dbc831d38c92042b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788654183, "uuid": "f3fab9ac-cc72-462c-b544-c0a2529032b4", "value": "49152:a0NX2H5euAUHStOfj4ivBPQBgkG/Ap1UixMW+qteMzsVIKtPZX9HemBywA3FO8ou:ar5euAUHStat5PQikGSUiKethsVhtxxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788654183, "uuid": "eb75c4c7-33c7-41e2-b220-a4008f89076d", "value": 3082240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788654183, "uuid": "3ef1f4c1-ec35-4e6e-b589-499d5c74fb35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788654183, "uuid": "2da7c5fa-1754-4947-bc00-c5f995dfdd48", "value": "e193de3508af192528cb2372ac4986909b39cd5c52a8cc219eda2fe55e421d1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1a6273a-a9c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788680251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680251, "uuid": "62fa3797-9e6b-4ede-884b-3f5cafecda44", "comment": "Malware payload (Vidar)", "value": "18d67cbf9028d7aa30979722284cbe01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680251, "uuid": "b137adb0-5bac-4f51-b7e1-8adef2cf8cbc", "comment": "Malware payload (Vidar)", "value": "e236c4ea9190a43089206a7e2f44b2f529ff91583575bc8d0f7f885ad1b09a85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680251, "uuid": "bca44e9b-6359-4e4d-9798-2218cc816d5a", "comment": "Malware payload (Vidar)", "value": "12cab852705b425398cfea497e1292693866454d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680251, "uuid": "cffc070f-ac83-413a-9bc4-7308b8db7008", "comment": "Malware payload (Vidar)", "value": "c8b313c13e19f3132235584a66b3a9389ea898e94750bfc8e2405d696fcd19c52b2f619194bc60039f1e19c31c44158b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680251, "uuid": "732289f1-4bfd-4d32-8afc-73b509144e1d", "value": "T1AA2833076CD590A9C4965B35C57A6222FA75FC88CB3237E32E48B9741F66BC23CB5B04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680251, "uuid": "0ea0d09d-9b07-457b-80c9-51a0d352c392", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680251, "uuid": "c1ad3a84-b7aa-40f0-adaf-f51c28b6a1dc", "value": "1572864:imIH7HpNuufKiBi6cBX5XlTcCdHAnDPNzDXXs4DgbtGKIUtA5lEX1XIqYg/:9c7fuE8vZ5XFlgjNsj2cXIPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788680251, "uuid": "2dde5493-84c4-4966-9a62-7fa04a102ddc", "value": 100970912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788680251, "uuid": "e7d9c04d-ff7c-4868-8e77-8ffc97800dd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680251, "uuid": "c67e3482-492f-4323-b1d9-323a46947838", "value": "e236c4ea9190a43089206a7e2f44b2f529ff91583575bc8d0f7f885ad1b09a85.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d4e97ad-a9bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788675841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675841, "uuid": "f855a208-810c-4a68-9517-35a70f3c30a3", "comment": "Malware payload (Vidar)", "value": "bafefb3ec7c5c4c3f6613b462354ef30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675841, "uuid": "0f995c08-b07a-40e6-9c4c-241e3b0785a5", "comment": "Malware payload (Vidar)", "value": "e3daee6d103ebcdaaed14de39d66d7782569a6985ab843b7f3783a91e0b634a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675841, "uuid": "0efcdfab-839d-4999-9f98-f2b77db7a359", "comment": "Malware payload (Vidar)", "value": "579b79a52cbef90579ad9df492227554e559b026", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675841, "uuid": "debab61d-6bb8-4da9-84b5-a21c738a572c", "comment": "Malware payload (Vidar)", "value": "0107316e3c7eac57867721e1af909d8fdb9320f8d05f7ae612e51fb19e4ef8a37190835d3376b013fe75311c2d0d440c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675841, "uuid": "d7c82d7b-9fb5-46df-a19a-b5d7b8d0b209", "value": "T151183343F99541A9C06AD63AC869C262FBB4BC044F3177E73E50B6782E3B7E1513A718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675841, "uuid": "0f25394f-25ad-4be5-86b0-3ed42aac2601", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675841, "uuid": "0be6b883-63e9-4b4a-8ca3-00807cbd1e1c", "value": "1572864:4IAwVaz7QTagRzTpCp8SqgYrQcRfXj41c1eJ3qk9BCX20fM0uj2PBBrT:nAwsz7QegV9CLx8lf0X3B9BCTfM9iL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788675841, "uuid": "675a5951-1f13-43c1-8200-b4f541ea3aae", "value": 90607984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788675841, "uuid": "4b7a3f33-3d05-48f6-b322-4b624bd6de0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675841, "uuid": "37a2ce10-884d-4904-9a19-f11df2348824", "value": "e3daee6d103ebcdaaed14de39d66d7782569a6985ab843b7f3783a91e0b634a1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009fc168-aa19-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788715978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715978, "uuid": "0b82b842-b96d-4848-8249-4d856c47398d", "comment": "Malware payload (Vidar)", "value": "bb6f45293d8aaa1416d6d6536ebb524f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715978, "uuid": "7781403f-11e1-4164-b495-7e025261e602", "comment": "Malware payload (Vidar)", "value": "e4342abffa36087262a220ef0b47784be2c2707b1c27f6c59503563fdda80691", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715978, "uuid": "7226ce71-6748-4d25-80dc-df80b0e503d1", "comment": "Malware payload (Vidar)", "value": "09dadf0e6c2b9e53ee2c738243a8a108f72bb9ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715978, "uuid": "791c917e-c5e5-4bee-be68-7646317cbe5d", "comment": "Malware payload (Vidar)", "value": "5841ae93aa3dcfc995dd832ed07c79ee347589de61adf98864ceba7efe5e46e0c747b1dd143a8893686f9d2171e80cfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715978, "uuid": "12ad5e31-8527-4d8f-b756-99eb423d5352", "value": "T16C28330769D590E8C09B8675C9BA5256BA75BC98CB3173F32E44BA302F76BD23CB5700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715978, "uuid": "c4b05e1e-d4f8-48c7-a616-f28fdb57bea5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715978, "uuid": "507f4acf-76ee-4846-8d4f-65546fe7b754", "value": "3145728:B0Bs4xSPp8hfL275kb798cGk5KqHT2vg3TF:B0BFx3hekb7Wcj5BHT2vg3TF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788715978, "uuid": "8255dc6d-69e0-4c26-9b0e-3426afcd8ec0", "value": 100990888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788715978, "uuid": "7ceea121-018d-40d2-96af-17af2c8a399a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715978, "uuid": "d0379072-2731-4bf7-b546-c8d047352093", "value": "e4342abffa36087262a220ef0b47784be2c2707b1c27f6c59503563fdda80691.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689318b5-a9fb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788703268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788703268, "uuid": "69d7d598-7d4a-49b8-93bf-9f38f78eb065", "comment": "Malware payload", "value": "d9bde3621ea439ccd9e384c0fd6d4407", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788703268, "uuid": "947cd126-f7c4-4230-91e0-01fda4121e61", "comment": "Malware payload", "value": "e6bb8d9d5b10e9aa499d4e8f1042481ccb7ea6302f021c7fa4c40a2ef0fc96db", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788703268, "uuid": "7906a194-fb97-43f7-b9d5-8a34e4c46957", "comment": "Malware payload", "value": "b74a20f5cabe5ea4b0ca38bad3a0b229638b6d55", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788703268, "uuid": "bdf5dd05-95ba-46ca-a2c6-7bfbc54ad93c", "comment": "Malware payload", "value": "fd79b04ce0cea21e406c68f0355f2a4542219a7c1f40820d417554ffb8c310bebfcdd846ab677b7952ba2ee964d5d7ce", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788703268, "uuid": "e0d70c95-50d5-4705-9043-18aae0abc490", "value": "T121C27D956A867C44BDC98A3E4CBD2B0D6DF5C3D1324942AC3D8A3C71DC15FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788703268, "uuid": "65a4d363-0938-4944-912c-db9cb1ceb3d4", "value": "768:Q8vCB+25j6es8R2mG9FYpMSUpi+20qUpi+20YQX:Q8l25J2mwd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788703268, "uuid": "de3d805d-cc28-4aed-9a7a-c21823b50d12", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788703268, "uuid": "3e7acc88-1dd9-45d4-93ca-b9f8a5431762", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788703268, "uuid": "0c547a9c-3aa6-4a6c-8206-0f40766fe330", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc111f77-aa18-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788715971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715971, "uuid": "771abc49-9ce2-4f88-9b47-7075a9d5ae65", "comment": "Malware payload (Vidar)", "value": "235a8f1e561c790af0ce0545a9f01584", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715971, "uuid": "ff5f6a14-f112-417c-82ed-be30709bf58c", "comment": "Malware payload (Vidar)", "value": "e77003cdca8caaaec9a03ca610ec1096f1a25d30aaca99cbf9c0f57567144d4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715971, "uuid": "248daed3-8912-46fb-b72c-0196e48ef98b", "comment": "Malware payload (Vidar)", "value": "0c30efc36a08838bd8a22fa46a3fb67aed0c6dbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788715971, "uuid": "515f374f-7cd2-4d8d-8f9b-241b6abc1255", "comment": "Malware payload (Vidar)", "value": "593fa31726ce0cb1d71f61a8316597595287f594d14a4f185cbbe239556e4ccd604a8fe1b711f321d0aa70649df814b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715971, "uuid": "9787a706-7375-4cac-b488-a1b0f6864e63", "value": "T1B218330B29D590E8C09A4B76CA7A5256BA74BCA8CB3177E32E40B6701F77BD23D75700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715971, "uuid": "69cf0fff-5dd0-49eb-9ff3-98348acdae99", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715971, "uuid": "53968c14-c4c9-4947-aaf8-8e4c818bf47b", "value": "1572864:NEOboAmntVkrZWBByUU/RutluqaMIWXYZMbfV7PgcgS3K6Npon+xXQV2vdEr:Sgsn0syUU/Rut7aWXYJcgdn6TvdEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788715971, "uuid": "2f8563b4-64df-4729-aa3a-df43e0dc1297", "value": 92602280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788715971, "uuid": "885cfe6b-7e07-4d4f-86db-75d87b43d79f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788715971, "uuid": "a1035fd6-6e2f-4004-bada-60173d5a1635", "value": "e77003cdca8caaaec9a03ca610ec1096f1a25d30aaca99cbf9c0f57567144d4a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d69405-aa48-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1788736395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788736395, "uuid": "1ece4ef4-d12b-4ffc-9a28-e8f389460773", "comment": "Malware payload (GuLoader)", "value": "8f750668658c89814794b813a788ada5", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788736395, "uuid": "336e5974-d16b-4161-b31a-527b92d22a8b", "comment": "Malware payload (GuLoader)", "value": "e801f57192dae98fac7cefc90bc5da6332bc668a5a2d9addbf135427ccd0c8d0", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788736395, "uuid": "888f7742-0e1c-46de-9291-f45ee1223dcb", "comment": "Malware payload (GuLoader)", "value": "c8918d4cbc3f080db337d5efde2b8a75c493a208", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788736395, "uuid": "ff6395b4-023a-4742-85b1-f37f74b9c9eb", "comment": "Malware payload (GuLoader)", "value": "d409b2b5d42a4e1a91b6ebb40d3451da57c0e9a8d1b91ecf7795ff75a42e6a6007d0bceb8e872351423ade6204f4bc3f", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788736395, "uuid": "bdf4f077-1f91-47ec-a4aa-621d422e5c4c", "value": "T159535B34FA6D023B4D4B2EBDECC61E55C5BE9211112350F1BEE4630C5446EACA3BE6AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788736395, "uuid": "f7c9dbd2-2173-4e40-b0b1-c124adeb230e", "value": "1536:WQL2t2KHZw4v1JmkIVKz3e6AuPUaht4wwDVWo:jK2cu4vTIVs3e3uPUaTRwDVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788736395, "uuid": "7d6d17b3-c778-4580-a933-83c6096ca91c", "value": 62960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788736395, "uuid": "609eba9b-97c7-43a2-b27d-769427cd38f8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788736395, "uuid": "8ef98c60-c295-4a21-88ca-40c3c38b3a7b", "value": "Unstintingly.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9946551-aa2e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788725362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725362, "uuid": "8b9ee8c8-55cb-4566-8016-d7809dd922be", "comment": "Malware payload", "value": "0017fdb8b5d6e5ef908cad3412eef910", "object_relation": "md5", "Tag": [ { "name": "UltraVNC", "colour": "#2F35DA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725362, "uuid": "88ccf91a-7346-42f9-ac4c-90188bd0468e", "comment": "Malware payload", "value": "e8bdbd96cb33b0e92cd7bae8f64e6599627dc3df656fc0a31435cd2bc06bd9a4", "object_relation": "sha256", "Tag": [ { "name": "UltraVNC", "colour": "#2F35DA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725362, "uuid": "b78c72a9-0482-4b3c-aa5b-92559734b8de", "comment": "Malware payload", "value": "a2bcb0e1d872dd0f4db64c02133d00f7ae2680ce", "object_relation": "sha1", "Tag": [ { "name": "UltraVNC", "colour": "#2F35DA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725362, "uuid": "cc1e32d8-76a9-4195-9f95-f4ed02a38add", "comment": "Malware payload", "value": "bf116d1b342b48a51240cad2501f24ed3ad80020e59c4cc919dd7d254380f679d1e72832f607c2f369c34fb635fc0fff", "object_relation": "sha3-384", "Tag": [ { "name": "UltraVNC", "colour": "#2F35DA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725362, "uuid": "cfbc0e6f-1da2-47a0-a981-635f5601e1fa", "value": "T12244232435D8B730E838995FDF541C3DEF64492B9748FAC7644828BB125B751838B8AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725362, "uuid": "feab243b-c985-4d70-adf8-a87c8d1afb88", "value": "6144:GiN6DXyBxVhxC9QuqV42xUlihOm9Qf9o+skjOa:GiN6DCLVhxCeG2xUlicmGf6+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788725362, "uuid": "f3dadf89-c172-4d20-90e6-e31b03074b87", "value": 261670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788725362, "uuid": "1aff3694-0ae9-4300-9151-bc8113295940", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725362, "uuid": "64e88a67-59f5-4524-ac15-b539a7971945", "value": "0d736040f6fcab61ef390639d0f9deb1270c8b3492dd7abd9cdc8ec43a100364.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2447c8e-a9d1-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1788685433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788685433, "uuid": "947718c8-3586-4b0d-8244-c7a7c7a055de", "comment": "Malware payload (SalatStealer)", "value": "ab64f75f49ce7d82ce59d8bfb685a4ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788685433, "uuid": "78f5997e-1be1-4d02-b79e-a8a2ff0bb06d", "comment": "Malware payload (SalatStealer)", "value": "e97d66dc8b585de415aab8a17d0c7a59fa7d5c98edd6709f2c456db162057655", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788685433, "uuid": "d48f863c-746f-4d57-bdaf-e458f5174ce2", "comment": "Malware payload (SalatStealer)", "value": "87fe192c4cebf4b2e5fa872e73505beba7fd0358", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788685433, "uuid": "4e73d476-94e9-4e79-8c64-65499ee39bf0", "comment": "Malware payload (SalatStealer)", "value": "7e4cc354042147cc950f97e4bc7e977c2232d33f5f20202ad7cf5403e962d47d306af73aadc01b2eae448fb20c39619e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788685433, "uuid": "efdb7927-dfcc-436c-b1a4-8c4f76dd1e6d", "value": "T17D76B0B875047DE6A67F577BCA96ACDD13B617238A8BA4CD8064BBC30563335FE02805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788685433, "uuid": "8e704886-3aa1-429a-9855-95626c85151c", "value": "50b691c20e897d69f4cfc4a80cf7802e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788685433, "uuid": "3f0f9909-7d00-46dd-b3be-bd3f7861290c", "value": "24576:A8mPEhhxDfXZAkHvQZ1P7tydlrYPAUIp6MH2GLlWpsRRr1VU1gpEekQZ5bcuJbq7:AQDfXrg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788685433, "uuid": "1c6b14f0-ad0e-413a-b533-59eb25295222", "value": 7641368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788685433, "uuid": "2e176a1c-1f7e-4a06-84a1-8b3edf295685", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788685433, "uuid": "fdd17562-6e49-4ea0-8e4d-c206ce6e4957", "value": "x64Rain.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5120d7b-a9fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788703074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788703074, "uuid": "1eba7c11-7a47-406a-938a-1efc511e2e00", "comment": "Malware payload (Mirai)", "value": "0ba5fbcac62dea7821b490835e1162e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788703074, "uuid": "c845eddf-38a8-4c12-934d-1ea97545cd03", "comment": "Malware payload (Mirai)", "value": "ea6440b7c24a9747c0d468a87687bce72f85c55591915e3530d504b8d82b534d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788703074, "uuid": "e8d5a18d-4913-4603-9b01-782f4cae49b6", "comment": "Malware payload (Mirai)", "value": "702be4d418119d0564094d6029dc437591ccde6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788703074, "uuid": "e8b9606e-5d7d-4bed-9069-79b3cfd63ff8", "comment": "Malware payload (Mirai)", "value": "d2929656c16a21efc069cbb10bc256307fef831e55b06494d401adb42aa7e720ae7aa8db43b7c814f2a2c7f209461e4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788703074, "uuid": "dbffa61c-ccf8-4e56-b883-f7639d157f3b", "value": "T196337C85EAA3D1F2F4934931401BEB5E6B38DE354014EE46EB197932FDF2693861B20C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788703074, "uuid": "bf5ff55c-ce6d-491c-b408-50cdb1852e84", "value": "1536:+U49tTRqCOPQ346mH1eEyV2+ZZzIZM/aKUlVNor:+U4jRqC2Q346y1DyV2+bzIZ+aKuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788703074, "uuid": "3bd94626-1507-4881-86bc-ee6ebf116539", "value": 53956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788703074, "uuid": "2f7f73f3-4710-44e3-aa0e-2312e96bdd99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788703074, "uuid": "17fa16b0-70d1-4024-b513-f88dff164a7a", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14e0601-a9a0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788664386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788664386, "uuid": "e8a5f1db-154d-4df3-b156-61f08b542933", "comment": "Malware payload", "value": "7c7c38f48e8ee0ac6c36830466cdd68a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788664386, "uuid": "814d2d07-7ee4-4a7b-aa55-08eb0b3602d5", "comment": "Malware payload", "value": "ea8af9d5db3bfb32f7b0ae7183a3c2895e71985192e9437e4a8a24dedbf58443", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788664386, "uuid": "936d2184-465e-4d84-95f5-ed1489872f33", "comment": "Malware payload", "value": "eb3841be2ea0c607348a0cd117322a61ff85515c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788664386, "uuid": "c1cd3694-e6b6-44b9-b687-c86b08c3f987", "comment": "Malware payload", "value": "a32d5fcc49114b6c4f5a6cbe88275b725b72ecc0548537628115a20f472cf3af69e4cb6d8db0491ba2374d1ea234fe9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788664386, "uuid": "b8c0baf2-16f4-4f54-8046-1055cbb45049", "value": "T1A9D522DA64FA49B8C837C3729F83E47E713A37844AA54D9BB6CD1E008D539989C32771", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788664386, "uuid": "2c1df8e8-0e1e-4429-9816-95bfe1e1b6ed", "value": "58f4b17816a07f7a36dd14e504d515e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788664386, "uuid": "7f33d2f7-a9fb-45f7-943f-479bf23dd3c4", "value": "49152:CuBTENr6+kD6Ipf6Nadd6EUg+RbIgnCS49L2v9bnfouVZ4AfGq3:CuBYNr6+kD6Ih6gUgnf9LMbfouVZ4Af1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788664386, "uuid": "4bcea239-4021-402e-a607-c22be223b9da", "value": 2929664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788664386, "uuid": "f873271a-cb1f-4066-9eec-028b08bfd9eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788664386, "uuid": "ad450ec8-9059-41ec-92f6-be5c17bb0d95", "value": "ea8af9d5db3bfb32f7b0ae7183a3c2895e71985192e9437e4a8a24dedbf58443.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7fdb64d-aa1e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718541, "uuid": "6c917b41-701e-459d-849c-4d72ac95e609", "comment": "Malware payload (Mirai)", "value": "e8106932767c3d13fc570b1f4c6ec51c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718541, "uuid": "4104dd3a-686a-4470-80fb-1518db98c074", "comment": "Malware payload (Mirai)", "value": "eafd39b0b526c0ce20a6a7754b25d57cc8b1028a0d5a784fcdacd519abd831a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718541, "uuid": "fe865db9-7b33-40fe-88a2-2c906b8597fe", "comment": "Malware payload (Mirai)", "value": "d505b6788894be1b8f2b3bf0689e27410b268a80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718541, "uuid": "0295c6df-8af8-4dae-a448-83c58d5ca5f1", "comment": "Malware payload (Mirai)", "value": "51f83d8b15bd108e9dea3d0b450c221fdbf169f32ce6ffc23093ee21de1bdfdaf1c04004e06c19541f8516235a6f0268", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718541, "uuid": "d40db8d5-ee5a-4ded-b3cd-9303305502fd", "value": "T18D147C12FB581553C6421FB04E7B0B76935E58E30CBBE04C1A0ABF5916379FA52CBB89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718541, "uuid": "9b306315-a280-49f7-a857-a707a61f0219", "value": "6144:1p6Bviby13WTcg6Zj1AJSGcNJewPJYChihFv:O0k0hFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718541, "uuid": "02472bb3-2442-4026-a7bc-4118f118ab75", "value": 198016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718541, "uuid": "24f1e06d-b9ba-4a78-8ed2-e47671e57ddd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718541, "uuid": "c6cc04c3-173d-40d1-b83f-085e6485f242", "value": "wj0s.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f250ef-aa2e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788725003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725003, "uuid": "740d2015-872f-41a3-b635-84f86bf72109", "comment": "Malware payload", "value": "4f336178aad13fded5af40cc3bb5da30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725003, "uuid": "ff57e21c-b17d-4e75-8ecd-71c7aad923e7", "comment": "Malware payload", "value": "eb0e2b6424e5ec1eb95d183a0f7022ab8044bf610972105289b8113ece084826", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725003, "uuid": "dd442995-8b57-42b6-83f3-743f7ef7f7a3", "comment": "Malware payload", "value": "b99f3b8aaf00ce8e1e971336cec9313d835bc33b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725003, "uuid": "a69881f7-8de0-4692-893d-b69497a0e561", "comment": "Malware payload", "value": "9c192548c0ac03cd5d7efd821594b3cae240b7c186c4bf8ff6be3fedb390bc7452942f5eee275f7e109480ca0ee83f6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725003, "uuid": "a04c6c51-427a-4d84-aa59-6603dd968e21", "value": "T161763907ECA554E9C0AEC13189639562BF717C485B3123D32B50F6386F76BE0AEBA750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725003, "uuid": "c35188a2-0601-4b60-bcc9-7cf736d780e4", "value": "4e2bd2c481372f7ab13b83b63b424e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725003, "uuid": "3e0f7b29-af94-41a4-a47d-d340d2ee76c4", "value": "98304:zktiYkwt4pdBWYfr3CeaFOumvBh8huTAE:zbdwt4pjnD3CFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788725003, "uuid": "11170615-e8dc-4644-9966-633c41397ef6", "value": 7390208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788725003, "uuid": "26266955-2adc-419d-b00b-c25c48c79f20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725003, "uuid": "a0ec66fa-6766-4c93-868e-dccbfca99dcc", "value": "test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e912cfbd-aa19-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788716368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716368, "uuid": "a01d4ea8-f369-4645-b14f-0b67c447c515", "comment": "Malware payload (Mirai)", "value": "44a0891ac6fd9a7ea3d3105b3534c340", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716368, "uuid": "ce17f2ef-4024-46bc-9703-91e69bb034e1", "comment": "Malware payload (Mirai)", "value": "eb1e47ecd6f0a19c0494efe4c6aae271572a5757f3caa31144873649b62c48b2", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716368, "uuid": "acbb2c93-3647-4a90-b67e-a1338d27d342", "comment": "Malware payload (Mirai)", "value": "c49049e1030ddde6473665bdfeb36928a03311ea", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788716368, "uuid": "378b7871-c0b0-48bb-bdf7-b81e9b91eba6", "comment": "Malware payload (Mirai)", "value": "fb58f61690abf307709032aebb6c4c96641e1d94de2555973bdcb05a03cbf36ff615533ff4eaca48508ab60f9e666f8b", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716368, "uuid": "c2371bca-74a0-43f6-8b6d-82bdbdb1717f", "value": "T1CD040946B8818B15D5D112BAFE1E128E37232B7CE3DE72139D246F20778A96F0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716368, "uuid": "7435d9e9-20d6-4600-b3b9-259a2475ed43", "value": "3072:0/iKQiBuqVWOrNqPBhi5ta0v5GlB3XexcR5Ba91BHzfBZBwm4TatvwYk:UQiBxrNqPm5ta0hG3X4cRnaRzOm4utv8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788716368, "uuid": "d2e059ae-3f13-4544-91fa-a92834e0d798", "value": 182044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788716368, "uuid": "9b0b7689-7a56-4d6e-89a2-d045efd4ff8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788716368, "uuid": "5d793d9b-1788-4d31-821d-29b0f9d06cb6", "value": "qtm.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c5b246-aa2d-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788724689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724689, "uuid": "3b70622f-6726-43ee-9337-abac3be8da00", "comment": "Malware payload (AsyncRAT)", "value": "16a2b7f149c3196299232a6d30d414aa", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724689, "uuid": "c6dcb1c9-7ee6-47bb-b97f-1e8b449bc37c", "comment": "Malware payload (AsyncRAT)", "value": "ebd9d6ef8b792ba88aa5edbd9bc093ec8739729fecc8507c8d3b158c02f09024", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724689, "uuid": "929b6ecc-ca81-46ff-a08c-b15042f3d86f", "comment": "Malware payload (AsyncRAT)", "value": "9ee6f8b5afcdef110f24835004979b899dee94ed", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788724689, "uuid": "7c7225ae-4d4d-4743-b51a-9df4f8327d65", "comment": "Malware payload (AsyncRAT)", "value": "8da8cfe0161de25e94bb65c10c799264753d149a2984a311c0b4cb5da5872dfcd3fcf90b87a0386f813b0b9874ef5584", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724689, "uuid": "08febd34-4045-4598-a64c-a4c7bb599945", "value": "T1E5C22C0873E8C572D2FE4ABA883385009775D55B9913D76A6FC890AE2E237CD8B14FD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724689, "uuid": "b78f27a8-9bbd-49d1-a6b7-3d1257a8e887", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724689, "uuid": "1c972373-191e-41c0-8789-43a309af7bd7", "value": "384:ATdv2D9YfxWceOsVa/KFHbxFH9qbuUsDbQxnCJfJBndnjJ3KxB+:edvhi1VDHVFIbdBiBnOxB+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788724689, "uuid": "a500baab-8847-4387-a2d0-a91677e4ffc9", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788724689, "uuid": "1cc5d18a-7f43-4165-aab9-bdbf38c4ba99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788724689, "uuid": "ec59b31e-7a1b-4962-93c6-0834317e74bb", "value": "CM88APP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6348c7de-a9a9-11f1-bd95-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1788668040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788668040, "uuid": "b08af622-e628-43f8-95ec-1f24f0bd6c0b", "comment": "Malware payload (RustyStealer)", "value": "1eeb3ebf665197ce9a35fc1ac745c118", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788668040, "uuid": "0032ad0c-fdbd-4f55-803f-8cae9322f5fb", "comment": "Malware payload (RustyStealer)", "value": "edd33db4a56d62fc653f67fc589d3421a2ce6678b4a28f85077f9200d8f2ea8b", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788668040, "uuid": "94718ca1-c670-4236-91a3-284f96a9f7fd", "comment": "Malware payload (RustyStealer)", "value": "2b8ed70633be6e539cbdf7ac60b770aece2442c8", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788668040, "uuid": "06042478-5945-46c3-be42-32c5f554e907", "comment": "Malware payload (RustyStealer)", "value": "99a3d701bed2f66c40cc6c25a4a8e0144a1d0deaef120bb9e098b963262c163cf71fd5baa8dc262b6323542fd677ac71", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788668040, "uuid": "e07e4ba9-840f-47d4-8d74-44fb0acdfe18", "value": "T18B664B41BA6B58BCD557C87487468A239E2130DB0B36BAFF018486383F6ABF15B3D754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788668040, "uuid": "03045051-9d72-48f0-a359-f22385f62345", "value": "78b4191a12298dc481fadc827b5ec239", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788668040, "uuid": "63ec9eab-be86-4a31-ad39-514be49b331a", "value": "49152:L24aKFtcsHcQQSXnf3ngE1Dh3Y9NJYbqmmwqw9W0lKBwss+/SJLvXlDctrM2BNcB:8uJpqjLK9LvJcPcs7H/0pA6S+fXuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788668040, "uuid": "57804e0d-43f8-4f66-8077-3552e884ef01", "value": 6626816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788668040, "uuid": "c24dd7f2-e2b0-4988-91e2-30715f8b302a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788668040, "uuid": "a3e63cf6-5584-415e-9a7b-3d10998856cd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6044ef80-a9c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1788677913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677913, "uuid": "bf8663af-dfbb-4c71-bf80-8ef2d6dec898", "comment": "Malware payload (SalatStealer)", "value": "35c1fbfb56f3f242b196ecaa5fdefd5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677913, "uuid": "207a6939-b89a-4c93-9b8f-6aa7873b4419", "comment": "Malware payload (SalatStealer)", "value": "ee27a24d9413d94c06b34f78ca7a8f08bac18391cd06d3a2dd7355897c1fe91e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677913, "uuid": "20961155-f9d7-4e7d-a2c4-22b8271a7a0f", "comment": "Malware payload (SalatStealer)", "value": "f9aebdae36f1407cd7fa11aff61c13337c3a5a4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677913, "uuid": "d490f450-2e24-408f-bd20-aa961a1e6d39", "comment": "Malware payload (SalatStealer)", "value": "cd9e16d31db4bc8845e5c18595cd0d0911c7dd9a02add82aeda09b9c30781e02c27e8a522989933ef2e91fa12a909ba9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677913, "uuid": "49f9d8f0-9bde-40d6-adab-5aada60d1c0f", "value": "T11FF5333DE85CE69BC962E8B08C75E9C12C37E356C00312571E965E3787EA71A720DEE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677913, "uuid": "2e0b6a46-1eb8-475f-a1dc-e4d00b93a6f1", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677913, "uuid": "45b4acb1-12e9-4406-b745-364d83a72240", "value": "98304:XOreJnYKnE7OUBLGUVxhu7jYspR0cazoeYvGJ5Xl:eyJ/nuOUlTVz+qjzbYvQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788677913, "uuid": "e499702a-5723-4443-bca6-4e90b3b5dffb", "value": 3592704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788677913, "uuid": "c4b5ac35-c220-450d-bbb6-7f9914a993fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677913, "uuid": "b44f9d5b-0313-4d8d-98b4-3e1cce187a47", "value": "NewLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e4f791a-aa10-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788712136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788712136, "uuid": "a413fb29-5c58-43fd-99d7-cdcd555e757b", "comment": "Malware payload", "value": "dad8a94c35a1548ff5e90c338a0d4a2b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788712136, "uuid": "c0a89f2c-e0b6-448e-ab26-4fb8b622be9a", "comment": "Malware payload", "value": "eeeee04a1066f6e958cadf89005c14dc64b97ed4c0041faa7dbcf3881eeefe7f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788712136, "uuid": "6b0fbaf2-0c13-418a-a878-ecd33c6d3b73", "comment": "Malware payload", "value": "47ff613d00c66397db0a9e062b5021d2989f3d6a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788712136, "uuid": "65d4a75c-9aac-4d5a-9b57-e39d9d89889f", "comment": "Malware payload", "value": "b7738c84722f3aad9cd24a53c1d0c7c20098c33afa82adc00fecab3764957fb9e220b91688edf2038f4b382bf5e90595", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788712136, "uuid": "f869b2ad-bc81-4b96-a5fb-57cd3c30607d", "value": "T195236D651A857C24AA98D4371D7E2F0CBDAD43E6320492DE7FCB3CF28C5AA9D910871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788712136, "uuid": "6bcdb0e2-0973-402f-ac7d-4ccaafbeaa49", "value": "768:IXRWNGxVnH9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:clxJwcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788712136, "uuid": "ca6272d7-d77f-4449-b42d-618a7f9c2edd", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788712136, "uuid": "dfeca0c4-ca6a-49f0-917b-edf1b3963ab4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788712136, "uuid": "912f9815-f367-4019-8c1a-2ae916194491", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e889800-a9f7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788701640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788701640, "uuid": "da4f887b-4a42-4f61-b15d-7cd47bb137dc", "comment": "Malware payload", "value": "0df0ea4b281af3f8c38a046944bdb28a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trickbox_v1_proxy", "colour": "#4D900C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788701640, "uuid": "16d12ee5-f2c6-42b9-a24c-b70ed316de8c", "comment": "Malware payload", "value": "efad80a4a5db6d23b911f12e5a6c3b262dff5e88e0cb38f63397a488beecb2f7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trickbox_v1_proxy", "colour": "#4D900C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788701640, "uuid": "89a227da-2e06-4af0-8edd-843dec49fd03", "comment": "Malware payload", "value": "4e51cf3b724d01b7301c7d18a3cb9e43d48c72b9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trickbox_v1_proxy", "colour": "#4D900C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788701640, "uuid": "0bacece9-71e4-4504-aac9-97aa5ac92004", "comment": "Malware payload", "value": "00a5cadec9b6431c00f151a11fea4eb7daa835dab5c3dc82fabf152f5a59d792cecd0703b4fe8179eb29fb5f6a18d9a5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trickbox_v1_proxy", "colour": "#4D900C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788701640, "uuid": "a3a957f7-1f08-49e3-a205-c3e73287c224", "value": "T118062309E7E005BDE133D578CD878919E772BC4A1762E6CF1364A9961F273A08E3E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788701640, "uuid": "98ff18d5-8d82-4afc-b0e2-180627a6c73d", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788701640, "uuid": "333513b4-3449-4510-9ec3-672868daa223", "value": "98304:rKAcWSJiqy8SFqNJy5Sv4x1DGwIAHI748pyFSZ:rUW+mFqm5SvO9IAHe48Aw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788701640, "uuid": "74df2942-ed77-48a1-a505-5646dafdb356", "value": 3990141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788701640, "uuid": "0c57e50a-6ec4-4d58-810b-24c7348a871d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788701640, "uuid": "e4ec01d3-968d-43a4-aabc-edb8783865be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee713327-a9a1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788664838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788664838, "uuid": "667d1305-c2bb-4f9f-9772-2971a6003f8e", "comment": "Malware payload", "value": "869dd3e611dd67a29770d3bc70b55832", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788664838, "uuid": "136d502e-e029-40e9-be45-8e9eae395da4", "comment": "Malware payload", "value": "efdf997d603e1f4c4737f5f8d8f20be7e59669ee70c122555c0eb21f05fad9d3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788664838, "uuid": "d7d2c063-9f16-4095-ac16-b1c672730b4a", "comment": "Malware payload", "value": "4ac761bcff91f8e08c2a778a7f9cd37b43ed0787", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788664838, "uuid": "f5a2dfca-5f11-4585-8cb8-ffa46e94a7e8", "comment": "Malware payload", "value": "bf45a6c3f17b3e444bf2bd92e04ad1b2dd0545bc248f20db3a172698e92cb5b2e104b3f3d22a0616d6136632acabd832", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788664838, "uuid": "5f921b45-8f5b-49fb-9a3e-af9b1a8c17a6", "value": "T18BC27D956A867C44BDC98A3E4CBD2B1D6DF5C3D1224942AC3D8B3C719C11FACD618B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788664838, "uuid": "af7f7e8d-096b-49c3-b25e-ccff31b419ca", "value": "768:x8vCB+25j6es8Rg9FYpMSUpi+20qUpi+20YQX:x8l25Jmd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788664838, "uuid": "6d6bf5df-08aa-479a-b002-724a54da78bb", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788664838, "uuid": "c7921c7a-37d5-4943-bf8a-c42d052160eb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788664838, "uuid": "970fc478-6e08-4d50-9f44-b898a264b355", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ff6974-a98a-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1788654630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788654630, "uuid": "2fdc42ce-f622-43ea-b99c-0c9f68316050", "comment": "Malware payload (RemusStealer)", "value": "756d63bdd8c9a7e95caadaadb8a2124d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788654630, "uuid": "2aa90439-a985-4cb5-9985-f366ce95f005", "comment": "Malware payload (RemusStealer)", "value": "f02e2fefd74c7268e3aced61017173fff92e2a1d0e7eaf7807189f371fbfcc1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788654630, "uuid": "b1e5908c-65f4-4ca3-824b-70ef3a0d14dd", "comment": "Malware payload (RemusStealer)", "value": "4ae26b9ecf5250d6b1691d4006b629fa39d668d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788654630, "uuid": "96a586cb-1fe0-4056-8b1b-845ee5cb8b32", "comment": "Malware payload (RemusStealer)", "value": "0c89917867b96878716b5d11707091d4285983df404eec3887278666cdb4c963ac7bf7b79b94f96875867f758107a706", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788654630, "uuid": "014147a4-28b4-4c8b-8c3c-056ad803d059", "value": "T1F2152309DB9758F2ED729D709EABF37FA07C5D0288AE5E4BCF4005728C63A618139749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788654630, "uuid": "85a945d1-a5f9-488d-bb8e-155dd0da80f0", "value": "96ab939b3b55d317ed1968d099ccc72c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788654630, "uuid": "3aabc982-3de9-490b-a115-57b104cf1a77", "value": "24576:ABryAeeFFyIquTL85wq5WCpp/yey1C/ufS:ieebNS5Zrpyo/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788654630, "uuid": "5db33c7e-f7fb-42c5-bb96-414209d93a41", "value": 874839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788654630, "uuid": "15c29e45-46f4-4990-ab94-e74576c96570", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788654630, "uuid": "b2a3d0f8-9ceb-48dd-9552-6c78a7b4e454", "value": "756D63BDD8C9A7E95CAADAADB8A2124D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "299a678d-a9da-11f1-bd95-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1788688989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788688989, "uuid": "cd758e05-9510-44ce-8e91-bedbf5499222", "comment": "Malware payload (RustyStealer)", "value": "3e97366470762f6c6504c68e84048c9b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Facebook", "colour": "#D4BAE0", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788688989, "uuid": "b56167e8-c432-4731-8937-ee6f1aed9686", "comment": "Malware payload (RustyStealer)", "value": "f06aa6a0e33aa2a4b1730424ddf67344659522d53490079b31a8f2f71d4e9428", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Facebook", "colour": "#D4BAE0", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788688989, "uuid": "2a417882-baa4-4135-8646-d158b6b61175", "comment": "Malware payload (RustyStealer)", "value": "f24833663dcbd79b22a91f480f5453bde617ed7a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Facebook", "colour": "#D4BAE0", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788688989, "uuid": "5eb2589c-84ef-4980-839e-e19392dee696", "comment": "Malware payload (RustyStealer)", "value": "249d20575bf656de4eebfb0ac3b90b87ba991fc405b85f9fc0ee280a8588f6010db0c29d825e62644b3689a5d0041285", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Facebook", "colour": "#D4BAE0", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788688989, "uuid": "28caa136-ecd9-48ec-bf27-363cdc58deb0", "value": "T13646331346A4862AF1B10F305DF6C5E3D8343C861E58479F2156FECA6B333D2517ABAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788688989, "uuid": "5961b887-e762-44f9-a920-b4276667d43c", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788688989, "uuid": "f812b490-d2e6-4f14-89cb-ec0a8f6b1ec1", "value": "98304:D+qkkk3jppaLwXIDbTQ8KdAyz/htde/+crsc1HmUZVoHw+vVpQ9kVYJx3NqndY9C:D+qd2TaYGTQJ665tde/+yE8VoQsVp7VZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788688989, "uuid": "da66478b-3ec2-4797-9df5-4a2f4ff4f548", "value": 5822464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788688989, "uuid": "3a5f5650-5bcc-457a-9cc3-22bf7e8ca884", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788688989, "uuid": "553db32a-d1c5-4bb4-bdcb-03e33e36f650", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0ec8933-a9c5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788680223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680223, "uuid": "80aec052-7a1d-4e5e-8dd8-0f2cf6f5bf08", "comment": "Malware payload", "value": "9742f9aa524f32c4d79065f1005a73a6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680223, "uuid": "84b501ae-d583-4e71-aae8-ff0313c95e21", "comment": "Malware payload", "value": "f111c1aa2a6f8a192b8b1d2ba1d8dd86c5d46a8ade52b3a2aef0a7707dfd5aab", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680223, "uuid": "534bfc1e-c6e1-4fb3-b385-09e4cb99d446", "comment": "Malware payload", "value": "be253a8e62fef1f9bd67d0c92883ad2ce5f64b88", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680223, "uuid": "f26022b7-1d15-4c0b-b86e-1532966cdd08", "comment": "Malware payload", "value": "27e0cef8fbb2182ef4d84df918825212aa3d1a6b2ae4528962f80590b3e6dc956b3ce054a4583963d51c8ba817dba845", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680223, "uuid": "fbfb633c-0a7a-477b-9ef8-00f9debeeafc", "value": "T11B236D651A857C24AA98C4371D7E2F0CBDAD43E6320492DE7FCB3CF28C5AA9D910871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680223, "uuid": "62904a1c-0fc1-49ab-8bc1-f6f81e6822aa", "value": "768:tXRWNGxVwE9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:XlxKpcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788680223, "uuid": "4bafb359-24eb-4f2b-b727-8cac6ce095f2", "value": 50071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788680223, "uuid": "f812f4ff-6fb2-45cd-8fec-25df8e2253d1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680223, "uuid": "377245d4-f478-4caf-8823-e15dd8d91a90", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d703f6-a9eb-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1788696634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788696634, "uuid": "124f6b70-b643-43c0-a639-e19fcd3876ce", "comment": "Malware payload (ValleyRAT)", "value": "1583d328a3a49c1e6c443a23a6faaa6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788696634, "uuid": "70c25a02-025e-4dad-b035-a5110e0c34cb", "comment": "Malware payload (ValleyRAT)", "value": "f11ad1739e537bc1b94e02e3d07febe2375606142107619c6f589e5ec288fa52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788696634, "uuid": "f3b9b7b6-a1d9-492a-b5fe-d161b41d18ee", "comment": "Malware payload (ValleyRAT)", "value": "ecc01d6e9675666dcc92bd8b22d4916e58f4640d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788696634, "uuid": "fe270851-0ef4-445d-9224-dbb98872e8ac", "comment": "Malware payload (ValleyRAT)", "value": "00d7e07ae6e496505f2c037e4662e523d9aa7368ea025949ab527477290fa4ea89865d7593ae46e504f704c42412645c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788696634, "uuid": "a05b9fbd-3b17-4d00-98d8-85a27c91a239", "value": "T1716733525B478178FFA808329DB926A97D64FB6738F801002DFEE18DD9356DD10F2A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788696634, "uuid": "ac8eeb68-e2c8-4afc-9d62-7b47b9d88c86", "value": "48aa5c8931746a9655524f67b25a47ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788696634, "uuid": "0f3c2444-5b43-40ec-adc4-6cb70f253cf1", "value": "786432:e29nutepbLUuy0Y0HZD9ZfN9YHrK0NPqBQnmC:e29uKw0Y0HZD9ZlqLK0NPqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788696634, "uuid": "3fec5217-f900-4f87-8b9d-9c485ca70b6e", "value": 29746172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788696634, "uuid": "458d1297-fea9-489d-8d07-64bdbc5431cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788696634, "uuid": "cdc6f4ac-a75f-4cf9-b247-877401191425", "value": "lastsvkpc-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6e3f7c7-aa20-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788719264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719264, "uuid": "3261d44f-381f-4247-8f70-025ca1e5bf36", "comment": "Malware payload (Mirai)", "value": "707d721dbb601fe561c3596de5f182c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719264, "uuid": "2ffacfd4-c5ab-4ef4-a989-8688d18d64c3", "comment": "Malware payload (Mirai)", "value": "f12b5c6131d8037eaa1261f62c3035c40c8a5c4abe0cb15611b30a089599fd7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719264, "uuid": "b017bf55-41e2-41d2-828c-c27566b46fb9", "comment": "Malware payload (Mirai)", "value": "5f6ebda3d52a755847b72816ffe7b58b7cde8e49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788719264, "uuid": "1a789a40-8f8d-480b-a3cd-ada63c2924c6", "comment": "Malware payload (Mirai)", "value": "22f074144e8bb2e1827b4dda808ac0062d0678f5c592d68e391edf023bd29ee87e94db0a8ec552ec2eb1cce7ecec1bc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719264, "uuid": "269988e2-7c3f-471d-94ad-2cfa488c6f3f", "value": "T1C7B3E085B210AE55C02672FCB1870A9093B17E7B4B9A150B4473F5B46DBCCD47E0BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719264, "uuid": "dc823599-87d5-4e6c-aa27-21adeec8d81c", "value": "3072:jx63zpjhO5z01nCU375P5wk5SOez7wuy:as5zqhr5Nzy7wJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788719264, "uuid": "353f9b28-49cd-47a0-bfcb-7b5b5bf9bf6a", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788719264, "uuid": "33445ede-b5b7-465c-9560-6d34f14fd2a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788719264, "uuid": "1a0762a0-90bf-4912-9d6f-b313df4f04f4", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c51e58cc-a9e4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788693544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693544, "uuid": "4dac0eee-2a7d-4b14-8836-14100d5d64a2", "comment": "Malware payload (Vidar)", "value": "6b78b171402c556db2fafe2d335ce4bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693544, "uuid": "c9a0a344-c98f-4b59-aea1-7aa2c66745ea", "comment": "Malware payload (Vidar)", "value": "f1c312605b3fda5b3d5bccf7e2ef5c2a0cbfa12126888a4c20fd2e7388d93e25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693544, "uuid": "5a965da8-d9f9-4a46-9daf-58abd9637207", "comment": "Malware payload (Vidar)", "value": "9834f7a126e638d518b81defab3a17f2e68586ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788693544, "uuid": "b818a06d-3a28-45ea-82ca-cb6d22d848d1", "comment": "Malware payload (Vidar)", "value": "53c6fbb3a5b4d45b60e84e83d862beff3991c7459dbd38633cb374aff61412680b7fe7f8f38787124f111c8a378b4acd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693544, "uuid": "7949f5c9-0e44-446e-9278-c0cbf6faa8a5", "value": "T1D428330769E590F8C19A4A75CA7A4265BA35BC98CB3533E32E40F6701F76BD23DB6700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693544, "uuid": "c6306389-827c-40bb-9ce4-ea873457eeca", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693544, "uuid": "7c87a4b0-2b69-4160-87e8-3d2bb48d3e53", "value": "1572864:NaNzCbk2CCPc2zW1Y5+zJIJMdASs7tvNubOItOs1a+d4+56qEJF:ANCbk2BkdYyw487p5ItpRd4KAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788693544, "uuid": "db16ff0e-8d74-4822-8d0c-e854d9250e40", "value": 94699432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788693544, "uuid": "9e4d227e-f29e-44ed-bec5-a6cfa49327e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788693544, "uuid": "d2204b92-5516-4e64-b562-f87af7772164", "value": "f1c312605b3fda5b3d5bccf7e2ef5c2a0cbfa12126888a4c20fd2e7388d93e25.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da3bac97-a9c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788680266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680266, "uuid": "0098ea4b-a84e-4616-85ca-62472ab7c4b4", "comment": "Malware payload (Vidar)", "value": "433c6fe2a073a1cfdb5b7586c31f2af7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680266, "uuid": "e736e242-b154-4bd1-8454-3be325e1df87", "comment": "Malware payload (Vidar)", "value": "f42f6fdde44cbe1884dbeae4691c19acf9f2cc2656c24e83c7c3821a179c796c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680266, "uuid": "c627dbf2-6b38-43be-978e-4a8ce3ce9951", "comment": "Malware payload (Vidar)", "value": "dc4b1b0388be4ba0cb5328e7c9524307cfe7bb5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788680266, "uuid": "0904c6f7-84ee-4bae-93a0-9f40424e26fd", "comment": "Malware payload (Vidar)", "value": "a54532d2aeae3f621a30e65f62ffbe5e275e0f9521d763594c411e6e88305c905bfd7bc451076625bcb3c1f5b0613382", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680266, "uuid": "50febe68-2d0c-4b9d-af6b-2c853a64be41", "value": "T1A41833076C9590A9C59A5734C6BA2222FA75FC88CB3137E32E44BA741F72BD13DB5B04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680266, "uuid": "3f516d0a-257c-46a2-b393-8a04d68af969", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680266, "uuid": "7bc044b6-9e1d-475f-8c92-acdec318be42", "value": "1572864:imqC4cB+pa3wqyzLsnUJ8SYso+8eDPGJ6a/+H6ibKjznQZq3HnWs4:9AcBj+3gO98cSO/G8ZqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788680266, "uuid": "f0116ba9-6723-4cf5-b84d-3d2708fe7140", "value": 90485152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788680266, "uuid": "2b42028c-61e7-41e8-9404-fa651bf8b7f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788680266, "uuid": "eb4f8cfa-0fd2-41cf-8e95-d5c65984c22c", "value": "f42f6fdde44cbe1884dbeae4691c19acf9f2cc2656c24e83c7c3821a179c796c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f961da-aa1e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718536, "uuid": "4b007358-d90e-4c28-b676-9aa6a7fba255", "comment": "Malware payload (Mirai)", "value": "b8645221355559139deeff8e78f82b96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718536, "uuid": "02c218a1-5540-4cd7-8239-933fec0ba746", "comment": "Malware payload (Mirai)", "value": "f4c979eb66209dd7057f193d3a79d37d5457dd5af990e2d9fd879b7249c7cb85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718536, "uuid": "03a08c6f-8581-4b76-910a-d987852a062d", "comment": "Malware payload (Mirai)", "value": "dce15b8f0eb6fb3af8b78581422ca3a7e610747f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718536, "uuid": "3c569565-d0e4-43aa-ae3d-2dceea7342d6", "comment": "Malware payload (Mirai)", "value": "bc00aea2353ea890773cbc72d1f753e4e30a514b69bf9358bfd6ccd6803894bcd72319fb9332aa7b9ab8804817ddbfc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718536, "uuid": "d7ce3dd7-dd06-4824-8b25-d1b9575c2a6e", "value": "T1999312251B132467FC7640F882CD175255F20EBCB30E2D4A8266D8676D0DEA1369BAFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718536, "uuid": "bb2abc7f-af16-461d-af20-040a43320fda", "value": "1536:6xY7h+SZf6Z/Qid5cEnqIPGIH7GM9o8qf47a8JKTxOo68woUQiZLsJVEWB:YYrf6ZIid5UMGNOmQbUdOVfXZAJVE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718536, "uuid": "957beae9-4ef8-40c7-8717-18d9394db6a2", "value": 97172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718536, "uuid": "293526fb-22b3-4648-8f3d-4ae2244c3a0a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718536, "uuid": "1b0fe6af-bd27-42c8-8e12-dfef17932196", "value": "wj0s.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb41aaf8-a9c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1788681153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788681153, "uuid": "fe0cf5b1-e41d-43c1-9200-a47966fe2736", "comment": "Malware payload (Formbook)", "value": "f1e09896a7b477c2573c2c8d28a3a305", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788681153, "uuid": "bc5434c3-0cf2-4cfa-ae4c-24ff784b8eb1", "comment": "Malware payload (Formbook)", "value": "f60f8d66ada9a63ee4ac722577bb6a38c653f438c24091f4f9cf72040561d137", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788681153, "uuid": "2b8d19b0-74d1-41ff-841b-4785c54254e2", "comment": "Malware payload (Formbook)", "value": "0832daf97db3c4010cbcfbfd7be88e4b4c762117", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788681153, "uuid": "4722314f-5607-48ea-b835-b36dfe2bbb69", "comment": "Malware payload (Formbook)", "value": "96accd4d11af2b31f58dcf662324d5b1f9dd94fa86ec911107964b5185fee57f2ea273aba8d16d0fcf96eaa81beb1fe4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788681153, "uuid": "4c42fffc-7c97-4dc5-a799-faa748636f50", "value": "T116F5284403619ACA76FC162BCF2A7EBE7614470B5D61EB0733FCE9897B5CA603326164", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788681153, "uuid": "82ad489a-d70b-42da-9878-f89bdd2a263b", "value": "98304:+Y3r0L50Cw6HynbuEmJbNC+TmHwgjNOGYqjK82CmIIFU9OBduMdGZ:N0LDwznbupjmfxBjQI9o9do", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788681153, "uuid": "4eb8c07d-b60d-4097-bd2d-b1aaf9011ad7", "value": 3637745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788681153, "uuid": "a42b4d5c-40b5-43c2-8439-d53513b7ab23", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788681153, "uuid": "03681b39-6fa8-4c06-a189-03d91127ad89", "value": "I-O Tender 1248760u.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f13fe81b-aa1e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788718529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718529, "uuid": "6850f6de-79d2-4d84-b6c1-c8fa87bf3815", "comment": "Malware payload (Mirai)", "value": "10853f8298dd9b9e3bf99009789094af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718529, "uuid": "13fd1777-9df6-49f3-abbb-840d0dc2a40f", "comment": "Malware payload (Mirai)", "value": "f6a41e926a8692787e859da9080396d1859ae7507524255bdd6fb55805c7dd85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718529, "uuid": "ef705e16-4fb1-4e31-b7ff-bd4975cf2170", "comment": "Malware payload (Mirai)", "value": "d1ca14ec371539746e9966b551f7fb898df4429e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788718529, "uuid": "f16851d4-bebb-46f9-b75f-5597cfe5774c", "comment": "Malware payload (Mirai)", "value": "a47956d72d41783e1e112e7da5983b2026112f7085ae8a00c008ee65cb8921eb757d567f108b76b0c427646a03eb9921", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718529, "uuid": "e3676045-fe22-4946-b6c4-d57ceeddff13", "value": "T14CF44A49F8416B26C6D132B6FA2F424D732747A9D3EA71059D2457383BCBD6A8F3B201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718529, "uuid": "c023cc02-3593-4883-b139-debb6efc9281", "value": "12288:iqUa9z62WUtCYDYGW6s54WT10qIqqKPtLNuGjpSIDwzm53X4w+IN4Py0:iqUaNWUtCYWthu5BQH4w+q4Py", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788718529, "uuid": "30d0238f-229c-4d15-b6fa-fcd7fb84721e", "value": 731052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788718529, "uuid": "1e2ad42a-a1d8-45ac-b2ef-602910ee1ba1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788718529, "uuid": "9381e8b7-e0d0-448c-b7b6-24b49850b6db", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c81578-aa0b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788710241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788710241, "uuid": "ebb59336-1075-4819-b53d-d0dec4da92c6", "comment": "Malware payload", "value": "0fc3648b9ab5c915d1a8fe2b4f28e836", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788710241, "uuid": "89340c84-7ca3-447a-8c6d-125ffeeaa368", "comment": "Malware payload", "value": "f7477bd7c7682fdadd99a5dd9ed2290797b906a75cd155ae83b7745fcbefc080", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788710241, "uuid": "d6c64ba8-8d34-40eb-9c42-2b8b37039bff", "comment": "Malware payload", "value": "15dae6de75691b72510451b379d13cfa6f9cd0c6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788710241, "uuid": "7cb837a9-4be7-432b-abcd-24458585d51a", "comment": "Malware payload", "value": "48921d3958ed2a745ff86f396066ddba63ec7bfad1866bfd4ae037232d565ce5796d0122d1a67b79bf7157f2bb578653", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788710241, "uuid": "7dc0aa57-273f-4aed-ba96-9e03889efb81", "value": "T10BC27C966A867C44BEC94A3E4CBD2B0D6DF5C3D1324942AC3D8B3C719C15F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788710241, "uuid": "46527827-28a3-40ea-bc29-cb813bc5a292", "value": "768:OB8vCB+25j6es8RO9FYpMSUpi+20qUpi+20YQX:w8l25Jod2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788710241, "uuid": "995b61da-c381-43dc-befa-85ea962848c7", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788710241, "uuid": "5aacb865-8106-4d30-8183-3d18faf93def", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788710241, "uuid": "1a317a2a-4995-4193-b24e-49b70f7faefa", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c34ba2-a9cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788684503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788684503, "uuid": "bccde526-d710-40e4-8bc7-298bde0d816e", "comment": "Malware payload (Vidar)", "value": "278203d2523314b703c8bc6b433e97c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788684503, "uuid": "52a49882-ea13-44cf-9bf9-c786a32faa02", "comment": "Malware payload (Vidar)", "value": "f762090080981fe38899e90a2d4d70b9455b9e01fa1d394e12de493ee3f75b10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788684503, "uuid": "869eaa1a-b99b-4ae4-bb3d-8e181d3b684e", "comment": "Malware payload (Vidar)", "value": "69e935d73388a6f1db94b8c81f1489f68e625c43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788684503, "uuid": "48482599-9126-473e-8081-425d2be9508c", "comment": "Malware payload (Vidar)", "value": "55bd37719a4bf6c4cf36e42d35946141a00dfa8ff198a9785aece5af1a6349db8599cb798285e99facd1dc0062420f7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788684503, "uuid": "e03304ae-bb26-49b5-9887-ee0ca44775ba", "value": "T1D328330B29D990F8C1964B75CA7A4266FA74BC98CB3073E32E40AA741F76BC27D75740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788684503, "uuid": "0930cbcb-5c62-4ca9-b941-ec77dd96640f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788684503, "uuid": "d6231d91-8cad-4549-8054-4602417c2944", "value": "1572864:Nz3av3e3G1I4teHfv5aJxjjJaY8tECulK/qC3nicwSln5KcpMDbaAiR4naV1dm6R:paJ1Hsfv5azj1xlKCCXiVSln59MfREIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788684503, "uuid": "4a33f169-4286-4c70-8a3d-8815c7c1558a", "value": 98893736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788684503, "uuid": "6e73725b-5d4f-4876-bb18-3b141dfd4631", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788684503, "uuid": "17009b0e-fba7-4de9-84a6-4e28dc95e858", "value": "f762090080981fe38899e90a2d4d70b9455b9e01fa1d394e12de493ee3f75b10.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70285b36-a9bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788675793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675793, "uuid": "5d292789-6e71-4ef1-81d9-730a5c5f5cb1", "comment": "Malware payload (Vidar)", "value": "0676d9d2c18332177ea617f8ea6263b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675793, "uuid": "67972945-5f1a-4f49-bff1-0a8878f82ffe", "comment": "Malware payload (Vidar)", "value": "f8f82732198335049d00627638d4100a4e2354de61268109228585ae349df9e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675793, "uuid": "c1d6bc9f-5429-480a-a812-c92da5fb0d5e", "comment": "Malware payload (Vidar)", "value": "966a966325aaa33d9e5128ecd322278d8ce11cb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788675793, "uuid": "943206ab-fe58-4704-9c97-8093f50fd761", "comment": "Malware payload (Vidar)", "value": "c5a16eb84a5951714edb9623f6ebd3511b17eb85db6f6bbd35575b3ea800ef71b2d80e9b4b8c2f6cca74f23f2447edeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675793, "uuid": "a507369b-e2fa-4b95-bcf9-a8ce922e13c5", "value": "T10A283343FC9184A9D569C63AC86AC262FAF4BC050B31B3E77E51B6643E37BE05139718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675793, "uuid": "d7dfb951-aa24-4b30-93f3-8e7b15d62d2c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675793, "uuid": "b32e3964-d536-4569-bab8-454d950bfaa2", "value": "1572864:47H+pihp+YUYZS2RoC24Ica37xKIyHX4SoRZOhZVKNFi+GAh4ckAI:sHV3+YNXa3QfWKhZ4N4+Rf6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788675793, "uuid": "ab9b1c69-0677-49ec-aa0b-a2a19253e401", "value": 95850864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788675793, "uuid": "04f6f7e5-6e0c-4d8f-b3f8-f57c40c11cc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788675793, "uuid": "1351b4dd-c8a5-427a-9c78-eb8e593b5dc2", "value": "f8f82732198335049d00627638d4100a4e2354de61268109228585ae349df9e1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25468017-aa3f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788732361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788732361, "uuid": "94deb9a9-9c85-4b89-9ded-27f7fd058bfd", "comment": "Malware payload", "value": "c83e6e3921ea8f9461db86bf0ff18ea3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788732361, "uuid": "9a7682f6-e179-47d2-baf4-d6e616a305d8", "comment": "Malware payload", "value": "f9203fd93932392404872c6cfdc90b6328d494ec8d607a87fe5ceef71d211c79", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788732361, "uuid": "f00c652b-489a-4f98-91a9-3aac3ac0343b", "comment": "Malware payload", "value": "35f837a5bc1ffdcd41149a45335a6f8f50ab842c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788732361, "uuid": "3a3c22d8-da99-435f-a8ab-90735dc6884f", "comment": "Malware payload", "value": "0f12023e94c54021e2746aa93529db6e5a445b220c09750c156441591a67da0ef2c6a8aa5ca68d2a11aa71a2fddbb41b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788732361, "uuid": "16433744-dfd2-445b-b75d-72ea1ed0ab31", "value": "T18DC28D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788732361, "uuid": "4916eb8d-1ff2-4860-9296-f3dd564b8425", "value": "768:08vCB+25j6es8RSW9FYpMSUpi+20qUpi+20YQX:08l25JLd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788732361, "uuid": "0bc2ea9b-cc42-4543-8989-24eb77878e58", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788732361, "uuid": "0e3d1445-5175-41ad-8d07-20445389676f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788732361, "uuid": "26db0f0d-a6bb-48ce-b2df-205fdab6776f", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebad46b7-a9bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788676000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788676000, "uuid": "e280e9ad-8051-4195-a9f9-c6098da51608", "comment": "Malware payload (Vidar)", "value": "06a557350031724adb809971b15f7389", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788676000, "uuid": "004ff417-1c70-495c-9e50-55c821694311", "comment": "Malware payload (Vidar)", "value": "f94530be39d868dc7feb7ae378090f3972cd43ec7d5b69f270e0f149d1238bf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788676000, "uuid": "d51b67a4-886f-4c65-bc3a-c5c0158b70ca", "comment": "Malware payload (Vidar)", "value": "8e425298d8b68bb13cd5cf20c607530258cc4481", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788676000, "uuid": "49a8dca4-824a-4a5b-8cbd-76148e77f037", "comment": "Malware payload (Vidar)", "value": "f8db5f9c077714c0bcb844c9ed6bd882e966ed8f9fe4837705ed76f8037817c9e71da7c1c2ef1f936c8629f5b10f0d1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788676000, "uuid": "f860ad50-30ab-4285-a54f-b57b01229d38", "value": "T175283303BC9584A5D069C67AC96A8362FBB4BC040F31B7D77E50B6782E3B7E15139B18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788676000, "uuid": "2015a7b0-4a82-41f9-900b-4af7efd5a31b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788676000, "uuid": "980bf9fc-8a69-493c-8b62-9380f75890f7", "value": "1572864:49ug0qTw5Fw8iO7gLPbJiAGMXvT61bNYAqT+c2pT3IYhgV6lfYXB:Qu/qTw5Fw8iOyjJpH/T21qic0bIt06B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788676000, "uuid": "b592b883-1685-4621-9c49-d7861a14cf86", "value": 96899440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788676000, "uuid": "3e9c4363-c517-4e28-9fea-61cf9f508b57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788676000, "uuid": "abcb3316-167f-49c7-bdd7-0ae8f43e35fb", "value": "f94530be39d868dc7feb7ae378090f3972cd43ec7d5b69f270e0f149d1238bf6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1610886-a9c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1788681163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788681163, "uuid": "22a23295-df43-4158-bfe0-e8e6e71feec2", "comment": "Malware payload (MassLogger)", "value": "effe032737893c24b9ab2ab5fb7c6dc0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788681163, "uuid": "101e273b-934c-4d45-8855-da56866b1af1", "comment": "Malware payload (MassLogger)", "value": "f9906595791bd667da6c0868e1f0e530628e60fcd77adeea7d197551bd6d6e9e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788681163, "uuid": "38935954-1c38-4bdc-8497-fbb61672d414", "comment": "Malware payload (MassLogger)", "value": "c136b3768e3225e441991d9642eaf25c4fc3539d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788681163, "uuid": "676776a3-df1e-4a33-a8f7-3586963ceb16", "comment": "Malware payload (MassLogger)", "value": "8f1bd1da1f5aef0b1076d1df8c132a3759c9c1d566c915e3729fa922fedab45dcb8120a5e632891122b8459549052553", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788681163, "uuid": "91116f8d-d480-439b-bc2e-77846522795d", "value": "T11C15E70B0A3C233B9FA513611428C14A13E88ED5DC729F582A6DD5B49E78F1F26B56FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788681163, "uuid": "1b8f2f8b-f1e6-499b-8c4e-e0b0d03887e1", "value": "6144:QnXnXnpJnXnmnXnXnsnXnXnXnXn8nXnXnXnJnXnXnLnXnXn+nXn0nXninXnenXnj:fA6NDzX/QlCqpET1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788681163, "uuid": "f73e2af9-5eb4-4e10-aab7-d567b9dc54e2", "value": 952346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788681163, "uuid": "78f793f2-e613-466c-be5b-34282c0871db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788681163, "uuid": "38097769-ee13-49ab-aecc-e9145f991ae7", "value": "Comprobante de transferencia.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c30cfe21-aa2e-11f1-bd95-42010a9c0009", "comment": "Malware payload (BlankGrabber)", "timestamp": 1788725324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725324, "uuid": "a214fc2b-50d0-4736-97af-78b4bff8ee31", "comment": "Malware payload (BlankGrabber)", "value": "b958353109ac8ecf07fccb1530e84af0", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725324, "uuid": "c284acf5-70d7-43df-bb22-fba7b0851607", "comment": "Malware payload (BlankGrabber)", "value": "fa3523b9e59def3558f6e9e97563dfd1e511391c290bc642a05962aeccef4afe", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725324, "uuid": "b743f52e-0028-4972-aea6-cab2f33eb20b", "comment": "Malware payload (BlankGrabber)", "value": "410dbde6c5078fc7ea8dae0c9d3364fb1e5b2430", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788725324, "uuid": "01e30071-1257-41b2-a0e6-4208d58b7721", "comment": "Malware payload (BlankGrabber)", "value": "a0d598a3e789241ce013b54f3c5a0e9b4519436b0155606d95bdc9dfd7bf11d610da8cdc9e327ffa41c360e2c2488a32", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725324, "uuid": "f3f61f6b-92da-46dd-8768-706c59616430", "value": "T197A63359629508F7FBD2453DDA65C966EB71B4324B70CECF07A882201E332E1987E732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725324, "uuid": "22944c7e-57d4-4658-b48a-66b2a04f6918", "value": "ed71b47f404234b025eb1f9c0778046c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725324, "uuid": "12009938-68ee-4cfb-b71d-0097e8decc4d", "value": "196608:MqfkzmFUP7C4JG4+NVlTjat7tPGB/ihrAyCk7VPfF8bfTfQ3LZapK4Dfrtw3D:M36FU+4kjjatZ+/yNCk7VPfF8bfTvHmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788725324, "uuid": "db95cb2e-a82b-41a7-9249-133ad1a50560", "value": 10021179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788725324, "uuid": "f66e122d-ad86-4d8c-9abb-2cfcd78614b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788725324, "uuid": "910730a4-0d3b-427c-9567-e086cf7034c9", "value": "Delta_cracked.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a692bd07-a9bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1788677602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677602, "uuid": "3d18291f-7485-4b64-b975-0a9482eca933", "comment": "Malware payload (SalatStealer)", "value": "2a1543809dfc7c36268b60fecd038e22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677602, "uuid": "4525f249-d317-43a0-8369-807f9a1098cf", "comment": "Malware payload (SalatStealer)", "value": "fbcc5ffd177eb7886d86ccfa93d3b35d6eeb1f530bfb3ed179f4a83b5dec709a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677602, "uuid": "b1360990-241c-42e6-8bc3-a7d747e5e445", "comment": "Malware payload (SalatStealer)", "value": "fecca8695f54b77cb77079febf8e54d70c1eb5a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788677602, "uuid": "8d89a593-3d79-4ec8-aaa1-ad95b3aab209", "comment": "Malware payload (SalatStealer)", "value": "a6117ae37b54a46593341bdbe6d2e7eb2c7181bec78fe1ae06ecfcbedd4cf0a7ae4b3b3a4ea61f565d64478e74a057e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677602, "uuid": "ac45d17d-92b6-4498-b38a-09b8fca86952", "value": "T1C2C66B11FADB95F5E903583100ABB37F23315D048B28CB9BEB547B2AF87B6A11D66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677602, "uuid": "24544e76-d8e2-4e8a-a717-2af399420280", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677602, "uuid": "087a2ba9-e169-44a1-b27c-4c3dd7824d6b", "value": "98304:7OY9ZJcp1fCjWiDzl/wCr1/R4NG20CDEF:XZ4iW+9wCppnZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788677602, "uuid": "1dcd27df-20f6-48e2-8779-7f2db2ca0da9", "value": 12573184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788677602, "uuid": "2dac9dbe-55a2-46e9-b971-32f1c8721337", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788677602, "uuid": "9e15d1a7-d945-43ef-b1ac-0116ddba9e90", "value": "Yougames.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }