{ "Event": { "published": true, "date": "2026-04-10", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-04-10", "timestamp": 1775865781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "a30a551a-bf05-4b45-bd07-5f006cde0a33", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e5ba0fb-348a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775790378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790378, "uuid": "93376ae1-f41a-413b-a382-10049ecee27a", "comment": "Malware payload (Mirai)", "value": "a8a0ca312e2d53afc4f1b41e84f5644b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790378, "uuid": "d3029ce0-6aab-4b39-9390-920a4496b7d6", "comment": "Malware payload (Mirai)", "value": "0000f1d62db0b64681ea2c7cf582d5e89218ae0a3178b147618170a221f31258", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790378, "uuid": "633fda4b-1c64-42e5-b087-6a2ed5ccd7c0", "comment": "Malware payload (Mirai)", "value": "4a8e493bfd49133c596bc4dc1aad616ddb017df6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790378, "uuid": "e3fb554f-92a6-4e20-a0fa-d33f01635acc", "comment": "Malware payload (Mirai)", "value": "c95a958f9ef0768bac9c0bd26f80ef08c74c07af7d50c8d45924078193d51e743f919b63b91d9bc6e87e124f53aaa706", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790378, "uuid": "2cb83a92-a54e-40c5-970b-7f61b9d24642", "value": "T134239D82E783C8B5D8A3017A5537A7569F31ED268061DB57E31CAE32ED13902A71B37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790378, "uuid": "1e6c101d-afd0-4987-ac60-e806dfa5f44e", "value": "768:u4jNTRXkLfEg+sYIKyWimpEHCjf2q7c7HWST2hs03ZleBdaW249wFloqKAqgTIx:nNdXkLEVIKyKxb2Z7HWpsL1wl3K9gT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775790378, "uuid": "9383c8c7-9607-47cf-85c9-b3d1c486d51d", "value": 46404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775790378, "uuid": "6e570de6-f349-410b-9ee7-1d11b08185f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790378, "uuid": "af8a3c76-0465-4346-a6d2-a57f428f28c3", "value": "Clipz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f0aaa1-348a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775790340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790340, "uuid": "63f87c39-4c5c-4489-acf9-849bda0bb7fa", "comment": "Malware payload", "value": "dfe770ec5ea2defb80603d765d3e4728", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790340, "uuid": "4995acb9-8932-4b79-9b7e-dfdb7833386f", "comment": "Malware payload", "value": "00f611bf28203c125a3e1f2ebb8dc72278d098312f73892d57815b20837975da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790340, "uuid": "36f2b934-31e0-4c69-8e20-2c914b313b51", "comment": "Malware payload", "value": "e75b6ee7416b56605fb2e4a469d8ec4aca1a9d2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790340, "uuid": "37564385-f3b6-494a-aa2a-67ac62208a62", "comment": "Malware payload", "value": "153c399d31ee7357b430fd6ab0cea8186c7062dfa4e16209c9b1b286142cc6d12a7770aaad0f9c762b41c6268599b8e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790340, "uuid": "ecb316ff-cc5d-4f66-800c-14e123de23ab", "value": "T156338D13949080FCC8EFC2BD8FAAB2369A73703A1275B55E33C4AE526E1DD215E6D710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790340, "uuid": "112041ed-5f5e-4004-8492-c2b8a98f9861", "value": "768:lhio7q+jfRKk0p6Q4FMMaLnm//QJl8P02GsBJ+RTRmNCx6a701VUz3Okvq3Iu7uu:Vm+1KklaLY/UlmGgsRT+Ja7OWC3buB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775790340, "uuid": "a36f0309-4f90-45ec-ba91-2eae4c0315a8", "value": 54472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775790340, "uuid": "3a77a9b2-885f-4b2b-85e1-41c794d47174", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790340, "uuid": "68878f64-44df-42c5-bbd3-c004a1f4566d", "value": "Clipz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33fbaee2-34e5-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775829444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775829444, "uuid": "1f25be00-9606-4d55-bbdf-31cce9cbbbd4", "comment": "Malware payload (RustyStealer)", "value": "4ff2f140c1fc291b387c894e522aae1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775829444, "uuid": "6f9ced90-6817-4d2f-b826-74964ff72e38", "comment": "Malware payload (RustyStealer)", "value": "02e2f58615e5911202c91c2b6e1f76e69cd6c5e94b268f1b67de5c768b5c25ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775829444, "uuid": "fb4a595b-ee3f-429f-8dc1-6cda91e658cf", "comment": "Malware payload (RustyStealer)", "value": "f53d55b0340aa0f5f02b9ffeb54f894cdbbbb363", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775829444, "uuid": "b3969a3c-dd6c-4016-8e20-e68c900f3604", "comment": "Malware payload (RustyStealer)", "value": "466f68c42476c89afa3a2d183235968d167d1b144fedeeda6185900a93e05dd77547c77d6df92b5efd5b631b8bd02832", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775829444, "uuid": "6ff675f3-9cb5-45cb-884e-b58cb13f697e", "value": "T16C16128129E748BEC09AC3B1C6CA28BDF19FBF454D369C9BEF9769405E32810C475B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775829444, "uuid": "878be109-75be-41ed-8928-7a8d99778eba", "value": "66e4622a2560a497065719058a0b3263", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775829444, "uuid": "bd271f92-71f7-4492-9335-d15e0b8bd924", "value": "98304:fZUmMxFLqDY/lBhT51nEQMd+OwR2/fOAs:RnMDsmDT517Mt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775829444, "uuid": "40c39f01-def0-4e48-b6d6-4d628360d21b", "value": 4279296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775829444, "uuid": "ccc3e24b-148c-442c-9f9b-4b844b734f41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775829444, "uuid": "89168dea-6452-4122-a923-004515ba3ebb", "value": "Agreement-RC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f73ceb50-34f8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775837932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837932, "uuid": "7d165993-ac74-4efa-b678-3bc06f9c9622", "comment": "Malware payload", "value": "716ea597b0d54d5e72a1ba94153bb172", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837932, "uuid": "1761e8bc-6dbb-42bb-b3ae-757cd7674b28", "comment": "Malware payload", "value": "0596a76e6772acb911c1a556ad86943224873411fba4383abade25300078ed32", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837932, "uuid": "f76691de-3dbf-408d-941d-86cd102361d9", "comment": "Malware payload", "value": "e40ffccd60655a9066c675c827e47e7136f211fd", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837932, "uuid": "5a84cd21-4f5a-4454-8e23-4de192e11692", "comment": "Malware payload", "value": "1d741a2c5f01392fc7d84d6a3c0fe91e70d96d61991c0201f2eaba0f3c065438114eb955032b5482f68bd0ac628bcb5d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775837932, "uuid": "3e341eba-132d-437e-abdd-eba7538c5aec", "value": "T15DD5F145FB999F1EC8F353760D396635147AE923C703C383C9692679688BAF00F862E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775837932, "uuid": "5e959d1d-c986-42f2-a5d7-d153c15535c7", "value": "49152:1RMnz0VlWiTa+UlZFSIRi9CFkrm/jqGFBwKve9RiBf4z:6zclMvFvAOkrm75TgAAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775837932, "uuid": "263a1901-2be6-4020-8847-e998d31de267", "value": 2995729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775837932, "uuid": "59229047-bbdb-43f0-a85b-d4521e42d188", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775837932, "uuid": "8d7fbccf-5acc-4a5b-9243-50a9aea8d1dc", "value": "sagawa(1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ffc435-34f6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775836887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836887, "uuid": "bec1120d-1ee3-4cde-8a94-34c39f6b4f71", "comment": "Malware payload (Mirai)", "value": "0a783b05b649d8635486127a6ac71946", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836887, "uuid": "64d43264-8ab1-44e4-a964-4f9cbc89105f", "comment": "Malware payload (Mirai)", "value": "074471e47a7a69f906a318593e27818cf10d7ce3fc4bc31961620302e8a7975e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836887, "uuid": "27d56277-81ab-4b97-af03-4521cffb785f", "comment": "Malware payload (Mirai)", "value": "ca2b7ac6148138b978b799c598f3e12dfedd799f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836887, "uuid": "4b933a7d-9508-4b5b-8ca9-5e57a2590177", "comment": "Malware payload (Mirai)", "value": "58cf81ee15a36b7dfe4bf8defbf5a6437a274380e162c3601081ee3a0630f0112b11ce856d80efaea4b8305b23920c28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775836887, "uuid": "8ed80651-18fb-4634-addf-e3b9e8c46e50", "value": "T1E9D35C0A79D270FCC687D170926E9F61EA3A745C02183DBBA3C2AE711937ED05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775836887, "uuid": "497c8170-ee0a-4448-95ad-8441fb275dc2", "value": "3072:lAF2acRfkY6z3xv+ErH4vk9954rlvLFZW8YYQD:yIRfe3xvvSrlvZZ7UD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775836887, "uuid": "ff087ec3-1056-40a3-8d3b-7adbebefe1ed", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775836887, "uuid": "7b059ef1-9b1c-4e1b-a4e4-ce885ebec38d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775836887, "uuid": "9e91fc96-81cc-4c68-9c65-904cc0466b87", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b7ea55f-34d8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775823874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775823874, "uuid": "8913f842-cd9f-42a3-93a8-b4cc7204aba5", "comment": "Malware payload", "value": "c268a50330d133cfb8f6a4c421b5b29e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775823874, "uuid": "55596f2f-20f3-4756-88e0-8dd30b62db95", "comment": "Malware payload", "value": "09f1b9609beb0339a6111e53354f2b1b160022e908771b8f03a67c214def996e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775823874, "uuid": "7a8ce776-591a-43b8-bbe7-6e96cb9996ba", "comment": "Malware payload", "value": "22a251ea03b2f4f8a8f528a2d3175a8a9f83d045", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775823874, "uuid": "5fde1cca-7e8c-480a-ba48-ac395ac9e57c", "comment": "Malware payload", "value": "176622392dc5fd80be4224b2147e917933e72cdc210c06e158afc0038e634715ed70aa5d5a3d1fcb1077451961ff9723", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775823874, "uuid": "865a599f-b238-49c0-922f-3872b89d4502", "value": "T1F58412257AB6D052D8D64632E424F9BA8E7D9E9EC9794F8B3704BA7C6DF03813D1D002", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775823874, "uuid": "c7fe0182-8b6a-49fd-84d2-222c84f7c33d", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775823874, "uuid": "16910c89-7cb6-44c4-892c-b945a3e7964c", "value": "12288:MbcVKlgggggggggo6Zj9amZFZBsquSyGNTaCmW:MbcVKlgggggggggoKBdF/Dy0Ta4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775823874, "uuid": "68143da6-1c58-4f89-bf02-2853e2a6964d", "value": 397688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775823874, "uuid": "3ddaa6fe-faa5-486f-8fbb-b8896713a05b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775823874, "uuid": "83a4d8a5-1293-4c3f-bea8-4e45b2d6680d", "value": "Beskydninger.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "084a84b1-34ff-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775840538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775840538, "uuid": "f45767b4-dc38-4627-a447-d0856a663718", "comment": "Malware payload (Mirai)", "value": "e146f9ef6407f37d972d1ca2fc7196a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775840538, "uuid": "eb3b8bda-08e8-469e-816a-7f26c9c44ecd", "comment": "Malware payload (Mirai)", "value": "0b144535a366d68cb8bbacaeb53097a8a7d4ee4843dccc2bb61f252af90aa573", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775840538, "uuid": "39046ee8-8a86-4e36-8cf2-7eaef0029cd7", "comment": "Malware payload (Mirai)", "value": "cbe47eb9d0aea5a6137fd7b12748b0f1782482bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775840538, "uuid": "14a72bcf-bd07-4cf3-9935-3ad4ccbef1a4", "comment": "Malware payload (Mirai)", "value": "e06d3b9533a218269052e8aa57668a9352c2ab691549ba84d257f5c0b4f970a4e572dfe9571aba28f98f114466082541", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775840538, "uuid": "aea23ca1-501b-436f-9525-d31a53674bd2", "value": "T1E704392F258191F0F6411B746BCBD3976C390BBF51A9909F6B416329B6E0B7BA02C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775840538, "uuid": "3b975925-90e4-4b30-b148-833f7fe86bc7", "value": "3072:7mPX5bl7RDfPIX5eG/L1AL0SFU66gOSNL9CnNgRdgJi55wnUXS:7eJpJUVD1A8n0YNgEJi5aUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775840538, "uuid": "31abf41f-0478-4d69-bc8b-b6df81b3cdb4", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775840538, "uuid": "b97f9d37-e9fa-43e4-9730-304be3386114", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775840538, "uuid": "0c0de1e1-6766-448e-a442-299ec01ec710", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e783eb38-3502-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775842201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775842201, "uuid": "e4136fc6-6ff0-4358-96ff-63a1aefc6905", "comment": "Malware payload (LummaStealer)", "value": "b50e3bdcd300be3d5aaf8fd00370cf90", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775842201, "uuid": "1a394299-1ae6-42d2-8819-af1b9793702e", "comment": "Malware payload (LummaStealer)", "value": "0c50b443623b0530b30ef47f036c486d0cdd9f2088c6c1ad1b2ac2963230bff9", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775842201, "uuid": "b46d7402-3aa5-44ec-abed-4ab1a2d66d16", "comment": "Malware payload (LummaStealer)", "value": "baba0107410e100a6d21901fc672a0f30fa6e87f", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775842201, "uuid": "30fe2e55-9bbd-43b6-a2ca-974eefb731cc", "comment": "Malware payload (LummaStealer)", "value": "2a161e4628cf671c9beb68ce8ff27162a75871abb1498aec2601b2a341ca18ba2d38b2d87594f7c8cca42511bc813e10", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775842201, "uuid": "e7512c11-c048-4860-8ea3-6f6cc48d5217", "value": "T114B56C00FECB64F1E4071B3655EB62BF6735A9080B375A9BEE803A79B9777910872305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775842201, "uuid": "714205ae-4d8c-447b-9ffc-a62e58b93803", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775842201, "uuid": "8785d5a3-ea58-4bcd-aab4-cb5eea2e718b", "value": "24576:k01ZeujqC8Y0g/LdyRI4r6xkvVyO1OaXLlU3r4RqloW67nvFuopeRuIBWoNsIbZh:kkERGbE6dUq6du2jcWbIbZoRbQ0tAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775842201, "uuid": "9404fa71-825c-40c0-8118-5d9c0f2e34c1", "value": 2287320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775842201, "uuid": "d2ed02dd-0641-412e-a57c-5a5de9e0cd9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775842201, "uuid": "017dc55a-3a94-4c20-8513-971090b101dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba94862a-3522-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775855870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775855870, "uuid": "3241ec76-8970-4816-9d17-95f256b5973a", "comment": "Malware payload", "value": "077cc41fa712188eff407ec6fc5d7ce2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775855870, "uuid": "fa677a88-b2c9-4518-9fa8-002ce55afd93", "comment": "Malware payload", "value": "0c63bd38f514db09c6cbc41c732b2f17f0e4265c4e7a2f48936758c3aae8ddec", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775855870, "uuid": "8e7c010b-63ed-44d1-b97c-b4d8542b2340", "comment": "Malware payload", "value": "0e5ea3289294ca17267fad813b6023b16921e46d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775855870, "uuid": "0a8dad74-64c7-49b4-b624-f4ce371619c4", "comment": "Malware payload", "value": "b25a16796c46538bb43a04925cc287211e5b3f7bbc06f66bb4f2e8a7b94434aee71f297d42e1ed2d41d50ae59cd5a77e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775855870, "uuid": "cee08974-da7b-4600-86bc-cc8c85f47933", "value": "T1E0E4CF9433ED9A59F2FF8F7CA4B521410A3AB85AE816C6CD1D44209D0873B46F952FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775855870, "uuid": "38f0446b-ec52-4de2-9926-21068f7b6a03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775855870, "uuid": "8adf0a07-8eca-4805-8857-6c2dcbf6c621", "value": "12288:/Zmr12gFgchGEqMeV89bROjl/1yJIRHqPuCA6H4pD0QE3IALT69y+H9TC:/Ze7eWBR5JIRR16zEAGy+HhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775855870, "uuid": "57ad0d38-2e7f-4048-81b6-4dc0682d5174", "value": 703166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775855870, "uuid": "9203c8f6-4776-48f1-8a34-e3e878c297cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775855870, "uuid": "58af5855-0199-437a-92a9-e5152bd83770", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dcf40a6-349d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775798537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775798537, "uuid": "e1d10d4a-e114-4f5f-8f8d-ed582eb9d0fe", "comment": "Malware payload", "value": "d8ffce0286a6d2e0954ff3f2f765d694", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775798537, "uuid": "2422449d-68c0-4df6-8cb0-907c3cdf626f", "comment": "Malware payload", "value": "0d7f7c4650bd3955be220bbd1d561a9bb94c018fa301dd8d4543aa6730347d71", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775798537, "uuid": "8fc4aa5f-85f5-449a-b4ee-22d4a158e245", "comment": "Malware payload", "value": "b111415db1e240a33c0c9da304b796e7a407d785", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775798537, "uuid": "97ff783a-f5d7-407f-8826-b59f65d6ccfd", "comment": "Malware payload", "value": "b6fc73ba88a0e8e1ac9dcea9e7ebfff39158183ee93343f6e5a95296a0458c1282817516fdb5eb8f3a124c38b7da9c46", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775798537, "uuid": "38a0888e-fedc-4b5e-9a20-648267f1ac35", "value": "T1A3E35058296F06DA27532828852B5B03EBF05733060DF6E5BB2DF7E1BF1105990EE9D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775798537, "uuid": "7628926d-33d6-4433-8742-84e6ab7ee0e1", "value": "768:FoE8zm+1SqEmkpwyA0niaavmPRqRcDHuUpDxjlFyOu7Ipz7lv0:bz1uvmPIcbuUpDx54Ou7Ipz7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775798537, "uuid": "dc873d2f-cb17-46cf-8cec-f1963c0ea460", "value": 144945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775798537, "uuid": "414d5e4b-94e5-4f5c-9b60-7b035c803866", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775798537, "uuid": "a15d33d1-ff90-46fc-89d0-f556744f12f6", "value": "Internal_Photos_Primary_6985.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a714587c-3524-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775856696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775856696, "uuid": "bd5ec0d7-eed6-4d2a-ad3b-a4269108f50f", "comment": "Malware payload", "value": "68ae5e31be058d67bc440ec198bcb57a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775856696, "uuid": "c85edbf8-59b8-420c-8c16-8be209c521f1", "comment": "Malware payload", "value": "0eb0ef3e9e132853f80ad89a51905e867087a4cbe73d8afdaecb5d03593a76ed", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775856696, "uuid": "c87ff8b3-cbb0-4faa-9f7c-7e6e705e617a", "comment": "Malware payload", "value": "afb589a3a9e1bf83c148492af049e1c6e80a7ca5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775856696, "uuid": "023b7486-eafd-4323-9807-c72bb334b51c", "comment": "Malware payload", "value": "21977f11a5f4af143ed4b08591e851857e074e9b8e26b83a25dc997a98ed42b11626b2db344e20d594ad2ed2c9f72261", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775856696, "uuid": "4e8d9275-26e4-407d-aec0-8df090a22bc7", "value": "T156314DF1F6989300DF7FF0F5EA57DD018F90E9CAF40680745034A2284865D7D75C2592", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775856696, "uuid": "b1f89786-9faf-465b-9002-b87c4b3f323f", "value": "48:9GqgiEa0tXW/Ykvr6UFnThR5VCYRvwW3le+pCxX16Ps:4qka0tpxUFnZcmvwW17ExF6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775856696, "uuid": "e1e6f46a-3a3e-4b17-a1e4-ba03c33c9ff9", "value": 1757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775856696, "uuid": "d5978657-ef45-4c6c-a8ab-597cec94f766", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775856696, "uuid": "6cccd04c-dfc6-4758-bcd6-8d81bbc2ac47", "value": "DOC-70YF2H.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8217cca9-34ad-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1775805524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775805524, "uuid": "fec6a3d0-f8f1-4c68-a7a7-e6aca23735c3", "comment": "Malware payload (ACRStealer)", "value": "2eb761196e4f9bc0329c22ebede489e4", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775805524, "uuid": "ce284b21-5cb9-4b18-9fab-ce920d4d9956", "comment": "Malware payload (ACRStealer)", "value": "0ecf53172665e81baf1e12b97bee3d4a6235923499899f3e4194f400f98deb22", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775805524, "uuid": "4c5b64a0-85dc-4be3-aca2-4dc6095d3603", "comment": "Malware payload (ACRStealer)", "value": "70c80fdb2253ffc1c1aa89e8cecc6ddb8fb09bf4", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775805524, "uuid": "e32f0139-efd4-42d7-b1b0-0e6d8a883e40", "comment": "Malware payload (ACRStealer)", "value": "20871eb15de14f7d8e1705f54a9e5babba0926fd7518323cb69de1879eb907f394e2c2de1a169af302fee7fb1d9f9b3c", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775805524, "uuid": "96f6d643-5c2d-40f0-aac5-4415ca834488", "value": "T141165B0BECB94CA8C4E9A5358433A146BE747C801B6173D72AD5B7A82F737F09879B05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775805524, "uuid": "a27e4bc6-ba86-4bf1-9deb-6b60d85c622e", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775805524, "uuid": "c9792734-68ad-41c7-8e3c-10a764ad5fee", "value": "49152:clImFYq58ORU3xvLOnUpVw6mgCWqjssQcX370R6E:cl+VV0Zuda7vE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775805524, "uuid": "c7ca3474-9dac-4887-b077-342ad062681d", "value": 4035600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775805524, "uuid": "45add8d7-eea5-4d93-aaa2-5b428a50d931", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775805524, "uuid": "2f0d425f-a4a8-4d95-b720-a36df470f721", "value": "SecuriteInfo.com.Win64.Malware-gen.98413488", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879e5a43-34c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775817559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817559, "uuid": "a809803b-421b-4492-8894-7cfcb7a642b1", "comment": "Malware payload (Mirai)", "value": "fe8fc383b26481d8e276a64c5dbcded8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817559, "uuid": "ba8ab644-047b-408c-81a5-9127d6a9436c", "comment": "Malware payload (Mirai)", "value": "0f1c3c7adc23ad914d8f360681a6b207a5236d5d560ac5d34b5a3bf5d4f71dd0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817559, "uuid": "adeabb89-bb94-44d8-b47e-d5f5d454dbaa", "comment": "Malware payload (Mirai)", "value": "0aaa47d703f428684fb4541c2df99a3b187f0f15", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817559, "uuid": "55c01206-1e34-44da-b570-04a6ec00eb9b", "comment": "Malware payload (Mirai)", "value": "33df54e103ce30d2c272c71f2b00151bbda6757ea3cd5c3952dbea835def8b860914443de16b6ff11ef9da4f61383285", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817559, "uuid": "3e355040-97e5-47dd-a39f-a5e942d659a2", "value": "T142839416BF601FF7EC9ACC338AA9170528DC651E31A93B75B930D428B25B25F15E39B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817559, "uuid": "3322bf77-3cf6-4897-bafa-7e84631eb7f3", "value": "1536:bw4pjQLOQ8ZHYxdGAopJpPok9Z5zty7d42+9:bw4pjWeFYxdk9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775817559, "uuid": "c32509fe-59f1-4e9b-a159-559119d95eb5", "value": 84172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775817559, "uuid": "e1d0ce20-2a0c-4c0c-b032-7b7fec02d2ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817559, "uuid": "d0d6e032-8fbf-4049-8f12-f5f74e5d1f9c", "value": "jew.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2545189-34e6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775830059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775830059, "uuid": "2d3adc80-3d6a-4e88-bdb3-7a6d88d2b0d0", "comment": "Malware payload", "value": "823b2d553a37529807bbd54dcdef88c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775830059, "uuid": "bb4cb43b-d5cf-4282-bb4c-f7377e5fe886", "comment": "Malware payload", "value": "15f1df9c3b4868199d06b324179ad35c61f42f80cf81138be4f774089d88527b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775830059, "uuid": "7a53a7cc-62ed-47f4-83b4-949b4b23e40b", "comment": "Malware payload", "value": "e8d224ce8d30e07ea8e29a867d2e05464f427a01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775830059, "uuid": "8da142c0-5627-452c-94d5-950e36a424ca", "comment": "Malware payload", "value": "1db97c804e9e96a71c9341bc1326cd6abfe4a9a79d2e22822428778e0a701f79a089ffec9ce9b90fe88748c85f73a72f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775830059, "uuid": "5a252200-5da5-4027-a686-0f9ce03e0084", "value": "T11C382321368EC53BD92E05B09A6CEA6A962C6D660F7244D773DCBE9A17304C31336F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775830059, "uuid": "b07a76d0-8c01-4a65-a578-89aab57f95c3", "value": "4b200e917ee33d8e56206c360a98a2d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775830059, "uuid": "527bc2f4-77a7-418e-86bd-b792784d092f", "value": "3145728:/NCe+qoIoRYgfqEIVCxGqvYFhL1K3Vbpzd:linZRYgfJaCxZvYFt1Kx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775830059, "uuid": "d9318e60-9363-4d2f-8da0-1307414b4a02", "value": 103938853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775830059, "uuid": "f87f6995-ed54-45e7-9228-bc8f6751ff77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775830059, "uuid": "73441b8e-5b65-4e8b-9dbb-5f69723b7442", "value": "StarMarbleRoll.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "074165aa-348a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775790285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790285, "uuid": "f9a4d1dd-ab33-4639-b91d-6436483ce7ec", "comment": "Malware payload (Mirai)", "value": "02f17c34777152c35eaa1eb37056f207", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790285, "uuid": "1e0c434d-24f5-4579-85f0-120db5458aa4", "comment": "Malware payload (Mirai)", "value": "16d646cca466381c0719bb5d7b1669ef1efb9fb467a4fc46443edfc02f67111f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790285, "uuid": "1532a96c-9279-495c-a3ab-d4cc72e2e07c", "comment": "Malware payload (Mirai)", "value": "55a02ccb4f7eb074d0c9e5bcdf5b3cd88185d40a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790285, "uuid": "08fe5c01-c1e3-43b0-b016-e42c01712168", "comment": "Malware payload (Mirai)", "value": "c3b4821ce58a6ce03d172b5ab85af248d55ede0b0f348631fce16b6bc8f670f760089fff78cbc4057059a251dc07c8c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790285, "uuid": "985d1b55-52a8-46c7-839a-9d305d25766c", "value": "T1ABD2E1722DC74D50CBD43C7792B9CA87227B81B448F73A913648BB6973E0C27343A686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790285, "uuid": "c229bfdf-9f70-4a75-86f1-3ee67295b660", "value": "768:sbmsbfOpqdofxrwb2o4kSIhhTWJaedAPs3UozK:sbmsbfndo5r+SIAaedACzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775790285, "uuid": "70629065-9a23-46d7-85ea-2a674746b5a3", "value": 30864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775790285, "uuid": "c921217d-de9f-431e-86b7-e9d822aaf76c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790285, "uuid": "06bb855e-bf5a-4ad2-8477-b6f41f6db3fe", "value": "Clipz.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2738ce20-34f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775835436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775835436, "uuid": "058865f9-5ffe-4a47-bf72-0e570c693a5e", "comment": "Malware payload (Mirai)", "value": "a1beaa3e8d23b9d9b180628474169ecb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775835436, "uuid": "e486ef36-b56f-4b03-a98c-56d391659465", "comment": "Malware payload (Mirai)", "value": "1b9afb8283c6396129ffd23aa89cc0321b7a12e995eaf0f98d4d478afb84e2ce", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775835436, "uuid": "092f703d-c0ab-404b-864d-34a9a8afc579", "comment": "Malware payload (Mirai)", "value": "9807428277267aa436dcb7f40f958943b76fbda1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775835436, "uuid": "a44ab10a-97f3-45fb-b007-35267a348c7c", "comment": "Malware payload (Mirai)", "value": "1a5b9301510104b23c6b8e921fd28afd34d54251a21199d6baf97298ff9e977328e4ab590766929f7061e3b201a44f32", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775835436, "uuid": "2e5a2389-e76f-4f01-974c-cacd69b0338a", "value": "T1C9F31A45BC918F27CAD622BBFB5E428D332617A8D3EE71029D255F2537CA85B0D37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775835436, "uuid": "221179f2-0a6b-4166-95c1-ba7ba1309ab2", "value": "3072:rVZkrfIxfnYLb0Mwv9LF4HRH/n9TIXt7:rjTf40fVLF4xH/ZIXl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775835436, "uuid": "aa1cdb86-90fb-40a2-b8af-8f288ec71637", "value": 170752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775835436, "uuid": "2b11dc77-c8f7-4fdd-b5db-4c305a13bda7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775835436, "uuid": "4a602a0e-a80c-4dc1-82eb-8364f6bd16f1", "value": "rebirth.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e7d3002-34c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775817570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817570, "uuid": "7cb0f952-03b7-4f50-9e56-d8f956bca45d", "comment": "Malware payload (Mirai)", "value": "576165cc623f5c1cc6b30d400957e0a2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817570, "uuid": "74376935-91ee-4032-bde2-afa9edb77964", "comment": "Malware payload (Mirai)", "value": "1bd060779bcb794a5bb8c551742660923659b3aee42972fb4b0670bf433cf3c9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817570, "uuid": "a84f4db0-3856-4044-ad95-e3202c7fd507", "comment": "Malware payload (Mirai)", "value": "5bb08c7730bce4ee4e43e48a70ee7d2ba7491da1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817570, "uuid": "324a62f7-eb90-44bd-ac33-a4b5f52c95f0", "comment": "Malware payload (Mirai)", "value": "0d50a49c11315689a457ddd64a2cfe299ddff756e80502db1c5e57e95826400cd514fa24f96df23a540abe0e9fc86913", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817570, "uuid": "31f87481-cddd-4baf-9c0c-9f8a0f68f0e9", "value": "T1E8534D96B401AD3CFC5BEABD40165A19FA313B3016A30F5B9BA7FC839C321A6DD16D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817570, "uuid": "0feafd69-765d-473b-b5d6-e1c945ce632a", "value": "768:neT+6JhUvtNaEVG1XPgj2x9+iGCvYN1ul8yXLyCIlqXxXv2XWFtN:nInQvtNFG1XIjeWvNUl8yXx2qBvy0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775817570, "uuid": "a575a9f3-f01c-4493-854b-c3c896cb5f8c", "value": 61432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775817570, "uuid": "3a7f9f10-666d-48fa-8270-7b7ab8a4679d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817570, "uuid": "fbe6d72c-60d5-4753-aed3-87f5c0265092", "value": "jew.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a722a3ac-34e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775829208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775829208, "uuid": "91da82b5-9ff4-4492-b269-12050d7908be", "comment": "Malware payload", "value": "facd132491666d6f823bb17141250f7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775829208, "uuid": "f786a873-112a-4c28-b4a6-a6e67594a7a2", "comment": "Malware payload", "value": "1d44541ba854a25d6ca4050fa6cd206ef82ee24678fd71f6f58ac18ff51c8487", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775829208, "uuid": "9239fe59-07e7-48e1-8869-fb20e18ec090", "comment": "Malware payload", "value": "a748cbf9084f697247050031cb7936791a1518fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775829208, "uuid": "8f5d4af9-cda8-488a-a3bf-ba5a2213e3a1", "comment": "Malware payload", "value": "3d40a448833d9db5b087384a2057ec3139e613351a1b4b397cb79968430f4d5ba2704a7c9723430fb3f88a380ce454f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775829208, "uuid": "bf3da83c-284f-4292-bf75-059caa4b9bf8", "value": "T1D9169D87B2B652A8D5B2C03586F7C62BD5327C058F20A5EF168877181EB37F45E3A718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775829208, "uuid": "b7177d22-3782-469d-9d13-328caafced05", "value": "f00bc39147e9d75e6df4afd9bdd83da7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775829208, "uuid": "87c2df03-c12f-4cf3-af76-fa7eb21c2948", "value": "49152:9LdaZ/eMhSKhrvn3Y0wKtb4Bcbl1ps2v4xdmE7ZYeAkJsv6tWKFdu9CiPT/G7Cwq:9gzhVixt9Jsv6tWKFdu9Ci668U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775829208, "uuid": "7e88c894-e6a9-4c6f-ab78-37e3ea08463a", "value": 4242944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775829208, "uuid": "f7160363-8a0b-4f3c-952b-a908aa037b52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775829208, "uuid": "5169dfa6-df8b-43a3-8de8-f4095e2add9c", "value": "2026\u5e74\u7b2c\u4e00\u5b63\u5ea6\u5185\u804c\u4eba\u5458\u8fdd\u7eaa\u540d\u5355\u4fe1\u606f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf07d984-34d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775822376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822376, "uuid": "6c0f4ef3-cc23-4a7b-b0be-5f8b1e4e140b", "comment": "Malware payload (Mirai)", "value": "209dfe968c18f48ade7c3c4075f50706", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822376, "uuid": "7bf94b93-ff33-4f03-92b7-f9d9901035e0", "comment": "Malware payload (Mirai)", "value": "1d68dd9508577016d36cb36f6549502c5fc23448d5eaf64d8ed4b02b39801a4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822376, "uuid": "e6ef58a0-37e0-4f32-ba5a-15fdef5cfefc", "comment": "Malware payload (Mirai)", "value": "341662ffc9c41c5942ded32f2a9dfc9c436b8d44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822376, "uuid": "c1e1643f-d0ff-409e-bf84-897e4ab69052", "comment": "Malware payload (Mirai)", "value": "861135f7e066913a55a5f4133aa370e391dab0a785ebda0e832a09659336b417b5c05b327b4883a29e00517c24f7b419", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822376, "uuid": "31d7f467-889e-4ccf-9775-09caf7e85664", "value": "T11F831895B8818B12D5D512BAFE1E118E3313177CE3DE73129D206F20778B96B0E7BA16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822376, "uuid": "53307047-473c-4bde-aafc-0399de45a730", "value": "1536:ijna/CzPC7fG73nmhsUrrar1FtQtMEig+wG3if7z7ueY52Y0s/hG:rwP0Qm+Urrar8+wG3if7zKeYw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775822376, "uuid": "a74a379c-a633-4d10-a9e2-ee9df757750a", "value": 83572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775822376, "uuid": "4fbf6cc6-8bdb-47e9-a32b-aa0864a781b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822376, "uuid": "2734b47c-2c8a-4118-90fd-5089941c170e", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c15e45e-3511-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775848490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775848490, "uuid": "5f84f336-2353-4364-bd87-0a4bd8f69878", "comment": "Malware payload", "value": "e73aa1944d5bf749e5b8d1b1e9fb3956", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775848490, "uuid": "d58687e1-450f-4421-b204-6ae080caaaea", "comment": "Malware payload", "value": "1e5dfb51162c91d03c80c5dec50a6a5fce5194b7ee170ba09ca5fe0075bd5515", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775848490, "uuid": "bbc8df8d-d284-4d3f-9a04-19440578db0b", "comment": "Malware payload", "value": "6068c76c8c356a0dd1b7f627c4105ca8d15689ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775848490, "uuid": "3cd8e69c-44b3-46fc-bdde-9d691a1bab66", "comment": "Malware payload", "value": "3c2c5ee64515b12704033c21e807831a6d410584b84cd3fe78f45f8f8263f6f40b2d4c5a6827943a524976a86acddf88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775848490, "uuid": "186b7e3e-5675-4dc8-bb98-0a47124cf97b", "value": "T1B2756D43E2A620ECC05FC170975B6722F93174055B38BDFB92D0D7352AA3E906B7AB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775848490, "uuid": "6e70e580-4518-498d-af1a-d8980c219263", "value": "b712b3f1f6f5dde070c523d4407e5a3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775848490, "uuid": "4275f431-6075-434c-b28d-33c22b58a86c", "value": "24576:ids9Esxlce6k91UOld2LMxmeDozCMZyFFkMEymOCUwPP8BP:idaEglcAHNaYczYgyL2PP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775848490, "uuid": "ebeae307-26e5-41ec-be71-f7ba70d23b4b", "value": 1566208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775848490, "uuid": "7c8aff3c-f2f2-4937-9cff-0eceeb8683c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775848490, "uuid": "ee6292ab-f5b5-4e76-85d7-7fa132cd001c", "value": "f_ex86.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1639bf8-3482-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775787108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775787108, "uuid": "5e2fbad6-3695-4ef2-8357-5295fbf35e8a", "comment": "Malware payload", "value": "b3223c74932a92e79c7a9875759906b0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775787108, "uuid": "fa915793-0212-4536-846d-c6662b577e6f", "comment": "Malware payload", "value": "1ebb03f11c7356520fc8bac4a7b49c83760740a3e00eb00309096cacca50bcc0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775787108, "uuid": "259a5b11-32e7-4e47-83e0-8f24cfb1f6ca", "comment": "Malware payload", "value": "9a00284bf536a41fec125ac1786e8107408f258b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775787108, "uuid": "55d1171a-a071-4cad-b888-8402b3f3e017", "comment": "Malware payload", "value": "cab65ac20df8e86f44e22cca614e5127c8ae64158741c85e47cd121324fe4580d41fbd55af6db795d09154a95a4f40d5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775787108, "uuid": "554d346f-8618-40a7-a7bc-68bac9ed944e", "value": "T1B2E0C00C74800873BD369CF9BAD73584810FC35E3D0EB59CC294241FB4F4890A000833", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775787108, "uuid": "6e5ea817-ce3f-4b86-b0d4-50e746d222ed", "value": "6:/24J+d9FENsRV6M5dOuRVYyttxYZo0I9nZKY3FsDKVKhOXqIKLsVKhOXqIKa03Ix:/24J+zF8sbYuRrFYZoDZYWghsOLsghsX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775787108, "uuid": "b6062976-83ef-4803-b98a-b7d6db22cbc0", "value": 365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775787108, "uuid": "81a3699b-849e-40d5-a8c1-69e0dbeae2d8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775787108, "uuid": "790a9a05-27e7-4b3b-aa83-fe1d7326e9fb", "value": "O.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e635d323-34d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775823731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775823731, "uuid": "90eaf8a7-2f4c-498a-9a0c-64480c85ccb2", "comment": "Malware payload", "value": "70cb35bbe9b6089810a008069b28299f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775823731, "uuid": "23f0f478-8297-45da-8601-db1ea4d2ee6d", "comment": "Malware payload", "value": "1ecb7609206b251ed877c0a9f340cedd51503de1efbccde7e515e8eec0ef82eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775823731, "uuid": "5734996a-2cf8-4fe0-a005-8256273e24c3", "comment": "Malware payload", "value": "244353e4b7de1fc4744fc5aff28ef53a47d59e3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775823731, "uuid": "bd038be9-fcdc-4327-985b-4f611678813f", "comment": "Malware payload", "value": "9d175d1c6c056522f231c7734ab67f60df45e5ab0d9508b2c7b4728f73f73a89fc9ed8c779fa84088a019f39c485d154", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775823731, "uuid": "5ce35dc2-315b-4b81-a0e6-ab230862e2e4", "value": "T10E845C21DBF88219F1F70B48EAB62422A937BE362D3DC54C1545174E07F368988A57BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775823731, "uuid": "2241e71d-a37c-46d7-834d-93737b2eb33a", "value": "6144:QtJdi6vNp42XVaLcY1ljrgzll4HiPcpW5HK8LLqJ6qswDLb:QtJMQHlaJ1lgzltPLLqJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775823731, "uuid": "9b18e412-d282-46ed-b5f5-1925a9502f14", "value": 399236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775823731, "uuid": "70c99052-8e1c-446e-9cf0-12d148f7b95c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775823731, "uuid": "03bfff57-2b4a-4e76-97fa-2481bf3db9da", "value": "TCO-AIM240204A.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4641b7a6-34fa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775838495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775838495, "uuid": "7b7d6f54-b85a-4485-80ab-3a49aad4dc9d", "comment": "Malware payload", "value": "34dd47fd23ef9746d5350139c8a5e298", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775838495, "uuid": "7d1941c5-e65c-42b4-a51d-91cbcbca3c3c", "comment": "Malware payload", "value": "1ed2cc2d9a93ddb2616bf21ae4a2ac8c4f813344831f9396f35c5c51b555aa69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775838495, "uuid": "bd98d844-27d3-41fb-9a20-342dd287d0c7", "comment": "Malware payload", "value": "798c1dd9c6b9bc7eefcd9bd37047486ada4cfd7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775838495, "uuid": "327651f5-a8fe-4872-9496-7898285193e4", "comment": "Malware payload", "value": "2d4827fe32b144a8f32796011cf727efd77ff2380992ec61d95588681daba1a29c7ae2a93b6bf13cba39403a33efa83a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775838495, "uuid": "fbc372e0-c3e5-4246-bc11-bc0d4deadbd2", "value": "T15BE5F10A64CBD285FE5874B9507BD3F1D263CCA47A2505ED9883B43638331B4BB1AE5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775838495, "uuid": "1565f61b-7bd1-49a0-904c-c5c194d204c9", "value": "49ef27758f86f7a8ab10bdea979f4dd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775838495, "uuid": "f9fa6f75-fc30-4705-8f1b-917df0ba4ce7", "value": "49152:6lG4bcPAlOo2ylo3U9Rl0vnlGLU7Nzz8+PIsvlr6w1Dc+rHMm:6lG4APsXloE9InlOU7/Istr6wpc+rHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775838495, "uuid": "4f11c348-c354-4f54-9cb1-40b9c7ebd7e1", "value": 3305472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775838495, "uuid": "b2b8ce5c-589d-430b-b8f5-7333e10281f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775838495, "uuid": "3b7c26c9-ca25-464f-8c5d-8db78d1236f3", "value": "\u70b9\u51fb\u5b89\u88c5\u4e2d\u6587\u8bed\u8a00\u5305-zhcnc-bR15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bac787e-350b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775845912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775845912, "uuid": "b0eb845c-75c2-4120-8658-4454ca2e1914", "comment": "Malware payload", "value": "0ac44ad9cfbc58ed76415f7bc79239f9", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775845912, "uuid": "e49f29dc-f115-4228-8d9f-e417dec344fd", "comment": "Malware payload", "value": "1eff237dee95172363bfc0342d0389f809f753a6ec5e6848e57b3fd5482e9793", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775845912, "uuid": "7604c329-4dee-4284-911d-8ba28d2313ca", "comment": "Malware payload", "value": "f759ccb6886234c63a66abd6102c636a46d1eba8", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775845912, "uuid": "8022dca8-4194-4a9e-a8d0-f9c779de8126", "comment": "Malware payload", "value": "c9055702b17125a102115afa32405130132536c03c721d55358e03e3f05d22f12cd434b0d86a54c9602de65b66014a92", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775845912, "uuid": "62db1374-b391-4a03-9a54-992ec1d76a2a", "value": "T1B0525C5442B08192C224CF767BA9228E23B1BD717B349B573253F75C8BA564C6D90C2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775845912, "uuid": "7d9ed600-7846-4ddc-a24c-410594f5a1ea", "value": "96:9yKbXKvtydHWFnAOXgWn8XHblUkFB+JJZfP7Da3R/E17UFbMiCzw:9ya8wHx+b8rlN+fZfP7mu7WMiCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775845912, "uuid": "e81eccc0-8016-4dd1-9419-5f53f0096550", "value": 13254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775845912, "uuid": "ad4e5095-e0a7-400a-a354-777b417de68e", "value": "application/vnd.ms-htmlhelp", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775845912, "uuid": "0e75401c-bac3-44d3-9b08-60861826f20d", "value": "api_reference.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70cb5562-3504-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775842861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775842861, "uuid": "e6fc88fe-39c0-46d9-b70c-1ae89b115554", "comment": "Malware payload (Mirai)", "value": "100c606d38921ea0cc87c6363da60022", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775842861, "uuid": "bf65c6db-1251-464a-ac1e-2327bb0dd9a6", "comment": "Malware payload (Mirai)", "value": "2066f8dc782e4fcf9a0cb4bbffc626f2c9a4565d584c41b48d3f96e2abe3c4df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775842861, "uuid": "0e0c2030-4605-4dee-956c-8cd64b579b19", "comment": "Malware payload (Mirai)", "value": "1fd8e61bd833538a4a488f6449915866b6f593eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775842861, "uuid": "978ffa82-3aea-4ab2-82e8-a21efec10f0d", "comment": "Malware payload (Mirai)", "value": "6c255da565ed070cde056f26a37359d4e03119860b8040e704449e27a3e3c9e7e53ef8da6724a83651a345606ad29219", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775842861, "uuid": "8826c1be-9b2f-4222-b938-0fe7bd67b9e9", "value": "T109D3B021E4006DD1EC2129F578BA96B80350EE740BDE1582EFFDF95E647BD9438AD2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775842861, "uuid": "c4d72801-ea7e-4664-9938-fc0e18f26f55", "value": "3072:PnicTtkAg7FSGp+VJE6AqUjq+c7zAbpb9/xo:PiySSGp+PMmT7zMplK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775842861, "uuid": "0943f605-71c9-46a9-a209-b0cbbe01c83d", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775842861, "uuid": "8814b985-8d83-4904-aa3c-03dd5db6f4cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775842861, "uuid": "39befa9a-a05d-47a0-904e-0aa6f5e0bfe5", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b985d0-34f6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775836878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836878, "uuid": "39c0caa1-d638-4ae0-9906-6eea62aa3663", "comment": "Malware payload (Mirai)", "value": "3bcf42fdb236416d4ee5d47eba0863d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836878, "uuid": "a2ee4785-5d6a-4822-a924-7faf48ad6044", "comment": "Malware payload (Mirai)", "value": "21920e475a8e6b8a60d57d92b67cfe3a11f8bd90acc3c138d6ae2a350aa554e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836878, "uuid": "55bfa9e8-f691-48dc-9676-527b098221bc", "comment": "Malware payload (Mirai)", "value": "04b8a027689f2b1e2b39042a480106b4ca75d640", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836878, "uuid": "482b6d56-eb09-4dec-9627-a4583a95c676", "comment": "Malware payload (Mirai)", "value": "065d91ccb870f7259c5ca7e42c067ff49f7a51e8ccb1761a1975585e1726bddb111ed005a30c61ba936e1281385a1aca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775836878, "uuid": "349c8b38-e516-4f14-9e2c-b86d19fc8c89", "value": "T1E8145A05FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775836878, "uuid": "caa06ce4-137c-4e41-a517-f12cdcc5d2c7", "value": "3072:ESZAGIiEgACYrerYqlNSwppHaecY4NX2UaN:HZ15BTYCrYq1QDY6T4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775836878, "uuid": "e71cac1b-6a27-4b8f-a8d8-e2c708629c4a", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775836878, "uuid": "65b8618f-bc57-44cf-a49b-27a1c48e801d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775836878, "uuid": "0d4118f8-6574-44fc-8df6-f27fe6ee3c96", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7bdd493-34f0-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775834470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775834470, "uuid": "8670d4d3-5515-4ef4-a85b-934471a73287", "comment": "Malware payload (NetSupport)", "value": "604d6fab8caf86de2d625ec951abe456", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775834470, "uuid": "803ac4d8-ee9a-4052-b5ab-ac1e51ab8cd0", "comment": "Malware payload (NetSupport)", "value": "2290bb864aabf6acd1ad3c9e2f2604d43c536c1981ebad6f24bc540057bc22e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775834470, "uuid": "9c2d09e8-282e-4ae2-826d-037f87fb5617", "comment": "Malware payload (NetSupport)", "value": "5a2f48305a9b51c83134a151c68ce2d1db68d71f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775834470, "uuid": "e4824ba2-6114-4c96-98e9-ced2db9d0a25", "comment": "Malware payload (NetSupport)", "value": "b46197e62840ce0c49ebdc59087f97aaae359bc6ebe0108d3868c995620dace699886f1edaca34a0b90fc63734fecf11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775834470, "uuid": "c3255a0d-9f58-48c7-aab1-ffef0a1222fd", "value": "T1F8266D1BEE6409F8C796E1784923E3C2BE64B400132123DB26D9635A5F637F84677F29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775834470, "uuid": "73c427ca-8d3b-44f9-b093-0f5906eaede6", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775834470, "uuid": "65cff57b-8270-4280-b560-0d25a32250d5", "value": "49152:bpMKrGRPpkVmeWTxxNmFwduHbNS8j+Qcl7r:bpiE9Z7NNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775834470, "uuid": "faf73121-f25a-4806-be29-748a49b88ada", "value": 4518444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775834470, "uuid": "4b8939db-d32a-417b-9604-7113eb7bc887", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775834470, "uuid": "84056a8d-3aa1-4b20-a4e6-82c8fe0ef993", "value": "SecuriteInfo.com.Win64.MalwareX-gen.33893287", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ddc82c-348a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775790355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790355, "uuid": "eb78634d-d78b-48a4-9fcf-32bf1291192b", "comment": "Malware payload (Mirai)", "value": "23e44c4e864a0f1c77818cbbc7ed08c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790355, "uuid": "c8492d94-c5e8-4d6c-927d-5b22500333f9", "comment": "Malware payload (Mirai)", "value": "2410fe67008effaf1f9684514c7118be5da2ab019ffbcbab79446b68032e845b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790355, "uuid": "859b276e-05d1-46aa-9071-d25754b0151a", "comment": "Malware payload (Mirai)", "value": "82ed6b86d731b5cc1198b6557bb6c5fdf6e117a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790355, "uuid": "a45108e7-f4b5-49a4-937f-1d496b7c2981", "comment": "Malware payload (Mirai)", "value": "45cc94718c25cb1059766628750956f663b8ef337aa4538c00ad01ade4f5977c2734c124f6f2d434c1941928518537f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790355, "uuid": "6ffd3153-0708-4447-940b-0b62f9c78ab2", "value": "T126431995FD419B12CAC15277FF5E4389772B03A8E2EA33039A269F31378B9560E3B511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790355, "uuid": "c43eaf26-b42e-4486-b191-d448e8202f21", "value": "768:SbbYLDjBwRsWQ9WYrO4SDhYaR8RBULDMZDc/W4ZGMvYtaA/5V21Qhuc6vzI:iqWQsYrO4SDhKXDZQW4ZGYY3xtX6vz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775790355, "uuid": "04590456-15bd-4684-90a6-844e0e9df0f6", "value": 58752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775790355, "uuid": "03f52c4c-70c1-407f-8545-b08492c96182", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790355, "uuid": "4a1cdcd9-9c27-4fdc-b675-eae3b738543f", "value": "Clipz.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d97aded5-350a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775845613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775845613, "uuid": "907153f6-6cd7-4ac4-8834-11fb812c7a9c", "comment": "Malware payload", "value": "4fc498be27e8dad52067f7b01816d5c0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775845613, "uuid": "53e58297-4941-4237-9a65-3d6b0d8f7291", "comment": "Malware payload", "value": "2775e7b5162ad1ba82f062c12c067da69d66a6113960a1bd2dcf6024bb0ec03e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775845613, "uuid": "5c3eee58-fde2-44f8-9ee2-ec07e04cd46f", "comment": "Malware payload", "value": "8417c2ddadfa63c8fef6b532951c05d9d5e80e54", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775845613, "uuid": "3a3509ce-1217-423e-b288-dc9bd7564b30", "comment": "Malware payload", "value": "3461f102bd46fb235d9aa7f2aa1e722f21777762fb8dd5e89532db9ed5c8ae645bd3474c7a6372cfcefeddaf273777bc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775845613, "uuid": "e993b060-4c95-48c9-b92c-ffa0e7561e53", "value": "T191964A07E89555E9C0ADD2348662D263BB717C485B3133D76FA0FB282F76BD06AB9304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775845613, "uuid": "d16dca68-89e6-47c6-ac67-d47e2e13aa90", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775845613, "uuid": "1a4fb47b-2f50-44a9-a8c6-ebe474140bf7", "value": "49152:WJlnogFk9c1aNHIL0C4qL/Kcxr9W3wve7FCojRTWq8zJXIHj7V4wfQpr29+jpTk9:WQFu/Lw3EehzdwyaMUkp9vhEpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775845613, "uuid": "46e22013-9d38-49a0-b455-bd4541f074b2", "value": 9334272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775845613, "uuid": "2e203b19-ff15-46d4-94c7-e1bc3abfe9e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775845613, "uuid": "6de1e9e7-a429-40f7-99e5-b5f0a379032a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba39ab1d-34d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775822368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822368, "uuid": "62aa0e74-34ac-4532-b437-46c662502b07", "comment": "Malware payload (Mirai)", "value": "f68e87888f00a003e973dd3acf97ce88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822368, "uuid": "9be47900-eb7e-4571-b23d-015a457b576e", "comment": "Malware payload (Mirai)", "value": "2945f83d506dd5ad780761bb0c39cbb12a92ebec58106f609d1878d431594a9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822368, "uuid": "17ab82b1-70ae-426b-a050-8203c84263af", "comment": "Malware payload (Mirai)", "value": "d379ca0d5b79e4e2511bd92ff34ee6c2709d5dd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822368, "uuid": "93a830aa-5333-4dc0-a8a3-3f3aabe5ab77", "comment": "Malware payload (Mirai)", "value": "574be06ee6d8a136fccb83e11655aff16fec1a1b82d645dade630819812c43a32647d1cdcce3deb5a6bbe8ac641d828d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822368, "uuid": "e84f8914-3345-4d83-b9dc-3fde1f19c0ce", "value": "T1D5631A91BD819B13C6D0227BFB5E428E372653A8D2EE72079D226F21378785F0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822368, "uuid": "db0a7bc9-e7d1-4b6f-8260-a6d3f6a504d8", "value": "1536:XGBQnw68oqNi5Ikzn/GIw+D3ohyaRdWViEs/hX:XGBBa5jb1w+8kayA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775822368, "uuid": "9dab3d94-3b6b-42e7-8d5d-de79244c8bd6", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775822368, "uuid": "38963354-cad5-4d98-b491-97a0fe7f8fff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822368, "uuid": "61bcf7d8-82a1-48f0-9e2a-1d674319ab00", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35233aa5-348a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775790362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790362, "uuid": "01b91937-9230-4db4-9563-759507251ab8", "comment": "Malware payload (Mirai)", "value": "c43366ff31cf4285e394f6a55efe3990", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790362, "uuid": "d26aed00-bb2c-4d53-b4ec-a027089d377b", "comment": "Malware payload (Mirai)", "value": "2988d323b09fb5b373acc1cc6caaae4f76ee036d8cd9ce08d1a21bff30bb9f1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790362, "uuid": "ef81afef-06a2-45b9-b513-0085627c6682", "comment": "Malware payload (Mirai)", "value": "cd4f69b38cce8aca3086f306fe1a2592d97ea14f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790362, "uuid": "d2defadc-7c74-43ce-8389-b42599876314", "comment": "Malware payload (Mirai)", "value": "49aba9eefe36c83e0a8d239e9a4272e4d13a76703ebe725e64c0511f693c148a4fa422170759bbff6369b9d3a315dd99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790362, "uuid": "04c519ba-6ed5-48be-9d38-884c5645ae9f", "value": "T1A473C85E6E318FEDF168873447B74B20A7A923D623E196C4D2ACD1105F7038E581FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790362, "uuid": "7f2ec81d-b797-4d0f-8fb0-ab0712f73b12", "value": "768:uanj974XW2PAhjl3zh6h/qun1By8qb/HDB63HLQcL7qISXwGCkemLtIN3e:15D2IhdzACugbfN63rQ3XwseuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775790362, "uuid": "4d261c99-7aa6-47d5-9892-e969d4e65e8e", "value": 76904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775790362, "uuid": "5c33ba59-4373-4170-a521-1934d6520c06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790362, "uuid": "3b757395-e5da-4668-93ee-2587bda9d343", "value": "Clipz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b47716a0-34d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775822359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822359, "uuid": "e2357495-c96b-4ea1-a350-082b71e6ac49", "comment": "Malware payload (Mirai)", "value": "40e9f759e0dceafaa4af944ca7ae715c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822359, "uuid": "b0c17ac4-f56f-4cdc-b2d0-551fc7078987", "comment": "Malware payload (Mirai)", "value": "2bf13139147b91a0383143cf7506baafea322df1c33a8bcee0254f0887e74de7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822359, "uuid": "eb3d4d76-989c-4c2e-bd9d-933123bc7897", "comment": "Malware payload (Mirai)", "value": "fc20e680c5069c2cb4a391904b1526b14c11e862", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822359, "uuid": "3c902068-d0fd-421c-bc77-605baad39413", "comment": "Malware payload (Mirai)", "value": "3dad876d8b7210ef7c538ce69f6a52b23bc917cddb9ca04bfba36fa8d90e6597d324ea2b4d3544188f402787d8fd7361", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822359, "uuid": "da525996-cbf9-4ea9-8d29-b50c87914a1e", "value": "T16DA3E506BB650FF7DC6FCD3706A9070225CCA51B22B83B367674D928B50B65B4AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822359, "uuid": "dd0a3610-2c90-4bd7-9399-a23c92d7a649", "value": "1536:LvGefaZSdtlD4/xl4ExO29zyN0ZNhdZp54crFCZeLs/h5J:LOefaZSds59zm0Hr6eoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775822359, "uuid": "5e1a53e6-fdd0-4f1f-8429-cedf2582f653", "value": 97736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775822359, "uuid": "d546246f-de17-4f7f-b5ea-9daa6df79485", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822359, "uuid": "d9fbe037-00b0-4d34-93fc-42496eabce3a", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cfbb5c2-348a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775790295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790295, "uuid": "8d59f6a9-c975-4e5a-ac71-a90ea3feee18", "comment": "Malware payload (Mirai)", "value": "9759454edde8e7a25013e1026e46a942", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790295, "uuid": "709e07ca-f7cb-4fb4-b3bf-10678d66516d", "comment": "Malware payload (Mirai)", "value": "2c77f6248d3ca2633fa7e816c399c084e0afcaa9e9b8f5954d03f0e0e75335c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790295, "uuid": "a4c2f420-8970-4ba3-ad40-51686cb2b1e1", "comment": "Malware payload (Mirai)", "value": "6eae2944329983049df98ef7c3b1a753623fa20b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790295, "uuid": "c799bde8-f1d9-42db-ab15-7e1d27b29c4d", "comment": "Malware payload (Mirai)", "value": "e2eba6b193e602aa8087504cb7fde1d9864857d16066dfe8f87caf619c619265ef91a9ff945876d1ad256570016fe249", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790295, "uuid": "aeb660be-d764-4e52-8836-e11a043f1874", "value": "T1B3D2F1749C07C5ABFF0C93FB409F8F246D3105968E3AFD69E6550A6D04D16CA4A3783A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790295, "uuid": "bbd7911f-a0aa-40e6-8241-31d89ccd2ced", "value": "768:+HZKPDHh7cyoctCjprX5b7h7uF7xGSD+79:dHhYtcIdrXd7Yzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775790295, "uuid": "c0b58b67-da47-4894-9478-f497982734f2", "value": 28804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775790295, "uuid": "556cfe8a-61c1-4ab2-8153-9d75f6ccb770", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790295, "uuid": "7fec45c6-1195-4490-9338-44c32ffbb643", "value": "Clipz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd23b89-3510-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775847933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775847933, "uuid": "ea0d64c0-25bb-40da-b5bd-408f5c47d0ab", "comment": "Malware payload", "value": "b445cca282dd108b170316a2ef7b89fb", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775847933, "uuid": "059a5842-f9df-4b8f-a12a-5aea65c9653e", "comment": "Malware payload", "value": "2dde38bd0c3174791fa567c117ceba8f369155096fdc435614f48d885befb454", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775847933, "uuid": "c1eb4d82-6925-4ee6-98ac-dc1d7eceed1f", "comment": "Malware payload", "value": "188b252b29964e027f0b4a1d49cd5b9997288f44", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775847933, "uuid": "e7bdcc96-3368-4d87-8462-1f5110e3fff1", "comment": "Malware payload", "value": "010f0e7924304c3e117b276126b56fa0c35a0dd77ea72618d4cab0d4c3a24cc7dfaf612c58c8e8b1f7bf4e453c848168", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775847933, "uuid": "cf1963fb-db78-4035-9bd3-909caca225df", "value": "T1D824B733E6A288B9C49FD1749FCAE5B26670BC184174F21D5F804B127E0BF609F6D689", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775847933, "uuid": "6a2eb01f-30b9-4e86-84fa-a48ae19fce1b", "value": "fb3237bad2e3a80d9e1f2968c22a2d78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775847933, "uuid": "6dbcb190-0347-406d-bc86-191c9d024860", "value": "3072:LAKDJOoKm2v0+2qqQmVQiMmYe4MVJN/IxT9wuqYfJP5L5mf:EXvnoN/Q9wuqYfJP5L5mf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775847933, "uuid": "994e0849-cdd6-4059-a11a-e70d8fe6c5e0", "value": 220672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775847933, "uuid": "7086c48d-c714-4731-b1f8-1d9eca1364f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775847933, "uuid": "d0bba422-53d3-4eba-9b51-7564bb7491c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a047f69-352a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775859090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859090, "uuid": "118fa1c1-0aba-400e-9424-de96a98b713c", "comment": "Malware payload (Mirai)", "value": "371b311254cf0eb5f10829d0a6587287", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859090, "uuid": "2c88cd88-bf7f-43e1-92c8-4f7e4fa1bdd0", "comment": "Malware payload (Mirai)", "value": "2e2b3522666f0db2f136fc05d7ba3151ed69b2cd4ef96d4207d2ac9b318b8163", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859090, "uuid": "9d80d8ec-4d16-47f5-8c80-0230e0a84d0f", "comment": "Malware payload (Mirai)", "value": "fab055228842d4d9053205cf42812fa7ae2f62e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859090, "uuid": "cefd60d6-65d3-45ca-ae54-16f5d51be0c9", "comment": "Malware payload (Mirai)", "value": "616aac7cb180c6e69961ca38a56b60207e88b5006362770a51d7615199cbc00d628bde15c3e6e1660386a20946e3616e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859090, "uuid": "6cddcdd2-a860-47cf-8b85-15abb6d3043a", "value": "T13954861E2E22DF7EF669837447F38A30969C76E625E1C584F15CD60D1E2028E641FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859090, "uuid": "020be14e-60d0-4bd9-a0a9-83b66ec508a9", "value": "3072:OB7GunypOqSRwV+I2OXLgM2x181xM9ZUVQfQ5n5qNbJvwE/a4u1Ubr:OBiunypOqbV+I2OXLvabUJnybJITHUbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775859090, "uuid": "2eea0223-7db5-4216-a825-f957d115e47c", "value": 295524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775859090, "uuid": "78bae5bb-1ff8-47d7-b880-dfcf0c329dbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859090, "uuid": "8830fc5a-ddaa-4b83-b45b-1c626adf4923", "value": "manji.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fca0d5b-34f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775835424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775835424, "uuid": "e7a61256-b718-4ce8-baae-d43234ea79ca", "comment": "Malware payload (Mirai)", "value": "978eadd25f6c4d302d6324db951b7d9b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775835424, "uuid": "18f6c3c8-af7a-4a88-a620-cb92084d46f5", "comment": "Malware payload (Mirai)", "value": "30bc209286efaf474d4d17d1a18b527ea917ca9965e5be87e02e4eb512e34ff2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775835424, "uuid": "53b61235-8ef9-4f83-940d-7b9e5c4cf7e9", "comment": "Malware payload (Mirai)", "value": "cb96965b5e15989bc8fd87083702f223209b9aa2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775835424, "uuid": "24e1284a-d4b6-4953-9452-94d702e8f395", "comment": "Malware payload (Mirai)", "value": "51fd7860d673b54f9a91b244458e5c5b27bfb43708a12574be35d1c4fc6b91c3f2452e7e617b19bc0f639273be80e693", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775835424, "uuid": "94228622-949f-4401-9843-0c4a26c98e4e", "value": "T15B24D60AAB610FFBD86FDD3702E9070139CC554722A52B367674D928F54B64B4AE3CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775835424, "uuid": "89b3b877-392c-495e-9b77-89bbafc255a8", "value": "3072:ySVheAzYmWpR2l/m3Oil0MOOUmeBOW91nBIAXXoOSr1:ySLeAzon2lMOcOOSIW91BJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775835424, "uuid": "0b2f8c4a-58a4-432e-b788-18233cae7f64", "value": 227276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775835424, "uuid": "8f1a9adc-9b27-4f26-9f37-f2c85ebf16e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775835424, "uuid": "20039f1b-1e62-4bd5-b8bc-6cd46b16fb4c", "value": "rebirth.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f7ba6d-34d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775822329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822329, "uuid": "22d673d9-1a1f-4d1c-88a3-4825cd92dfd1", "comment": "Malware payload (Mirai)", "value": "3133067c44e3fe5f70f62eb7c9bcc518", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822329, "uuid": "1a184a72-73d1-44e4-aafe-2f84708281b3", "comment": "Malware payload (Mirai)", "value": "3143f1bb94262733cb91ca6d84a014fd29ffc0b1bf61bc8fd1e796e34f5b6588", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822329, "uuid": "6322616c-a13c-43f5-8e38-c4324d78c8ab", "comment": "Malware payload (Mirai)", "value": "d377bec9c93096a8753835785f8fdd033d0d04dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822329, "uuid": "b5dfff08-ac06-4f24-829a-957e34c19a46", "comment": "Malware payload (Mirai)", "value": "9712dc6a657d67daaa97b8957c9ce0bef29a8a78f021d39b7856abb90b635265b33d4dd739a1e18c1301ae5c7ef6f753", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822329, "uuid": "2a0a6b6c-cef2-48e4-9cc3-722e16ec4d44", "value": "T1FC4302AEA2076E93A71314B6D6745CF2B4934FF650C8F435AA5F02B857CD61B433488B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822329, "uuid": "77e002d9-32aa-41f5-8a51-0d6a61952dd7", "value": "1536:6bwzH4WSgfh789A/lVl0iHKLuy6tlV1nLk:FUgpTvlQLd6tlHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775822329, "uuid": "4a8f388d-4002-43fe-b53e-00e3a40c2768", "value": 60128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775822329, "uuid": "0d0d0601-c000-4f42-9eb4-8da8ce594529", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822329, "uuid": "d26376ef-b453-4de1-b0ef-8e8620a155b4", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18f34cf-34d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775822354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822354, "uuid": "11e1984d-795b-4e5b-9e7b-20a91dc5c0a8", "comment": "Malware payload (Mirai)", "value": "9d2e71b4c40fefd4a1aaf51e98dbea6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822354, "uuid": "eff82626-be16-4bf4-b376-2d22549b48d9", "comment": "Malware payload (Mirai)", "value": "3335cd19ad26c1b3ec478aed0f1282d62e15c4203e07fc8110ff819dac71c610", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822354, "uuid": "2b607b85-7f54-49e7-8736-4ee354cd8ea1", "comment": "Malware payload (Mirai)", "value": "7be3cc16733a7e6ab06ab9a155625cbb573bafe4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822354, "uuid": "e7d5272f-8639-4c56-8fae-7b13049d0ef1", "comment": "Malware payload (Mirai)", "value": "c8de189113578a2bdc9c61d56acbe6e2b8674ea2a0cf0f3585e7bc2860b2e00bdf62759af1d378595952eea58662da19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822354, "uuid": "36b4fcef-b959-4ad2-89f7-f745f01d8481", "value": "T1DC535BC5AA47D8F6FD5602711173E7378632F13A1129EA87C7A9ED32BC52900EA1739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822354, "uuid": "cff7f790-2cd7-4816-a3e6-8b13700febb0", "value": "1536:ahZerRy3lVDKvfb9IZG4R9bdx63QFP++CMq32UFSTGhk15uJnaroXf:ahqo3lVDKbd4bZP+zf2UMT2M5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775822354, "uuid": "f727a00e-ebac-4f25-99c1-fed6868ef6b2", "value": 62928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775822354, "uuid": "52878f0b-8795-4055-b356-c775a6235bf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822354, "uuid": "a85e5b64-5874-4cbf-93d0-38c79f0d7d37", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39cd2bb9-348a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775790370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790370, "uuid": "a13a8ddc-14d9-432e-baca-0908c60187b7", "comment": "Malware payload (Mirai)", "value": "c0d908505c72e0fd34601bfbef2eea25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790370, "uuid": "b43de9f6-961d-4588-801c-5d94da2344dc", "comment": "Malware payload (Mirai)", "value": "3427662f1a6db21c0f2bf8a0db8befbc222e7b6466d5bb1ef62e43ac8646d52e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790370, "uuid": "8827b63c-0cc2-4b74-b7a0-522fa7c563a0", "comment": "Malware payload (Mirai)", "value": "c904f05897c6cbc4a5508de02c725474243afc24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790370, "uuid": "d97a37c2-ec51-4e35-994b-8dd1f7b77911", "comment": "Malware payload (Mirai)", "value": "52691ae00e772803e66e401c75886e8347bc4034bca3003e0b8492d5f832818b9b86b4be1bc0a362439fc833b8acbed6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790370, "uuid": "c437f07e-e7aa-46c4-a5b0-1e674f374cb2", "value": "T1DD436D42B30D0907D1672EF03B3F27E1D39FEA9121E4EA44354FAA859275D325686ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790370, "uuid": "3e650d49-30f5-4e2e-956f-eb533c43ff7e", "value": "768:8Os5JlnSJgOuqzeuRmAieGoMAyH9DuX5d2G2Prr1lKtTgmrfQjK0IQ:OJlQgOuqvRmJLoODa5d2Jrr1ApqK0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775790370, "uuid": "f3578f51-4ffe-410c-a46f-86b4566fefb4", "value": 57028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775790370, "uuid": "00f2b0cd-b3a8-4768-a287-e6de6d9d21be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790370, "uuid": "d2c8b4da-d7aa-45fd-ad73-1eaad6967fa2", "value": "Clipz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d2a26c-34e6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775829850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775829850, "uuid": "f2eb905f-7dcb-4e19-bd5c-4c2d7cf835f5", "comment": "Malware payload", "value": "7d6201c54edbe18c1ff82e549b5d5b12", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775829850, "uuid": "8cbce8e3-a953-443c-8e3e-5947feb85da9", "comment": "Malware payload", "value": "343a03bb86f202fc05ea8881408a820cd91ef2472c876649b5b003d7922b56fa", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775829850, "uuid": "79b55aad-62e2-453f-ba02-992ee5f26fd4", "comment": "Malware payload", "value": "eff098692ad975e2811b78f6dc6118e7e1d01085", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775829850, "uuid": "4f7a62b1-dac7-4f80-9834-f9ad1e3a5c51", "comment": "Malware payload", "value": "2859c50d820c2562f7c1b3c974ce4bebf699fe6387672ed3dd81b8915a41d54c6989c4da41cb768e96382cf6d8a742f2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775829850, "uuid": "b85e2f80-3989-46bb-898c-1d9bec241a65", "value": "T129355C15FE13A6DCC029D8348A5ADD020EF87CDB0FD1D9AF848754666A6E5F3E738608", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775829850, "uuid": "104bfdc6-5f31-4f52-9a68-6197e31ef87b", "value": "f090d2b92bafee32ac5fb9f6d29b5148", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775829850, "uuid": "a856951b-dbca-4085-9fd6-651ff0553dbd", "value": "12288:qUEa2rrSnZqTBthPEcQUjBsx+Hbw+Nq3TKWhXnBrI92jrg514:MakrSnZqB8cQOB++HbDE3vhXdI/14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775829850, "uuid": "bfa1bdc2-ecc7-492d-a98c-6dc599ea3064", "value": 1058304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775829850, "uuid": "61730a76-1156-4d2d-8c76-465195a01cdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775829850, "uuid": "72c3e544-245e-43dd-ae9f-3247ff2b4c92", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f43c2f0b-34f9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775838357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775838357, "uuid": "2a4e7e2f-7fba-4f0a-a844-01e59bda2f54", "comment": "Malware payload", "value": "e97d434b29fe71bb466c75016f2239e6", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775838357, "uuid": "a3d9fd44-3037-4b1f-bc3b-a3fd1764bc39", "comment": "Malware payload", "value": "347b225d68578cbe75860fde144344dc1e75879f57d389a056950d2542b43698", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775838357, "uuid": "335ecd23-6928-4a1e-b731-c0086d1fd14c", "comment": "Malware payload", "value": "a016e824d743fff82c3b2f2c33f7fb97a43ea2dd", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775838357, "uuid": "794c62b8-db9f-457c-b38c-3b84f1659e15", "comment": "Malware payload", "value": "1a9afeae3a5c712ee99547d2aa2d5939670ce3291511f6d9c32beb24e6063b16b9ab3d6427a6fb4be64ead710553d086", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775838357, "uuid": "afb72a5d-02e5-47ee-866d-111a9090f77b", "value": "T133E423F26AC58EC1D0815F72856B27E517EE8C643042E89A70DA388CF7B75D62EB1E14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775838357, "uuid": "9f303f0e-43d1-4754-90ca-c609dec8e9d8", "value": "12288:u354hXjmgQ/mKzAGY4AyMZv9PtlZh/YbGVba2IZlncoXEzgLrI9KIE:M5oyR86MZJtlZhzVyuu6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775838357, "uuid": "f6db1e64-5bbc-4809-bbb4-54f332586ada", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775838357, "uuid": "00459aa8-ec29-480b-9b31-e0bcce45f2ac", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775838357, "uuid": "9fa92f0d-6df0-4b12-a8af-7e804b2826c9", "value": "\u70b9\u51fb\u5b89\u88c5\u6c49\u5316\u4e2d\u6587\u5305.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73ff4db-3514-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775849878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775849878, "uuid": "7e0fa2ac-1e86-478f-86cf-cb0f22b1f1b8", "comment": "Malware payload", "value": "01a28f75ffb8ed8684a6c01ba977a872", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775849878, "uuid": "f3b65fca-401d-45ea-a4d3-e5fafe178f90", "comment": "Malware payload", "value": "34e0789d21c0a8339f27d4b681e4648d789c5217811842239287e804e3073c45", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775849878, "uuid": "cd16b4f6-3645-45e9-9c88-e67bb152b649", "comment": "Malware payload", "value": "5524e22b30906a9373708b5eb733a608ae8cf8dd", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775849878, "uuid": "c491ef61-8c6e-4c20-a1e7-e5cb7a8bd60b", "comment": "Malware payload", "value": "ccc4109e733c268457f81f0ae3533e483e4e3338e2a678eeedbcac8c5e17ce215385866cb93c65d2a63a712dc025712a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775849878, "uuid": "ecd6c793-915e-42ca-a153-a0cf4bd5f09d", "value": "T19FD58CCAF7C4AD6AC4F36372C67A56A215174C268B83CF935D44323C19B76D05F8AAC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775849878, "uuid": "0e77409b-ef17-46e3-a3f4-844ccd16536f", "value": "49152:CIRFmRjG/o/KrcsawU7LSs1kGQZya2GwikujFD04uYz9qmNU1USH:Cqo/KrcsawU/5ab+Y04BJqoU1USH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775849878, "uuid": "f0d2d1b1-77a9-4a04-b4e9-dfcf7f94de91", "value": 2910569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775849878, "uuid": "c9eec874-f776-4172-a7b3-2b7356b01b23", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775849878, "uuid": "71319d7d-d01a-4b29-a1ba-9ce83d861b4b", "value": "34e0789d21c0a8339f27d4b681e4648d789c5217811842239287e804e3073c45.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60241cf8-34f6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775836820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836820, "uuid": "a5bbc9f1-93aa-4f84-ab5a-826da6c35e56", "comment": "Malware payload (Mirai)", "value": "b6c72b15e001f7d8787d6c7a286b52e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836820, "uuid": "4fcbea7d-100b-44d0-b382-1266608050d2", "comment": "Malware payload (Mirai)", "value": "35bac26f5c6be15bd4c3c0675774d81f16ec3e1bee3d33cc6cc42ed4c614229e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836820, "uuid": "12ba4d0d-60b5-4d32-b719-5d5cfe3517d7", "comment": "Malware payload (Mirai)", "value": "e2549451bda4b040a3be885ff927193ff5a524ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836820, "uuid": "81a0a4d5-c1e2-4e0c-8202-a5d225b5f2b4", "comment": "Malware payload (Mirai)", "value": "dc3c710b034f379d220069b980d22888cd52d5f7fef8e62cbac02086621898d377a6d30baa6b43df5cfb30bfd0ba04f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775836820, "uuid": "61a98749-b733-4036-a2a2-2a9f11e9d4ae", "value": "T10C5302521A6CF829CAE7D93D0B7840E686DC8EE4A492900F53CA7DF44A05D38BEDD587", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775836820, "uuid": "5e7a7e54-4a00-4f42-87bc-2f57add29e41", "value": "1536:Mdcqm5iERozq3p7o8FwOA4zCKOFGUfKbeH6UhV/uzKUmAQc:MaHJgMo8FwOA4zUFGUO3UhAzKUBQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775836820, "uuid": "e97dc600-6907-4278-83a2-acfad04cf442", "value": 63928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775836820, "uuid": "cdf4f3d7-e330-42ce-a8ef-97781f68b9cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775836820, "uuid": "68862a80-d5c1-4687-90a7-1e9c03936f45", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71aa5af5-348f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775792611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775792611, "uuid": "4211489d-976b-4617-a7d5-6cad92e65968", "comment": "Malware payload (Mirai)", "value": "e9c3e1540a3cd6ab19769b4f322f326d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775792611, "uuid": "d3cec64f-8eae-4006-8f8a-a5902100cf08", "comment": "Malware payload (Mirai)", "value": "36c75c26cff6f4bb850d7ce90ce7d0bacf9b8fdb057f8c5b14a1ea9df67ada98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775792611, "uuid": "f71847e1-cdf3-4624-8509-8a6021cc81cb", "comment": "Malware payload (Mirai)", "value": "be5b69212c77615db32020fcfc4ced4033096ca8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775792611, "uuid": "4bc9963a-dfeb-451f-9cdc-b4a93259239a", "comment": "Malware payload (Mirai)", "value": "d48a6a2e0322cc49e9c3829e2b5d510807efa214301e2526d6f5e35745972eb5838f799e36d51a924aff41b8e1c17741", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775792611, "uuid": "dd68e518-d784-44be-bdab-f40c5be879a8", "value": "T1853317C4E903D9FDDC5619712137EB328772F13B1029EA87E7ACAA23AC46B41D44729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775792611, "uuid": "f676f512-c666-497f-b26d-555a9bc25759", "value": "1536:O13kynNjv6czSEZeLmI37KNCgoTctoQzWxS2RAfah5cQ:AUyntv6cuEZ437KAgowtoeiSi1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775792611, "uuid": "7d1a6d4d-12c3-4891-a05a-cc86104d2b01", "value": 54864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775792611, "uuid": "e98a092d-b154-4479-9fd0-012251f9f44c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775792611, "uuid": "3aaf0b29-e64d-4589-b979-300e397eb02e", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f31d38fa-350a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775845656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775845656, "uuid": "ff6fafb7-16d7-4481-9e5d-e929cb65f7b2", "comment": "Malware payload", "value": "dc0f1379ed4e8d25a68fee99aeb01137", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775845656, "uuid": "fdc01f31-24d1-47ff-acbb-2710eb9ab7c5", "comment": "Malware payload", "value": "38afa677ae2aff1e35cc1f2dbb0286417c558d019996161279c488e7b0a00607", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775845656, "uuid": "7a61dbce-f58a-443e-bdca-531f224ff884", "comment": "Malware payload", "value": "ee443bf76d7bcf65ce81be8b28703a8b45d54950", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775845656, "uuid": "12936817-2907-4616-b4a7-5519c5b4e5d6", "comment": "Malware payload", "value": "964129a0d0e2a2f3edba2d023c42f9229785f5c2a3d0f97c42e9fd018425a90f587437ae3244a6adf7feb584e72f9061", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775845656, "uuid": "8e875393-3f81-410c-874f-74a6e9523d2f", "value": "T1F893591136FD5204E5B78B7199658345CFABB901DEB192C92221575C2C21B45BE23B2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775845656, "uuid": "1e6ae2da-8848-4153-9e9d-742bc01e16e7", "value": "24:99/jP19g70gJFxhdu1GRzkEFWqQrWhQrWFDYyM:9Fj47HF9u1rEFWqQqhQqFsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775845656, "uuid": "05a069e7-e675-4f1d-98d7-4ec448d0e3c3", "value": 93784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775845656, "uuid": "dabfcb15-3f2f-41c7-9be7-fe3fdfa75c80", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775845656, "uuid": "463cb60b-b1b1-459f-a1e9-bedff76c216d", "value": "Odinokie_Zvezdy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37474721-3537-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775864669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775864669, "uuid": "e3384678-11ef-4d2c-82fa-03faf1e80795", "comment": "Malware payload (NetSupport)", "value": "d0c3727bb29a98bff5f002f8a97adcbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775864669, "uuid": "e775fa0e-9110-4ffb-bdc8-7037861dabf0", "comment": "Malware payload (NetSupport)", "value": "3aad0d3fee7f04ea8bd56016f16e8a45c9a7376e9443078122df2271698b4e50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775864669, "uuid": "8b77ea87-c948-4788-90f9-fd6e8c5da8f4", "comment": "Malware payload (NetSupport)", "value": "fdfb95f9ebd184c0f7e631c3afbb04e55773b5bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775864669, "uuid": "819e4c04-69c8-4eef-8a30-378e4a9f747c", "comment": "Malware payload (NetSupport)", "value": "ad0f0c615ba25dce5419aea85382886e18446d62ce81b4d67dd5053f0a6e51b2601fa528be14398fcb3412d086fd5e58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775864669, "uuid": "ed238ea1-12de-4018-a6e1-9572179e8419", "value": "T1AB266D17EE6409E9D792A2784823E3C6FE28B400132123EB26DA63595F537F84677F1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775864669, "uuid": "729950e8-4173-4b1b-a181-613c59416ef1", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775864669, "uuid": "02d3c66c-43e3-452c-9e42-e8e1540403e3", "value": "49152:vEhS15ubAB4ZExh12jIU2FkFDUIYtjtWQclFrdts:vEjEBt6Pi/us", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775864669, "uuid": "8419d28a-5764-46fa-b07b-6f8119d079f9", "value": 4497429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775864669, "uuid": "e051254c-bc9f-44b2-9400-439ae190f15e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775864669, "uuid": "4c6d9082-5231-43ef-884e-2c5a4734bc82", "value": "SecuriteInfo.com.Win64.MalwareX-gen.78746991", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c07e29-3500-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775841066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775841066, "uuid": "95c4c766-480d-4018-985e-da4879cbaabc", "comment": "Malware payload", "value": "a3d9a5da24e2fd6767f8c93a378b0f6a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775841066, "uuid": "f041fac7-108d-451e-9a1a-8b974be54204", "comment": "Malware payload", "value": "3d91f442ddc055e19e3710482e1605836c799249dacd43d99843257a3affd2d2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775841066, "uuid": "4a0434ee-673d-4297-9ed2-772395d73e77", "comment": "Malware payload", "value": "8e471f8a435deca9fbdb32c70d31612c4967e002", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775841066, "uuid": "ad006e2a-494e-43c6-a0ef-24b4233fe572", "comment": "Malware payload", "value": "6c063d4540702765109fd7170f1f6762af1710cff1b24fda3b8121591779cf6decbd7e234f19949b550bf7785982279e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775841066, "uuid": "93d48ad2-5fd7-47e8-8a35-12aa64402254", "value": "T12BD5338B9654E5CCEDFA13D08A4D33E611F883A43696C3768CC1BBAD15CF5962083DB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775841066, "uuid": "1b9dccbe-1de5-48b2-af96-32b5b8eec6e8", "value": "49152:0/H9TAT5yB+ivDtJOw+qSShRiyprX1D8dO90UfdJjC3U1sd6SoZbBvWHd:0/27iRJOw+qnRiy91YdOigCEid6Sofad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775841066, "uuid": "00b4a4af-955f-42bd-a5b0-fcc6013e2ca5", "value": 2866638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775841066, "uuid": "857ff247-24ac-48bc-a57c-cc9609a802eb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775841066, "uuid": "793b2f5d-0d79-44ac-b97e-8a9bde91d9d8", "value": "hwmonitor_1.63.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec073a58-3486-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1775788951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775788951, "uuid": "a41fac4d-6e1f-4135-8280-6ca811e6ba63", "comment": "Malware payload (GuLoader)", "value": "34d72fc49349b9bfe03f2504b84bbb56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775788951, "uuid": "a80e9c14-8504-4a0c-b8d6-ef99c63c3a8b", "comment": "Malware payload (GuLoader)", "value": "3e13c0ace9f009cd692ccbe6dde3fcd7f0efc419af8e40fcb47af3f99d36071c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775788951, "uuid": "0066386f-2020-4181-b8b6-a63c395ac28d", "comment": "Malware payload (GuLoader)", "value": "293d42eb87b9f71cef073e1f88a0030ba6b2d5aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775788951, "uuid": "ecff64c8-fead-4707-923a-5175daa55f26", "comment": "Malware payload (GuLoader)", "value": "b439fc2ca58090ab9b34071f9e187d0126ea775995af76d04d1d8d72f4e2b78723bad1c5e70f5ada57a4f3727af673a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775788951, "uuid": "0bfe8bd6-4f31-4082-b1f6-35d9ecacd8ee", "value": "T1AE8412B435B0E551E8A10232E425EE3E1FB89D5ED4795E8B130CBFBDBAF1683A41D102", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775788951, "uuid": "89b82ed7-b1e7-4c9a-8a3c-faf978399235", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775788951, "uuid": "b80c64df-bff7-4c8b-a33e-b191058495f3", "value": "6144:BbE/HUe3Y0VKlgggggggggoFJs7oz9GeKlz7QO6KVNqZLi6M3lEMANpW2N+2uE3w:BbcVKlgggggggggoFJs0afzPqZGzlUsx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775788951, "uuid": "70e5bd15-2277-4e04-a19e-02944d4cc019", "value": 389224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775788951, "uuid": "6caf2fe5-4db9-4c7a-b325-2f19ccf1c40b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775788951, "uuid": "d15aff10-334e-41f0-b9e1-2dc857870247", "value": "Coessential.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2efad52-34da-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775825040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775825040, "uuid": "9ad82914-123a-4850-bad6-32f9383fd0c8", "comment": "Malware payload", "value": "31541f27b58de3051acfddc1dc6b6644", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775825040, "uuid": "122d155e-b85b-4d6f-bdba-a00deea5b954", "comment": "Malware payload", "value": "419de443a7c81099777fa3fa29e69604080c3454452988be708e69c7845aa59f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775825040, "uuid": "8363357e-ff65-4337-ad1f-6e03a6918cea", "comment": "Malware payload", "value": "676d55975d43c6a8484850d9b3e25874d797e4ee", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775825040, "uuid": "aff32960-d802-4a7a-a11b-9db6521fc0c9", "comment": "Malware payload", "value": "b4f4362192550ab19f90cd9eeb665b3b438e709155152984a14ead00a8883225900f33d8528ee02e6db0977e04a77989", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775825040, "uuid": "4c09c8dc-4db7-46c5-b940-e07239e44a85", "value": "T13E6633DDCF3DAD21EE4FEAAA8F1F4AD9FD5E8E4C9117010E69B8741208141913AD4E36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775825040, "uuid": "7b2bdac3-3837-45bb-bf88-eb11131870d6", "value": "196608:pz27Hk1/2JP63qAQ5CZfE6S2c0FfRpmhaP/i29EmiIUhE1K:pz2z4lq/qE+3/ibmiIlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775825040, "uuid": "772f55b5-60e6-4f19-af9e-e48de36dc175", "value": 6830069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775825040, "uuid": "e75964b5-c26f-4c36-be70-445171cad8f0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775825040, "uuid": "969e3e77-28ab-4dee-bfcf-5224cd981322", "value": "Krypton-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc24314-3503-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775842430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775842430, "uuid": "39764245-415a-4658-ae4f-cf570204f099", "comment": "Malware payload (Mirai)", "value": "9d8e92200918948fff59d95a0f48dbbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775842430, "uuid": "a872616e-764f-4674-9bb2-8d1b0a381326", "comment": "Malware payload (Mirai)", "value": "41f1e679dfe4f6a1d0b622623e5fd86e6b99188ea45a0328b09b76825dde7640", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775842430, "uuid": "dac343b9-6151-4d4a-8e67-65c851add993", "comment": "Malware payload (Mirai)", "value": "25c0ebde32b2f0a0131ffa3d94a4ea9d32b325d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775842430, "uuid": "e3fdb1e3-52cb-4a5d-9223-71dc2b0e7d6d", "comment": "Malware payload (Mirai)", "value": "f2aa6e340e26d24a9043bf221f1826a8912b1656046e37a2f9acba6c70bbe94b3d8cf3fc7f894b0cb9103381793c4e3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775842430, "uuid": "9a16ce8b-5a00-4208-8741-f267c4770a9c", "value": "T1CEB3AF87B2907ABEF0A45E3FC4135E26A6259F705583273D71FDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775842430, "uuid": "582b1676-acfa-4521-b885-eb5f067852fa", "value": "1536:tdNSXAeuUGWnKYUqwaJ1Xq/3A5hcB57laZeCNjHWBOdiyWT15Ov6fHzR8rSR:t3SrlGWnKTU83AQB5A5Liy36ftUSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775842430, "uuid": "e8f5025b-ac08-4c33-b58f-9ef0307e9116", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775842430, "uuid": "3c9aaa2f-f4d1-4081-8a58-572a320d6bdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775842430, "uuid": "204f089b-02c9-439d-8088-724f8316dd57", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc0d29da-3528-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775858476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775858476, "uuid": "d8ca8a88-e9be-44a0-b4b9-1627c46b3293", "comment": "Malware payload (Mirai)", "value": "975375460f20f8fced5cc97b365383bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775858476, "uuid": "ae68de7f-1ce0-45b8-bd2c-f5ce8d06529f", "comment": "Malware payload (Mirai)", "value": "4490b335ffc3623ec2481f0d0876f106771b4ccb3dc0844f0911b48b05b9cc53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775858476, "uuid": "ccc5ba3d-d6cc-441e-9194-6c5b1d8c4928", "comment": "Malware payload (Mirai)", "value": "da1ac2dcee63e8ef94ed84afd2941fb11ecef39b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775858476, "uuid": "8063e59b-5db7-4039-97a1-f902357a9894", "comment": "Malware payload (Mirai)", "value": "c2649116eb48ae146747e3feae511e89ba6d3ae6e8c03281d5e4b97df86442631307a3724b47569c172c2fe40d65773a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775858476, "uuid": "eb0425d7-e178-48f2-a7f0-8c1d3199230a", "value": "T174627494F155CA27C9F913790AD70336B231EA00B39383D3961C5B3C6F5A38EA60E769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775858476, "uuid": "9be9ae7e-c738-48ff-89be-c3cecb87a918", "value": "192:1LKr3bNBZtevCxMPnaXb4Giq66lFEStk:MrTkCxWnaXb5J7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775858476, "uuid": "144b07f0-49bf-41b0-8044-0f875a822c7b", "value": 14968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775858476, "uuid": "cd24e21b-b759-4348-b7ee-756fa065c044", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775858476, "uuid": "f6a75aca-dd29-4c86-a227-a062d6bd19d8", "value": "arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc581e80-3489-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775790267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790267, "uuid": "be432d9a-2edf-4708-b48f-18713a60185e", "comment": "Malware payload", "value": "f2da611352d743684ceef3940b705e12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790267, "uuid": "d7801c7c-12c5-4b67-a6c2-8882cb701c5d", "comment": "Malware payload", "value": "45b65480013c10804d62542047321f6692736b9d45725d74f674b55a02d6373d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790267, "uuid": "7c4c3b02-264b-4e8d-b825-bb0393b51607", "comment": "Malware payload", "value": "049b05965c3acec76970d6773d9ce4126f41f40f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790267, "uuid": "7ac568a8-2c8f-4621-9a89-d3069949a7eb", "comment": "Malware payload", "value": "6c44095e7e775dde59b3925e338537bcd3200ea67c8740b40203b91539aa29f88bba23c876364200142080333fe5137b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790267, "uuid": "c139b9fa-9942-4e14-8918-422a461da06d", "value": "T1D4F2B5616505B5BCF8A800BCF54B21B625934C687D6CF3D7A087763AFBB474C2CA6E09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790267, "uuid": "c27ebf10-cf22-411e-84a3-eb54fae7d4ea", "value": "384:R7rBnn56cW6XhfkNJUnLc2OVIrYQ0FmbW++T6zB1S3h96bBChphsszt1jk49PX1X:R5n5WqqToYr0g3hUdFfW1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775790267, "uuid": "365d3533-bf0f-453a-95ae-1b1b6d7cea97", "value": 34316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775790267, "uuid": "51f5eb35-08c0-4e74-852f-3f70c065b0e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790267, "uuid": "b0c16bc1-94e1-4e53-ad0a-7e2e58eae362", "value": "Clipz.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf88337-34f8-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1775837944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837944, "uuid": "ff89c8b5-4c4c-4e57-94aa-60bbdb0c19bd", "comment": "Malware payload (Smoke Loader)", "value": "14e0411b1a7089f77a86abdcf7daa0ef", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837944, "uuid": "cb923f93-04a8-436b-a91a-590db5c6c60e", "comment": "Malware payload (Smoke Loader)", "value": "46ed43856f5d50071b23a227b43c20492dfb7b85ff9cde1eb0600b2c8686c1ee", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837944, "uuid": "1397b73a-26d9-4214-8fbe-4f95963359d5", "comment": "Malware payload (Smoke Loader)", "value": "6f75d151765ccf689ccbcf9db44b8c04441c5dca", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837944, "uuid": "f305f17a-3c17-40ce-b3dc-9665acc33191", "comment": "Malware payload (Smoke Loader)", "value": "bc2179d640f5fb13daff39b6c3d01ce3333e8b418802c20f1f3afca9698c1091052f97ebf4a38889c365ae20979cbbed", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775837944, "uuid": "2d9bff7b-5017-4495-9c12-f41f2d730d41", "value": "T1B9A55B0B6CD548FAC49AA3368CB61591BB74B8090B3237E32E917A783F76BE05D74744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775837944, "uuid": "367b20df-49f7-4ea8-b4fd-54fa3ee7a441", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775837944, "uuid": "aaa48332-c74c-4dca-bb3b-a76bf0eaef97", "value": "24576:5BIsHtsD6j52S0UshcbJNoByV7EUwEhfrzFhheleh29mhPx8SF:5qiU6YS0UC+7PrhzEsp/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775837944, "uuid": "2a91ba5d-11b1-4f44-9f9e-659134876683", "value": 2119896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775837944, "uuid": "dd86281f-813b-4e16-a46e-d1693e610a56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775837944, "uuid": "a41a773a-104d-4bd8-b2cb-30c4ec3e1091", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6101157-3481-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775786713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775786713, "uuid": "d01f4224-cab8-4a70-9a4f-e25928f8f0b8", "comment": "Malware payload", "value": "699ceef67f0583fed1f45c4e8cfa553d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775786713, "uuid": "b59ef45a-f427-4308-93e7-9d4052ad2c5f", "comment": "Malware payload", "value": "474ed00146a66c81612448ed264e53e790cf2f12e5f6d90be7ad02791e8b6f77", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775786713, "uuid": "3bbf75e4-b1db-4cf8-b66d-669c0f22d045", "comment": "Malware payload", "value": "95342364e686f963cc83e5fa3e88317bac31ecec", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775786713, "uuid": "46ac1868-985d-406f-8eb6-69568ca41865", "comment": "Malware payload", "value": "47334bb66b4ca8ac196ed868a2b579e3af5ee43b81e86d121255d40dd0241ea2f05113d5f8a483dad43e4535e718c52b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775786713, "uuid": "c407dcf6-8bf8-4611-9215-69962f79bdc6", "value": "T1B2968C07EC9115E9C0A9E2348A769252BA717C486F3537D32B90F7382F77BD0AA79740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775786713, "uuid": "f5d9a08f-fe4e-43eb-8028-27cd45a9ace5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775786713, "uuid": "0bf2c8a6-b87b-4f8a-9f40-510ddde02a0c", "value": "98304:HjVKqmb6U01yG/cwAtGTSwnI6jo5ujNXjvEkYwY3Z9sd9En:HMqw6U9G/c9GWwI6joAjNzsxvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775786713, "uuid": "62018525-6e42-48df-ab7b-e86a60883352", "value": 8708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775786713, "uuid": "88895694-a71d-4e30-af5a-ed851d089fad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775786713, "uuid": "dee6d392-c9aa-40ad-8d04-ecaa64c4aaa5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9816018b-3518-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775851517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775851517, "uuid": "6307ed40-d56c-4870-88b8-93d2722c113d", "comment": "Malware payload", "value": "d5cc9cd0b293c113c426d3c64d151338", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775851517, "uuid": "a5f64f7e-2f01-4eee-a1b1-158ea9282856", "comment": "Malware payload", "value": "48f19eef9d420137dee9974e3cc6af3ded9532bd631ace36f7d15eebec6a2dce", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775851517, "uuid": "8d8aa078-9402-4a3c-a5b1-ff31a5cae217", "comment": "Malware payload", "value": "48ba4ffd996443f82e04389772fd53e19fa4bf88", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775851517, "uuid": "5b22bfec-a5f9-48df-b717-f56ba7b9518c", "comment": "Malware payload", "value": "0a4bf89b9ae9936f5afc87ccf931bcbbd7949141a9115b6e6e2439781e89283ce10997042f0ea60455c97d34912d07cf", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775851517, "uuid": "5a5e52fb-a97d-4ff9-b70c-8cd34c8c6b00", "value": "T13B46E0CAFBC8A96AC4F75376C97542E254474C268783DED35D18763C28BB6D00F4AAC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775851517, "uuid": "3fd573fe-2d09-4c10-9c1c-dff77b321515", "value": "98304:ZkJoTYrEHypskBb9pFjrKr1gmaU4gklMIGS1Zcw/4IRhoc:ZTmHbXFfqThYMIWwZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775851517, "uuid": "ac608fb3-5ed4-4ca9-b0ec-a9cebcd4eeff", "value": 5380372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775851517, "uuid": "298b5b8f-15df-4603-9eea-54e423308ec1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775851517, "uuid": "95973540-98fc-4f10-a2d6-5f5954006cc8", "value": "\u667a\u5929.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1cd7e75-34f5-11f1-a769-42010a9c0008", "comment": "Malware payload (PhemedroneStealer)", "timestamp": 1775836608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836608, "uuid": "72fd1e64-2619-45d3-a601-dc08f061d270", "comment": "Malware payload (PhemedroneStealer)", "value": "deb20b105642fd2bb2e25656a741d565", "object_relation": "md5", "Tag": [ { "name": "777", "colour": "#8FE944", "exportable": true, "hide_tag": false }, { "name": "Luna", "colour": "#B2669C", "exportable": true, "hide_tag": false }, { "name": "PhemedroneStealer", "colour": "#645F55", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836608, "uuid": "908f2ef6-c705-42d4-84ed-8d8eaa36fe70", "comment": "Malware payload (PhemedroneStealer)", "value": "491899d8b372590a25dff1c932f4b99040061c9a58166574b9f0582ecfb70117", "object_relation": "sha256", "Tag": [ { "name": "777", "colour": "#8FE944", "exportable": true, "hide_tag": false }, { "name": "Luna", "colour": "#B2669C", "exportable": true, "hide_tag": false }, { "name": "PhemedroneStealer", "colour": "#645F55", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836608, "uuid": "d4cd5ced-0532-4b51-a090-fb17799540aa", "comment": "Malware payload (PhemedroneStealer)", "value": "bec4ee990bc8e338c1c652073ddbf2373368c3d2", "object_relation": "sha1", "Tag": [ { "name": "777", "colour": "#8FE944", "exportable": true, "hide_tag": false }, { "name": "Luna", "colour": "#B2669C", "exportable": true, "hide_tag": false }, { "name": "PhemedroneStealer", "colour": "#645F55", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836608, "uuid": "bd998483-9f80-4f70-9c1f-b43ca06d4169", "comment": "Malware payload (PhemedroneStealer)", "value": "bc40aef2ac36960a971ca1df74883b6a59880e99d3a9245273f8bf05cf1c96b9b3360d2a1de0ca89d69991ae7d643fb7", "object_relation": "sha3-384", "Tag": [ { "name": "777", "colour": "#8FE944", "exportable": true, "hide_tag": false }, { "name": "Luna", "colour": "#B2669C", "exportable": true, "hide_tag": false }, { "name": "PhemedroneStealer", "colour": "#645F55", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775836608, "uuid": "5b1d103c-3f70-4b46-ace9-9c19861a97f2", "value": "T1CDD3237002D12B8BFA6F071B165C9B629176746361ECD9A6A70CE38DBC99EB43F93050", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775836608, "uuid": "a0708a86-7266-4012-89dd-0122f50f8295", "value": "3072:o19RjchxKZ2xLnBmTocUg87n0GBCs6f0xAKsmt4A6apjVCxGQks:mTjcDLnPcUg8z0KCsDeaphy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775836608, "uuid": "325e78c7-4832-4ced-bff5-aadb8138f509", "value": 141553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775836608, "uuid": "f7667936-001b-4bc7-827e-670e38993047", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775836608, "uuid": "6ec00de4-f071-4ee7-85c7-c1fbb1b92283", "value": "luna pass 777.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff5c6d7-34cb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775818298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775818298, "uuid": "4f47e333-78ce-4dcc-8e59-7ed2936ac945", "comment": "Malware payload", "value": "647e168c0f7d96abe90dc1f1123542b1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775818298, "uuid": "2b747706-bace-4cf5-bab2-66ae42b0cb30", "comment": "Malware payload", "value": "4ab3b6c8940e1900a62328ea898dab69718e074d260604a8edc3fb6e88500f4e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775818298, "uuid": "3312c99a-e23b-4569-87c2-25cd3db21db2", "comment": "Malware payload", "value": "5a7980813b82d1ce12e6fe2542ff6fe601a1c645", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775818298, "uuid": "d66a2106-184e-4781-9be9-3178b8193ed3", "comment": "Malware payload", "value": "33e10072e522034fb0efdab8a37e269a61be60c57fe893d2a2fdaadcd6aa191fd7c2fc001d79c451d726b90e3ca98afd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775818298, "uuid": "12ab9736-ad93-4ad1-86fa-702d07a7c2f3", "value": "T1A9137D6966857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49B9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775818298, "uuid": "77755ebe-a5fc-449c-905a-44a6d54458fd", "value": "768:bz+N99GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bz+Ecy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775818298, "uuid": "8ea8af7a-e1c7-4542-8502-443daaf1ae65", "value": 45507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775818298, "uuid": "247a4711-0f13-4beb-9aa8-10304d3b6f2b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775818298, "uuid": "6aa0424b-1807-4ab7-8750-8386de97bdd5", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee3e7ed-348a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775790298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790298, "uuid": "3ae49a83-d771-4ead-a8aa-56a4c7ee1284", "comment": "Malware payload (Mirai)", "value": "601fa8d766c16b760bef0fc92d3f6fd5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790298, "uuid": "199e81e7-a0c8-4795-a098-ea33aad44798", "comment": "Malware payload (Mirai)", "value": "4ad07b48ed7d396e0cb35fbcbbfe05dcef34781b86435c0c30736ced67ebe341", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790298, "uuid": "8a89df94-5010-4164-b392-bb19dcf3afd8", "comment": "Malware payload (Mirai)", "value": "de60d579a141b7b0022e434663d1570ceb9a8534", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790298, "uuid": "49f6feb3-2fc4-461c-b3a0-27f2ee38099a", "comment": "Malware payload (Mirai)", "value": "0fcfa5082fb5d14a328bf719a0d1b6165f721fea34c622174dd926be230aadcbddd2f67957859131938f45590ee57fc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790298, "uuid": "14faf007-3355-4303-b6e6-948f7607d3e0", "value": "T1E9B2E0E3E6D0400BE24253BF977D8FAA4981643027FDD510F20132D366B71229BF8AA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790298, "uuid": "ef6482bc-eb7f-4258-9ce3-6e880d253b3f", "value": "768:kybNT9fJ9LWqOQ4Otlop5Fhp+cQHL/1UD:vN53EqlghENrNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775790298, "uuid": "5bdbd921-28fa-41e0-b97b-dce882203b6f", "value": 24816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775790298, "uuid": "52e92d2a-ec30-4ffb-b05f-90b18ea20e53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790298, "uuid": "1baff8f0-26be-4fa6-af42-21cd3e15cd69", "value": "Clipz.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1f554bd-34f8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775837924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837924, "uuid": "89c39e89-803e-422b-94ed-a83d4822cb42", "comment": "Malware payload", "value": "65f1164fe8ef9ce07869b7762cdbb0b2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837924, "uuid": "758ce0da-fb73-424d-9678-a55c130a3772", "comment": "Malware payload", "value": "4bdf7226644876c09e6091127260593a4f7af3b78d148b56004eb1be09bdf4b8", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837924, "uuid": "fb1778bb-5ef2-4322-8412-14cb677076de", "comment": "Malware payload", "value": "60ce3b8b031e4d1877b37d9fe7aec35c7ddbd9ca", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837924, "uuid": "1197e02e-6515-47dd-8eb3-b57b3dc289f0", "comment": "Malware payload", "value": "7084130c8584945ece2ed6604939d2f4844a5e8e1af3459b9395c3421ff9047d94578aba97f7f058020d8ded37445a46", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775837924, "uuid": "72cbdc22-07f9-494e-b6ac-cbbf7473af55", "value": "T1B7D5F145FB999E1EC8F353320D396635547AE923C713C383D9792678688BAF00F462E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775837924, "uuid": "4011cdeb-86e0-437e-a587-283d66b5ce9e", "value": "49152:akrm/jqGFBwKve9RiBf489PWHG2xqy9gupBV8nYjmzXmtl8aFPdHMZjKCHGBKWUC:akrm75TgAA8J6GMVgupzaY2278alx3CE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775837924, "uuid": "d79a4b02-6b40-40e3-a3ea-2f05c1ada9a4", "value": 2995725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775837924, "uuid": "1e788d4e-7863-42fb-9dc4-d3b4a8b63b5b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775837924, "uuid": "3ceca2fe-23ab-48f3-bdbc-94103d6c7a03", "value": "sagawa.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c2c2ed-34d3-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1775821631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775821631, "uuid": "ed2a94da-d09b-41a1-a982-9f07b5737c79", "comment": "Malware payload (ACRStealer)", "value": "326fc10d406df041a19d8cd59ccc5330", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775821631, "uuid": "ba967f24-1052-4482-9159-9f83616032c3", "comment": "Malware payload (ACRStealer)", "value": "4d093afdab92a7f2d84e4e900442e3a70658ae14dba49198ac4e80cd96ff50e7", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775821631, "uuid": "7f6f1860-75cf-4b97-a557-bbcb341bd866", "comment": "Malware payload (ACRStealer)", "value": "2adefdbbfcd1adfd50beec3d0e08ad19ec1c17db", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775821631, "uuid": "56d211f7-83b7-4023-8d6c-3dd87849b4db", "comment": "Malware payload (ACRStealer)", "value": "5ff863af20ca49cedc6f1b2ebe0c6e6ded92da49c62837e2f880820e4e34a2f0d98372235fcf1c90b5603a8248164433", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775821631, "uuid": "2dbeb6b6-a9a1-41a0-8622-8aba600ae569", "value": "T119F56D0BFDB98CA9C099A1348433A156BF6478411B3273E72AD5B3682E737F06C75B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775821631, "uuid": "b5f0f9e2-bb2b-4956-8e87-aba1480f6955", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775821631, "uuid": "b3347f3c-108d-4fc9-a966-9f9d67fccfdd", "value": "49152:398dtmxAoz4RMFL8GHI8ZILVnWb5jzkQc7M:39JxJ+lqFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775821631, "uuid": "387dd54d-13bd-40d5-9c89-c49122efe99d", "value": 3577864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775821631, "uuid": "555f3fca-3d7d-41af-92da-78252a320feb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775821631, "uuid": "9f190457-4c5b-4838-bda2-3176564460ef", "value": "SecuriteInfo.com.Win64.MalwareX-gen.95419384", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe527d7-3489-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775790273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790273, "uuid": "8dda3c92-aa63-4ebd-afad-157ad860416a", "comment": "Malware payload", "value": "a2211955d1640a3699cab71e4f45c3a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790273, "uuid": "3792b6c3-446d-4cb0-b7bb-50bf186f3f1c", "comment": "Malware payload", "value": "4e1e256c7192f461b741282d54776cc1b804a65cba3e3fac0bafce2e46b015a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790273, "uuid": "5866164b-9669-48f4-999c-843183d609c7", "comment": "Malware payload", "value": "558952703373dbdd45f5fceceeb66f8952eca563", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790273, "uuid": "d8ff91e1-8b50-4bf7-a728-9ba79cf86b2c", "comment": "Malware payload", "value": "59cebc034ebfa6818172952e5cbffe6356b7d99a82a2311816ba98402c547c26b3b19e031110fe65fd304c9c4aaa1ea8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790273, "uuid": "231d9232-e068-4e1f-8cbf-103015ea1072", "value": "T1EFE2F1D962DB4E19E7794BB3884F86E1CC97146147E4372E0CE982211324D99E3F9E0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790273, "uuid": "3ed53a7d-1cf2-4cc4-bd6e-806846bfacd2", "value": "768:rWaXzCcV8r+ruLPCjhy5AGGg+KCsTDQC0IXxDWTJyn1DAbDZYusem:tXN8q2P7OKfTDZLXNWs1WqTem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775790273, "uuid": "f1f867f3-7d26-4de8-90f4-d32b2379d6db", "value": 32272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775790273, "uuid": "5e292946-add9-4501-b74c-55ce8c0289f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790273, "uuid": "fb6d16a4-6bd8-4cbc-a5e9-650322cd6e80", "value": "Clipz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5218f35-34a7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775803059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775803059, "uuid": "1d9e3b23-6542-48b3-a85f-df3b06930afa", "comment": "Malware payload", "value": "089536a1f4bb58c0ede60e738ebfa970", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775803059, "uuid": "2561bafe-bdb2-4317-9e14-391b71be9f24", "comment": "Malware payload", "value": "4eabbb925907b805a51e6f4b5cfa547a3505114c6564358dcbe69c433483ff87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775803059, "uuid": "ee0fe443-3816-40ca-98f2-089a00a7517c", "comment": "Malware payload", "value": "d3a45b0379e9a54bf10f3039e15f86e0df075b73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775803059, "uuid": "30d686d9-581d-4b49-bef7-81c708028618", "comment": "Malware payload", "value": "7d0337e6a3cbb5e93dbb1f385415b7f01fa3b14add43e59c9f92ba326317d4590bcb9718b54323a46ac533b29da6ae63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775803059, "uuid": "dcd4c76b-905f-45ca-be7b-1670f2a48854", "value": "T151E57C87B2B65324D9B7C13886A7952BD6727C46CF2065DF125CB3186AB36F01E3B318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775803059, "uuid": "12dab363-a848-4400-9cd7-8a38595104e4", "value": "0c2cdde01d811ba2be59897dd7167604", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775803059, "uuid": "5cd0bc10-aea8-4137-aac3-f960750908d3", "value": "49152:zZcUUrF5aqMhKrZckSTWd6Rc0OdW6CUJ2Jsv6tWKFdu9CEPTvG7tepHFhh6DhqaT:z6XuAcyxmJsv6tWKFdu9CEiO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775803059, "uuid": "52fe05d6-17ce-47f5-96b0-1cfe313d43ac", "value": 3314688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775803059, "uuid": "71bf347f-91ec-41a7-a2d5-655b41eaafa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775803059, "uuid": "617dda4b-4f74-4b2c-8c2c-c7bcdf1c8dd0", "value": "2026\u5e74\u7b2c\u4e00\u5b63\u5ea6\u5185\u804c\u4eba\u5458\u8fdd\u7eaa\u540d\u5355\u4fe1\u606f(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc505c10-34fb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775839176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775839176, "uuid": "22f63834-5181-4228-ad59-60e3f9200f00", "comment": "Malware payload (Mirai)", "value": "73cc1189c449966e2039cf9267ce5c13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775839176, "uuid": "6fea62a8-97ab-40d8-bcbb-210c5fc8d3f1", "comment": "Malware payload (Mirai)", "value": "505869c9e70d3e644a5725bb2845c9bbf6c86c6a1965f053bfc545fa6777fba2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775839176, "uuid": "80d2b02a-3d48-4ed0-9134-aab990c04d54", "comment": "Malware payload (Mirai)", "value": "2eda72c7bc2b26c2c2ee47e4cd424eaa7aa5b90f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775839176, "uuid": "37613e45-b0b4-4516-96a6-a57bbbb2aa49", "comment": "Malware payload (Mirai)", "value": "85690bb71d74c438c50b10a72f4348258605b34159eb9b95ab645845ae20b5db4fcab587f4de37757c60d43427993c42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775839176, "uuid": "11246823-7054-40c4-9873-608dc664376a", "value": "T1ED148D68FE4E78D2D2C7E37DAE4A0FA2302779749565C0B51A00A29FD5EAFD488D0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775839176, "uuid": "f01c5aa3-1c42-49ff-84c0-4bb9d9dc03c8", "value": "3072:badBpAIWIfbEdOcdY3rZiigZ2eNRzPxv:bOVfbEdxm4iubJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775839176, "uuid": "35b7bc8e-43e5-4740-bc59-c81a596012c0", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775839176, "uuid": "f4b96b71-fc25-46ef-aa87-1f74c2ec7424", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775839176, "uuid": "fc19f64a-ab5d-40b5-8de3-93de71d934b3", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee8e190-349d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775798781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775798781, "uuid": "90c5f601-1fa8-48e7-8c2b-3273c583f55f", "comment": "Malware payload", "value": "1db3c8e15d59fd94fd4094a7c440d89e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775798781, "uuid": "d826dde5-4859-4302-8ecf-86c2bb2efd6a", "comment": "Malware payload", "value": "50b50b5a67e6dc6c7aa8e285ff79cdc3430867a7e36f316bccab279e155ab893", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775798781, "uuid": "7c19b2a7-9663-4cb2-8060-117db6ca1657", "comment": "Malware payload", "value": "55c95326896dd08e153c54ed1c5fc16cca41e5e2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775798781, "uuid": "d886d751-0c14-49ae-ba43-7de89562f553", "comment": "Malware payload", "value": "6b6e4b8d5bf67991b5ed9ae9af911d44e8c9dd6bc2ef3ec68c3707df2fb5c95ce64feec04776a18a6dfdc6714567042f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775798781, "uuid": "35d63be1-1ef2-4e6b-9480-c364ca0af9f8", "value": "T1B9137D6526953C25AE99883B5C7F2F0CB9A983E2304491DDBFCB3CF18C45A9CE318719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775798781, "uuid": "3dc7245c-773d-4d11-819a-af49adecb9ad", "value": "768:bes9NyXsZztC59GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bzHusZXcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775798781, "uuid": "8d9fea49-6447-46db-8c10-f8e28c4c85ad", "value": 45527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775798781, "uuid": "99d7c656-3820-4a4f-bd46-9445764eac02", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775798781, "uuid": "dc942a6f-3548-4a0e-ac79-3b0bbb4d82b9", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc888b3e-34f8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775837941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837941, "uuid": "6e4f9ec8-ba01-4540-81fd-f7a2aab58b21", "comment": "Malware payload", "value": "f6d64065b447b1443941867183763bea", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837941, "uuid": "4975cb98-9d99-4519-8278-4a47d0bb5cf6", "comment": "Malware payload", "value": "57151572cf361d49ead0235eef7cad3827f4711120f3397e746a660aa9c6250b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837941, "uuid": "e641196e-558b-4ae0-a6a6-aa98cab44ff2", "comment": "Malware payload", "value": "a57c3e22541ec3df89e2c816fed46e0f164054da", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837941, "uuid": "48ec99b8-1f0b-47f9-a3b8-a8db25670d31", "comment": "Malware payload", "value": "55ff3e73cdf74ff0cab955c497386b0c970b11c5d6ea6858bd4639c642f9e3528f8682a8195c358e96091a276afb93d1", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775837941, "uuid": "42495563-b403-4602-b8d9-cb2c1dd845c3", "value": "T17DD5F158FB989F5EC8F353320D392635647AE827C703C383D9692679248BAF40F552E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775837941, "uuid": "adc2211e-3de2-4a85-9fc4-6d4c5b748c74", "value": "49152:DWYc6nGXzxvMY31nYNf8QkJYSa/8kqucF9Cvkrm/jqGFBwKve9RiBf4Z:SYc6nGXFTxq8HZa/nKAkrm75TgAAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775837941, "uuid": "0cc0556b-0d52-4fb5-9d6e-29a80f15c6bb", "value": 2995725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775837941, "uuid": "bde95fb4-9145-44fd-8806-018056b6fd03", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775837941, "uuid": "b8be3798-c018-4584-97bf-8ee7530574b2", "value": "sagawa(2).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1261e2d-34d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775822326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822326, "uuid": "e37f19cd-2235-41c5-96c9-1f510c4a5931", "comment": "Malware payload (Mirai)", "value": "e7364120e249b51201cd92f91abe52f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822326, "uuid": "ad5296f7-78f2-4270-9545-20d2001aef0b", "comment": "Malware payload (Mirai)", "value": "5733747394fbebde0a7b703e8567d19356516f184fba99dae5de9a655aa52be4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822326, "uuid": "5efd92de-8abd-448b-b47b-ddf08fbc7cab", "comment": "Malware payload (Mirai)", "value": "8a0c85718acac15eea301fa40ed3a213e4c08803", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822326, "uuid": "005ff6b2-fa28-42e7-bdc8-43e2bf4601fb", "comment": "Malware payload (Mirai)", "value": "217c0285f4e56e2a3846f4f4e10e53c9150f9839e1db3bf76508e9fd2df92802fca327738eba7c8064fa51b31f4a29c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822326, "uuid": "3e8dcd58-9841-4faa-90f6-248d21a8e8d0", "value": "T126E2F1309D082C20E670E9376F388BC362EB67F0E5B572D6292807A426E6D0D4EB55C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822326, "uuid": "10bbfd19-ac2f-43e3-9462-14033671a64b", "value": "768:heBsVPxhgoeW472XFJGScKAfcUnMO1zpITDjD6XBvs3Uoz1:heGVPxGoLVfncKAfcCMqRiz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775822326, "uuid": "fdded5e5-f0e3-4d12-bd97-1ac75536f357", "value": 33864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775822326, "uuid": "8bb416ff-900e-49de-b477-dbd408a7a4a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822326, "uuid": "51d8d65b-9c6f-439b-a361-05131038f939", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13dea6ae-3512-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775848718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775848718, "uuid": "086d2bce-65dd-4429-a71f-f1b1f922b3bc", "comment": "Malware payload", "value": "7adbe7bf3558afc7cffea719dbc08600", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775848718, "uuid": "156f0276-953e-48c2-858d-9ad621167006", "comment": "Malware payload", "value": "580cde4ffebc78e3b2d2e73cbcb820c7d6d815b283d3269510521d552169a960", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775848718, "uuid": "86bc9e5d-1334-4069-85c4-149c618b34ea", "comment": "Malware payload", "value": "d81f996dc0ad3bc86e3090bf431fb54074fd10d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775848718, "uuid": "56d995bf-7e50-4b02-8f96-8e7de9acd6b1", "comment": "Malware payload", "value": "b86e5519fe4b00aa57fd6ff5557021bb010a30c2935352155f133fdea43de21665195a619405994c06d9c2fe08518d1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775848718, "uuid": "13cd44a3-16b3-4a24-984f-edc88677da91", "value": "T126654C43E25781ECC16AC17486639772B970BC694138BE7E1B94D7321F62F609B2EB34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775848718, "uuid": "a89c86b4-ef39-426e-9abd-0a76f3d437d1", "value": "14cde7b463595466a4cd0f905f59eed2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775848718, "uuid": "5911b543-850b-4e05-917d-51bb1be840dd", "value": "24576:6OQwCGL/qI2cR2Xmb0LU5CbLAnGRjYMMuC73fV:6rwCoiI2XmuneGHW73t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775848718, "uuid": "5829bb4b-208c-4105-b856-5539797d367b", "value": 1412622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775848718, "uuid": "6506f53e-5160-4ef9-8eb7-a5df891c3f23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775848718, "uuid": "5d269921-e7e8-4938-95d5-2e3ae6c74e87", "value": "xxy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec59e3d-34d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775822322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822322, "uuid": "7b0a4f6b-6e28-4b4d-8a03-181f3bc9e13b", "comment": "Malware payload (Mirai)", "value": "2f5a17c5a8ed51606e8f585839487f25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822322, "uuid": "05ff2be2-5005-4c06-8dae-59d83eea5ed6", "comment": "Malware payload (Mirai)", "value": "596a4370528e80a5ba2dd6997ff38327cfb256b762f64a04319b400a00fbbc4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822322, "uuid": "cb2b59d9-7c12-403b-bc8d-b544e73e6b3e", "comment": "Malware payload (Mirai)", "value": "02909739e77d0ceae51d3815effc002306d4fd42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822322, "uuid": "0cbd6edd-209b-4fd5-8145-39289403f65e", "comment": "Malware payload (Mirai)", "value": "566a6c2fabf91f4102129d739c3b2da571713b65ee2e286983af1a70cff533593adeccd82b659925bfb51bb2d8c2834f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822322, "uuid": "a5a65236-c22a-4d0d-8857-9d560698166c", "value": "T120539C73C8296E54D19582B4B871CB781B63B48082471FFA5BD9C2BA9087DFCF6093B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822322, "uuid": "51329f89-90ad-4798-9a76-65d9c276f802", "value": "1536:JaDwtqKcomlIFZCXaZMYfPkYP2gpK2mP5A/iabC0c/v38Bs/n8a:JwacomlITCXaZMYXkYOgQ2mgiabgXMla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775822322, "uuid": "ad759dbb-aa97-4c57-afec-a1f20625f8c9", "value": 64464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775822322, "uuid": "04e1b526-dcdb-4f6a-ba47-8ac15ff413fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822322, "uuid": "4a6fa28b-904b-434b-9dbd-3a1b6f9cf50c", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "080a049f-348a-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775790287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790287, "uuid": "5ed39e82-7b48-4a5b-bd22-80b6ca440985", "comment": "Malware payload (Gafgyt)", "value": "5d3d26d73d261f0f85ada125b701624f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790287, "uuid": "2bc70499-1385-4b66-8ebf-68c582274be9", "comment": "Malware payload (Gafgyt)", "value": "5c8e27be2234d090b52675fbe9bd8cdc6efca33a3f5d429447caae9b1e99163b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790287, "uuid": "8d7b05c8-6544-4501-b98e-e449600b08c9", "comment": "Malware payload (Gafgyt)", "value": "7ac61fb29792d8e6dfdd1605c2c321e5d1f54413", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790287, "uuid": "5d669f31-f6ae-4f08-a5c8-237dc9ec284c", "comment": "Malware payload (Gafgyt)", "value": "e5d28c0babda24b4d9f1bf607a2cfc9981e1be9517fc54d3c2af70560cf6539696d08dfb1732266dd5a13514c4bdab87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790287, "uuid": "5a6d534f-6d60-4deb-951c-c0979c77c4af", "value": "T146E2538CD469132EC7E172FFEB8912CE733A1ED8A79B753AD13531A053F02686535A18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790287, "uuid": "2a34edbb-3760-4e8b-963b-d2d357a764e5", "value": "768:Tw4zHFWb7BS6bF5qDtNOQhE6TJ/TnR2VqxJbAcQvKYGeB:TJpWb/FweQh3TJ7syG39GeB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775790287, "uuid": "ea928387-3dd2-4d99-a0c2-6c2b6118ee4b", "value": 32543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775790287, "uuid": "d94bdd6f-9fc3-4140-97ed-e1f487ef0488", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790287, "uuid": "0a5e6794-64d9-47a9-8411-a3945498c85d", "value": "Clipz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3046884-3525-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775857145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775857145, "uuid": "8efb00e2-8026-4b53-9437-182375671409", "comment": "Malware payload", "value": "0056d154f91edfb03e98f9098fba0c17", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775857145, "uuid": "b33110dc-17b9-48a5-b2b7-7b8f0ee99220", "comment": "Malware payload", "value": "5d2c8963aabbf2c8ce288366b8153f22729daea7eeae26eece51fd53eebf4aef", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775857145, "uuid": "2b2c1ca8-2239-4b1f-b135-fd2bbff456da", "comment": "Malware payload", "value": "c54edbbdd6a7c88c13ccb1b8a759fbae6385ccc7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775857145, "uuid": "44cf948d-450e-4431-a9f1-6f61b947f596", "comment": "Malware payload", "value": "083f5bedb5148583a5e0f7ed5b0b9ea43ffb3296a3ce6957a8c88092ef80a5aa9b19c47bd0151943c7496376a39d8453", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775857145, "uuid": "2a778c4c-de90-4305-adda-532eb59377af", "value": "T19433B6A167F9151AF6F38E783CB465958C7BBE726D61E08D8280204F0875B95CE78733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775857145, "uuid": "35c4898e-ce0e-4296-a5c6-d90a583c8d1d", "value": "83fa772670ac674cd68ff73f3ef04802", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775857145, "uuid": "c730868b-0904-49b3-961e-6f446169dfa7", "value": "768:mezMQ/0vaXDiTLlGCI0App3LdSph6koMsqsq:J4EiTLXA37sp4kofv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775857145, "uuid": "dae7590a-7e5f-4650-903a-8cfd843a72b7", "value": 54784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775857145, "uuid": "9d176fcc-21b3-4c81-9dbe-9e0975bb1220", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775857145, "uuid": "10f292f5-307a-400d-a165-cbbf6a3ba838", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c303fca-3523-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775856114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775856114, "uuid": "5c9e3d0c-8dbf-4499-8945-9a138d8154d1", "comment": "Malware payload", "value": "29c920fc1ada2737d0876db164d8c912", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775856114, "uuid": "97dea0a1-5759-4fe3-bda1-eafbe5e3c140", "comment": "Malware payload", "value": "5dbab3b3797330a7fd44055475d482d7f6d622697658b1f81a4f8ea5ff4e8588", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775856114, "uuid": "77b2839f-ca4d-44a1-a1f1-088c365c8053", "comment": "Malware payload", "value": "d40b7a34c21dc3b35d619fcb4a619702d96ff455", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775856114, "uuid": "749e1b99-df90-44a7-8965-b0ba9402f85b", "comment": "Malware payload", "value": "cebb2b4169431b23e8ef285420d39ef2ce480309c3720c476fb0cd7cd7269ec01d5384b8836778f9334b9235f04a3749", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775856114, "uuid": "16cc8130-1821-4f6c-803d-cb01da9a4e52", "value": "T170D5F1E4D904A7E9D02DD275C958CFBA65B0CC46E6B4CA2AFC34BB5C21B9CB25B1C0D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775856114, "uuid": "d716b8dd-87a7-4e78-9c61-b165beeb965e", "value": "49152:gCvY/FP3arWfhC4+mRoeaCng/pTBlIDyw+EkMtrVS8gitxW0qmapeR/iy:1Y/d3arWfhrRfXghvTCkM5VLxcOiy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775856114, "uuid": "9713c53e-0f16-49a7-89e6-a681d7b0d980", "value": 2781184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775856114, "uuid": "3dd4fee8-ef9f-4cfe-a9a9-5dc8bf42a6ec", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775856114, "uuid": "88dfc6d8-2770-4314-ab63-44c6be911225", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af5eab6e-34d7-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775823639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775823639, "uuid": "d341036d-de66-423a-b3b2-3a0fa448a1e2", "comment": "Malware payload (NetSupport)", "value": "758352fde388e3f2fb3a5f2902992d69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775823639, "uuid": "2039dfce-64d1-4e90-9e0f-3436e9f256ce", "comment": "Malware payload (NetSupport)", "value": "602bb2ee982a34318742ff64d58dfb105f22a004988871de83be5877ffa313e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775823639, "uuid": "2883fe93-822b-46be-8973-cc481de753f1", "comment": "Malware payload (NetSupport)", "value": "908b81b940732d5c3be11bcdb56572caf0dd729e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775823639, "uuid": "d26b3df5-76cd-4706-9981-28c2122c507b", "comment": "Malware payload (NetSupport)", "value": "5a888549dec3957181554a10a8a574044d9af94de9d6dd85a63bb158828417c7c79936a74d78e9b491cc2f430dcc2020", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775823639, "uuid": "0f80ebea-30ad-4fa3-80c2-4bf38f18b950", "value": "T131367C17ED7849E8C786A6784823E2C2FE24B400273123D726D967552F237F89677F29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775823639, "uuid": "8838030f-9ee0-4212-9ebf-5db8a015215d", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775823639, "uuid": "30e4e5cf-3286-47b5-af7d-e7d8f2d2870a", "value": "49152:y3Fp6CM+gZSap87Rq820gbwCPxS6BR7jywnc3vmM87G2yw:yeSa7EEj4M6mMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775823639, "uuid": "14bd241a-14f6-4726-a6ce-35c55a28d519", "value": 4996604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775823639, "uuid": "79e92e66-edd7-4b90-9f38-e731573f0606", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775823639, "uuid": "a8b73bbd-c170-461d-a330-35fad005b958", "value": "SecuriteInfo.com.FileRepMalware.91197377", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea3c07d4-352b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775859815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859815, "uuid": "bb60dd3c-84be-4fd2-a607-5411d13b28bb", "comment": "Malware payload (Mirai)", "value": "00feda1ae1920ddbbf695216ff29efe0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859815, "uuid": "f799399b-8798-4077-9314-28cc20d94484", "comment": "Malware payload (Mirai)", "value": "61ff918715e0e70cba2cf04a33c4dad052d40f8c1b018b36555c8549cc5c6588", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859815, "uuid": "07638925-e9d2-4f20-9b52-c94ad51ccf9c", "comment": "Malware payload (Mirai)", "value": "7ba76708c523011dcf35ef37c2cfa6b42846a3ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859815, "uuid": "932c3f69-a5b5-46fb-a34b-6b6769788818", "comment": "Malware payload (Mirai)", "value": "5ae32591b158833f3eb4e7eda00db3812bae2c553dbb50be664084fa83906fedd385b8b8898927eca40ab24cd0a35823", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859815, "uuid": "d5742eb5-bc9c-4b3a-a7e4-e5cf9516b58b", "value": "T122F33B47B7208FB1C368967109B3CB67A6E6269216E19985E66DCD107F3035C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859815, "uuid": "068234de-e58d-4202-ae3e-92cac39de552", "value": "3072:93VJgTdgahP/2o/ZrTheIsnjCWRXFm4UpM1wLxpPNNOziHNfam:9FJMgWPZr8IaCWReS1WpPeu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775859815, "uuid": "8760f8e4-a939-4f88-9b2f-347fb5802adf", "value": 166976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775859815, "uuid": "2b2bc795-8423-49b9-b2af-f883301b9159", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859815, "uuid": "aa1d8f8b-1da9-4507-a6e5-230f511a03a9", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "043aeebd-34fb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775838813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775838813, "uuid": "d017ee38-163e-4d96-a587-90f967ee8ddb", "comment": "Malware payload (Mirai)", "value": "b0880852d724f234ea713a46b29e97fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775838813, "uuid": "08c3c79d-5746-4204-b059-704627c34c39", "comment": "Malware payload (Mirai)", "value": "6235cf907950c724116726ff08edca1891492c58491cff0e0ef62522302265e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775838813, "uuid": "4061099f-c520-4063-b09b-4d3dc3b15dd5", "comment": "Malware payload (Mirai)", "value": "11b2ea841ddb72c544f4693d6ca0540e9dcae635", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775838813, "uuid": "0c046ce8-eb7f-4857-96fd-22cc4e82cd3c", "comment": "Malware payload (Mirai)", "value": "c5f41b0493a89f0faf9bfcf77f5253168016336258b9ea8948ccf3eed67c671c38aa509093eb32b0877cbeb2fa13f1ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775838813, "uuid": "e75ae533-8ea6-4efb-b53e-4974c98ef1b9", "value": "T131D3CF32E0086DA0DD2117B43476597C0340DEB40AD59243EFBEE5AE28B7DA57DEEB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775838813, "uuid": "310d72cd-e789-4b39-80e9-e28ce470fe2a", "value": "3072:jNOFV2mOAc6NBmjOd1CVOHVv3WDxGGRhaUNhkv0Ze6:xOFgpOEoVv3MXL5NhGOe6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775838813, "uuid": "da2cdb32-6b35-45dd-aef7-5a5879e791a7", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775838813, "uuid": "c9181b88-d9cd-4b6a-b2aa-d3437cb764a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775838813, "uuid": "888588fc-de7a-4207-b26f-ed1bf7ad3b09", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3315e948-3510-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775847911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775847911, "uuid": "0e8dd9bd-16a0-4392-a522-2cad48a2cb0e", "comment": "Malware payload (RustyStealer)", "value": "b8be35766c6f3346b7ffe1c06dd8717e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775847911, "uuid": "caf39b32-b731-48ea-a793-0eae6a8f55f3", "comment": "Malware payload (RustyStealer)", "value": "62df37acd922519eaea83a8679c6ff0c051a14768a18e7047f8cf0df4f021ddc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775847911, "uuid": "a55d789a-5a6c-4ead-8ff5-b4ddfc28df8a", "comment": "Malware payload (RustyStealer)", "value": "c04d38b661cc009c4232fd67bb1b4ec7fd4c6ce9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775847911, "uuid": "253b89a8-4ee7-4891-9b23-1095eec5e2a2", "comment": "Malware payload (RustyStealer)", "value": "b5f199e34448cf96f8d48b1969ea6365d8d2cf3c70c2ff9cb44e549b29b805f335a3e305bbcd5739572eb27d3e7cddfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775847911, "uuid": "9be6eb80-b4d4-401d-8505-fd24af1c457a", "value": "T1D4B70126A66890E9D67EC07CC1934B36B93270D90B346BF39681966A1F71EF87D3C314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775847911, "uuid": "574808d5-4f6d-4f88-863a-224ef4e638b1", "value": "64a26a963f3d56100455e7f4f125d323", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775847911, "uuid": "4d040e15-4d78-485b-bf7a-e33289cdfd89", "value": "786432:B+ujzYfLvdVXf8aimso6zvXOwuj4zpg79il3MjZq7ueswwy:BTjUfLHXfaJr4Qasl3Mwueswwy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775847911, "uuid": "40867323-8357-4400-b156-4313999ff96f", "value": 52001000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775847911, "uuid": "a67bd50f-bd17-409b-983e-1d12e5e9f360", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775847911, "uuid": "f1322d5d-9d27-40aa-b0b0-7aecad04dcbe", "value": "7zS.sfx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca208fd7-351e-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1775854178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775854178, "uuid": "addad001-1e5b-42f8-b0a7-95eb3610fed2", "comment": "Malware payload (AsyncRAT)", "value": "9ffcea176ee91a0da4bf2dde1ff41153", "object_relation": "md5", "Tag": [ { "name": "38-180-82-109", "colour": "#8926AD", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775854178, "uuid": "7430e56b-b39e-4f2b-bd1d-0f550544e78b", "comment": "Malware payload (AsyncRAT)", "value": "637efa8a39524160858818ff63e2e0e502d5808aee97063ba4e98ee15267d0f7", "object_relation": "sha256", "Tag": [ { "name": "38-180-82-109", "colour": "#8926AD", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775854178, "uuid": "61b9a1bd-4425-46a0-81d3-b6de435e4dbc", "comment": "Malware payload (AsyncRAT)", "value": "fa287dc793075d4b4596f9cb5ce5726442e4b9cf", "object_relation": "sha1", "Tag": [ { "name": "38-180-82-109", "colour": "#8926AD", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775854178, "uuid": "6352531a-204b-416b-a958-198bef95d97f", "comment": "Malware payload (AsyncRAT)", "value": "5dd70e4b56a0051d793a69bec1aee4d478be9ed3db1409b0214e602789360ee4a40598a0907bccf23a948551e656c674", "object_relation": "sha3-384", "Tag": [ { "name": "38-180-82-109", "colour": "#8926AD", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775854178, "uuid": "1078755c-5997-4888-abf6-ae8257ae6442", "value": "T13853EE1D5BEE4108B1B35F489BEB11A14A6BBB6D103C81D95488E74E4FE3A04CC967FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775854178, "uuid": "20d67108-af2e-487a-aec1-fa8600e6d23c", "value": "1536:3izPWNhxGI58oYLuUe5V3/snvpI+qlmgzLnWywzjctswdwdwlwg7Bx17Uspg:avp1qlmgzDJwzjaswdwdwlwO1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775854178, "uuid": "f9b57aa6-af31-4c69-884a-00cfc33cd5c4", "value": 62206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775854178, "uuid": "059b4a1b-e374-4045-81fa-3f747c7cf073", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775854178, "uuid": "1626260e-918a-423c-a528-c1d4792388ca", "value": "COMPROVANTE_NUBANK_10_04_2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77de06cd-34ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775832565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775832565, "uuid": "0cd686d6-918c-4c9b-a2e8-4c59d798759c", "comment": "Malware payload", "value": "441ef6d248e23964b6cf68a73c5d6e0e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775832565, "uuid": "5d2d77df-0382-4cd3-8757-209d0e3eb9d6", "comment": "Malware payload", "value": "64269fe84b019e496fe6e9193c4920214f6ea78332cd12dd25e308955dbffccf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775832565, "uuid": "d3841304-7732-4cb3-af02-fa7e9eeed34e", "comment": "Malware payload", "value": "37609d72722b828a8e5f8e3bc5b93d91f1442cc8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775832565, "uuid": "64fe0d02-1675-43e6-a9ae-53396c76fd2b", "comment": "Malware payload", "value": "18736f01d24cbc5dcc5463b673608ef1797911579a18efc583b48bacde00bf1475feda2efcd178b439ca1cb6c83371a8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775832565, "uuid": "02e85db0-0ecc-40e9-8224-ba3f1780271a", "value": "T1C9136C6566953C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775832565, "uuid": "65f4e0d7-ce8b-4d1d-9269-41261f906678", "value": "768:bzXRWNGxVR9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bNlxocy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775832565, "uuid": "39b670a5-b1a4-41d6-8079-73b1c4272c4a", "value": 45523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775832565, "uuid": "513902c6-94c1-4810-a7d8-d6a150eddcaf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775832565, "uuid": "dbd78208-7590-4d54-8af9-e01deae02e96", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb0a74c2-3529-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775858957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775858957, "uuid": "c24c1039-2ab7-4943-98b0-9e0c81a3c3b9", "comment": "Malware payload", "value": "766bfd56e527aa61874b384c50b3d029", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775858957, "uuid": "f13b85be-18c6-4a8e-9dd1-0d4db66802d5", "comment": "Malware payload", "value": "669dd842cf0713c0df293276b78c2a82bcebd6a3ceb9f1656c4e1204f6e85cc7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775858957, "uuid": "9e6dcedf-f556-4454-92fb-1dc20724bae5", "comment": "Malware payload", "value": "fb28e2f7bfa6ff5ae4f2b8347dd1795218624d24", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775858957, "uuid": "51a25f57-4c95-46ae-b61e-bf681d048dac", "comment": "Malware payload", "value": "59e37ae6ce0cdeb6901c846ef993eaccf3c84046ff6bd991105c28536fac3cd68f0ba1c6dafada8f8ff0df446432e999", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775858957, "uuid": "17bab7de-61a8-4cec-8da1-b6c484e6fcbf", "value": "T14D46E102E2974ADEC46BC0F8C5116E67F4BE78200A28AB367BD84B646B53B3057FD745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775858957, "uuid": "fc5e0115-e61f-4936-ac3a-16e9eacb5c5e", "value": "c05cf134dc19034ad65ea00a44098560", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775858957, "uuid": "2d74577a-8ec1-43c8-824a-9ae2e9f1a3cf", "value": "49152:JLl7vZMSM0VmI2z24jI00zIv53v+TK+Opx+tXOFWn46TCImm6CyKb+8kg/BNpOZ2:PGTyOFl6F6u+8kcNj2tiFSNAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775858957, "uuid": "889a5ae7-bc69-4223-85ee-e71ad8f02401", "value": 5530128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775858957, "uuid": "e68a9014-dc78-42fe-ac26-62bd88cedf74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775858957, "uuid": "5ca2ce9f-a863-463d-98a5-d472eddeae4d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe314761-3489-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775790270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790270, "uuid": "937354bf-b0d1-47e7-904f-29ea92750637", "comment": "Malware payload (Gafgyt)", "value": "e4c3eecf1e6ea0ffde3c164ce0bcddf6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790270, "uuid": "cc180ea1-7b7b-4a3b-a6a7-128e64b6befe", "comment": "Malware payload (Gafgyt)", "value": "68d597b438c92642937c89271fa135e09071029a9eddd636b3165e90639b40c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790270, "uuid": "160294ac-f19c-4ea7-aa32-972b6a83c95a", "comment": "Malware payload (Gafgyt)", "value": "b3a9abaf2edf1c7075adc86e90967b957bf52b75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790270, "uuid": "21a9ef2e-e10b-471c-b625-bf6ff5ad1f32", "comment": "Malware payload (Gafgyt)", "value": "9a94dbdf5bde4fa13d691947577b25d74c93ce036ff5e6f5ba9878c18c5f6abcb9ad129117cd732c417979ae1234a2b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790270, "uuid": "5d69cc96-6919-42e8-8e7c-1498ce0544fa", "value": "T1E762C09900AAFF00DC7C35F3046A3A65B6653F7C60A8899B3560274537CD5929BEFB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790270, "uuid": "304f571a-dcd2-482a-888e-d74f564d29ba", "value": "384:eEze2dB2AeV5zmQ0drhSyrkh6vnaxAhD2p+Eoug/R:TdB2AuAdI8naxAl2Vg/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775790270, "uuid": "03717097-a15a-43c7-9ef2-0a99f915944d", "value": 14636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775790270, "uuid": "8466ca7d-8661-483a-a724-2ff7ce374339", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790270, "uuid": "d2d999a0-7abb-4597-9a7c-626109966f34", "value": "Clipz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ed9593-34d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775822311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822311, "uuid": "3c0d2094-608c-48c2-ab9f-fa70efa43f0a", "comment": "Malware payload (Mirai)", "value": "9026bb26ea49a7ddd1ab5218afb55361", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822311, "uuid": "3f661793-a3ce-4f0e-b2ce-3732eeda76c7", "comment": "Malware payload (Mirai)", "value": "6b4fa5b84da132d9746f6af281f8ddafbedd04719b11a0d1269d6168cbe69be8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822311, "uuid": "39055b64-562c-4c44-b365-d54d3040353b", "comment": "Malware payload (Mirai)", "value": "e53cb1b266012cea0b280141946b903b58da70c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822311, "uuid": "20bdb8e3-d57b-4147-a9d9-830ab2d71c92", "comment": "Malware payload (Mirai)", "value": "7418189007a30acbc29965a7f8efd398943d653f0be626b8dd875ff36e39e2c14d7d0e3d4be60b9a27aef6060b76beae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822311, "uuid": "6bce6589-7c9f-4627-a3dd-bae5e6bcd115", "value": "T143E2F26A51ECB12CE44E903BC32FA98E31E65D11BE17C69424C476DADF611F910B6833", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822311, "uuid": "bf82f197-f51d-4ecd-b77d-b7cb3b22f809", "value": "768:g32bRAqg2UQzSPMjFY8AFOEPB6ZSq7xnwNQBUx:DbRAp2U4ECF+FvB6ZSonwN2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775822311, "uuid": "b8433e08-d6f3-4a11-a446-cbfe02681583", "value": 33900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775822311, "uuid": "8a4f2075-df55-4616-8708-fbeab821c751", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822311, "uuid": "66fa0412-920e-4c32-bf9b-41b7043b8ea2", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da2b0de-34f6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775836816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836816, "uuid": "5d925435-9dec-467e-a049-fce59350ff33", "comment": "Malware payload (Mirai)", "value": "fbe9c954334cb6c8832c8b136968c7e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836816, "uuid": "fe390f40-f738-467a-a46c-4213f93e7547", "comment": "Malware payload (Mirai)", "value": "6b7a6077af12feb73460be5a73dacfc239bfbe8e08bc1cde9f6e61b7e1de9475", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836816, "uuid": "bfd8b8ed-ab0d-456b-93cf-9165e2f9debf", "comment": "Malware payload (Mirai)", "value": "cae0d99c11c8b72ddae03e284ed8461b233e8a1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836816, "uuid": "094dd0cd-2085-4d51-a890-df72456e53e0", "comment": "Malware payload (Mirai)", "value": "26f2c6fa1c07bc049ea8dd3c306c7b34c4150314a8b77c7a10008fb9b8526ac4268e5c82c4dfc49d6e9c29daf6b913df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775836816, "uuid": "777760a8-9d34-44c8-9931-5335e77fc78c", "value": "T146631257FFDC5F99ECDD1AF806EB65DA13919031A07341B80DE29C8A819FE60219A8CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775836816, "uuid": "dffc7cb5-8425-4f24-89bf-b7bd809cbd7c", "value": "1536:G7MbwKNGjjH+Xq34n/q8Zu41zmX3sDg8L9XxrP5:G7Mbp2L+Xqdfoz2sDL9BrP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775836816, "uuid": "70d4d213-8937-4308-835d-e087ba29468e", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775836816, "uuid": "b2da1fb6-13db-4ef0-afb9-3b76fee28563", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775836816, "uuid": "7fa3a31b-e553-4763-9d2a-21bad6abf93f", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "628036b3-34f6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775836824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836824, "uuid": "89711e32-be15-4c42-b1ff-0fb9ad9458a4", "comment": "Malware payload (Mirai)", "value": "cc65375e778e3a5ada4dfbb0e016ce20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836824, "uuid": "2e0b4f2e-7d2b-40cc-956a-46cec342b574", "comment": "Malware payload (Mirai)", "value": "6bbf02b82c454a6a4f7594674d89526d5c698e45fa513e3711a5c925ace32e11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836824, "uuid": "f8a9c73c-df0d-4de5-8869-c20aaef05929", "comment": "Malware payload (Mirai)", "value": "b78f444d6923d44c45ae0ad0d84d9a6e6d4ee311", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836824, "uuid": "d3b29cc8-9e8d-4d93-95ea-56c7a546aab4", "comment": "Malware payload (Mirai)", "value": "0536d37a5af6ddd6487c51b5dfb46977e6f0222ef06caabef580f64b6a4b683f46de723fc36c26d951281ca732d544f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775836824, "uuid": "b40ad2ba-706c-4d62-a65f-dd84423246b9", "value": "T1065301E7A0D47DCDC2598274020B5A473EC66378605A6A3A76C0F6A58FF1380DFC9BD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775836824, "uuid": "c321412d-bca3-46ba-9731-3acf05f50c7e", "value": "1536:C1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8ASRQ2EuTLkg4azHb:CM5az1Fy0oPgdZX6hTo8Ri2EuTLGazHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775836824, "uuid": "e80b1f04-d4c8-4738-b33a-8269db790ddf", "value": 60808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775836824, "uuid": "b6670627-395c-419c-844f-fda76112271e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775836824, "uuid": "a973c0ea-da97-4d0b-9a7c-6e063f21bb40", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df22a6af-34fd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775840040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775840040, "uuid": "cdf3f829-349c-406b-ad98-7e55daa47bc3", "comment": "Malware payload (Mirai)", "value": "8745333a26c2423bdf4d9f7e549baaab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775840040, "uuid": "a6f4d93b-6357-4eda-873e-dd470120ec8f", "comment": "Malware payload (Mirai)", "value": "6c54c63eb33949af085f793ef8f38edc2f2d22a0e6aa660d4281a943f63347e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775840040, "uuid": "4caca7d0-544f-434b-b913-2db224ab70d9", "comment": "Malware payload (Mirai)", "value": "e295563cfbb7d672ac11f4e757414a0bc7ccd8cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775840040, "uuid": "bf87bf0b-5061-4680-9a25-9411ba8ae6b0", "comment": "Malware payload (Mirai)", "value": "f7783fded6d514853b6a860d6efba7206a0ed6268d79bcf57abf89782fcca13ee00f050d29e0f47f92b39ac6e92488fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775840040, "uuid": "02048772-75a4-4b3c-ac13-9479ac0f35bf", "value": "T106C3F185BB6369D1C1A242BDA4C00AC387916E318FE317080699F674387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775840040, "uuid": "45f00ae4-3b54-43d6-821b-ec7cdf3e9362", "value": "3072:OBb4K+nqsnSjZldbaUXGSgqTWo1OWqEwztlMMTnK:0OCDjXG9qTWywxlxTnK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775840040, "uuid": "66bbaaa9-e0cb-4321-92e9-fe5337d43798", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775840040, "uuid": "239b1a9e-93cf-4791-81ae-a168682c83ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775840040, "uuid": "09eb24e0-a685-4de7-8d5d-b762171f1e45", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8eca55-34e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775827957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775827957, "uuid": "6ef9dc68-d2fc-445c-b21e-a0b59f4f57ac", "comment": "Malware payload", "value": "4fc11103656a21ead7ce026ff80e51b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775827957, "uuid": "9262fcb4-dda6-4db1-b3a4-7f428a934059", "comment": "Malware payload", "value": "6ce9a32dab44d084a6664b9ea6f6c2274632c6f014a251929755c890f75c19e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775827957, "uuid": "baaef6ab-faad-4241-a5b5-6362e8236d75", "comment": "Malware payload", "value": "e4356aa03886cb0e155c1ea97db8b89ef0c3b370", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775827957, "uuid": "a531b343-5cb3-47c0-8323-01e396de9a06", "comment": "Malware payload", "value": "72ea4d0d1189421f532acf2adfe0c46653fddd32207fd47b271e8164b82fc08bd1abbf01c4ae49ff32ffe39770b90191", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775827957, "uuid": "5283e350-2a1d-4644-bf70-63ca0d359497", "value": "T102473380639445EAE8D55A7C819A592353B3BDEC2FB8E14F0AB47D673B770C1AD30B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775827957, "uuid": "1421f93a-81e7-4f20-9af2-c5fedf622bcb", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775827957, "uuid": "717d8bb0-fc8a-4353-932c-62ed8804af70", "value": "786432:Mj5vzAljSYGuSW8UW+Nj/vZAQSOPeUBWtA1deJ:o9zAjShWLNNLqQSOPeUp1de", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775827957, "uuid": "18bf9531-2fc1-4f60-980f-b9f62e70da10", "value": 25744723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775827957, "uuid": "693b92ff-b2f5-419f-a0ff-f27381126f89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775827957, "uuid": "3fb9a03f-3ae3-40a6-b257-d9b75a251c40", "value": "UnloockToolAcc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54152471-3493-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775794280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775794280, "uuid": "917d595d-83b9-47f4-a85e-298edfb07fc1", "comment": "Malware payload", "value": "fd043c14452d4184cfdf7aeab2e3e2f3", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775794280, "uuid": "0d94e616-f6ef-42de-ad38-92fa19e0c701", "comment": "Malware payload", "value": "6cf878fbbea5e609258b2250b23d094e1eeb7e509c6e51831eeb37526be8a9e3", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775794280, "uuid": "a6d36dbf-4972-431a-8167-86ea86b58768", "comment": "Malware payload", "value": "cadd6d50cff01c24cec2acb92baa0002ea2ed95b", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775794280, "uuid": "22bff7a4-662e-412f-b667-8d5c5e8d57ae", "comment": "Malware payload", "value": "99dc8fdcc62d1c0db989e306d5a48e16af736b229cde8696227a51c4d431ad95543593f9046d695427d299ad04c05bdf", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775794280, "uuid": "97e8d449-1acc-422f-9fab-106c9c76058f", "value": "T17C14D733DB6284B9C4AFD1B0ABC6E5B26571BC184274B11E5F804B217F0BF60AF6D685", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775794280, "uuid": "a9624210-e32f-4618-9e36-409f5c9a8f6e", "value": "fb3237bad2e3a80d9e1f2968c22a2d78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775794280, "uuid": "4d6d76e1-cfe9-4e39-a40a-d6ff4363295a", "value": "3072:EwDJ12J8manQmVQiMmYA4qFMx7Fcb+2JP5L5mNbSmk:EN8m5dx7FcbLJP5L5mNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775794280, "uuid": "61c10d0a-78bd-402b-a503-124fbe9903f3", "value": 199496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775794280, "uuid": "d0ce4c74-0b5a-4c98-8cdb-4a0157a45817", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775794280, "uuid": "6301199d-d44b-4f57-93af-26c29f68b8f6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb0b9b8-3522-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775855793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775855793, "uuid": "f0148724-a057-4f23-bdef-89126fc8dffd", "comment": "Malware payload (ValleyRAT)", "value": "39abe2be49a14147c34eeb03eb6e3fba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775855793, "uuid": "82b853bb-8e26-41ef-b181-6301bff3b32a", "comment": "Malware payload (ValleyRAT)", "value": "6f1bc66bfc4c97ec54c08e498209183f47eb65ffb1954ca6a967a074b9212415", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775855793, "uuid": "b051989e-b89b-4a05-90d5-5a80dd2f3dbd", "comment": "Malware payload (ValleyRAT)", "value": "453eb081b8631341040eec00b0256fc7bd78cf19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775855793, "uuid": "e7d758a0-4aa0-4d9e-be16-e688f4934e8f", "comment": "Malware payload (ValleyRAT)", "value": "083963c200c9a97502dc9cb62dbc4f7416a5d57633a4274a945c0039e34de332a5c4dfa683ae7a2b4b8c56ffffe94d53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775855793, "uuid": "fb77fc65-2951-468b-9a8b-2fbff4c8ffbc", "value": "T1630833D5301A4965D87BA033BD41EA88BEF84DCD510ADF2ACB52EE7C09512E1F07BD1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775855793, "uuid": "c8cebcf6-407e-4a9a-9284-5234bd96adc0", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775855793, "uuid": "2f41a2ec-78c1-488c-bae4-83afbe2dda43", "value": "1572864:nybQ18HYZ9yy3KrcJN4mo/KBV9ggLwiUQxdvtPWVOCmW3HjRqYo:nc/4Z33ecYmoCWdiUQxdF8X3kP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775855793, "uuid": "b8f1a5c4-415c-42a1-9cb0-c38585102feb", "value": 78525679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775855793, "uuid": "d86b67a3-29b8-4ab3-8da0-22de25c53ba3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775855793, "uuid": "1542d2dd-8192-41b2-87c6-c3b1f9075471", "value": "Letslat2.5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ce2e76-3509-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775845156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775845156, "uuid": "30d36ca0-11ad-40ee-9a7f-efff809f9f73", "comment": "Malware payload", "value": "6c2f276ba8851b48354db2f49ef57e80", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775845156, "uuid": "2434ada8-f5cd-4ff1-806b-ac750aa04ce1", "comment": "Malware payload", "value": "70705bce0d1386b78ed87f9fe71770106c31116195310837bff6f195451a1775", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775845156, "uuid": "9c6e92b3-9c7e-4681-b3b4-6da8958ebf93", "comment": "Malware payload", "value": "0a682a81d461189d598695ddf3756dad92dd1695", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775845156, "uuid": "3835a5c4-6f67-44e4-ad13-2be250b5f5a7", "comment": "Malware payload", "value": "c4de505aaf12507b71dd38afb0c5924803bc9d9e0669c5568aeb7daa2a9073b3b12026b149f94518b9e49e2c00cd5c10", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775845156, "uuid": "40fecb2d-7956-4cdd-8db3-b0190dcf704d", "value": "T1E5C5E28D775D41ACC56244B210F10A92A7B9DB16A3E85E071BC6CC788E120DDBBBDBF4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775845156, "uuid": "6caff7e9-5eab-4aa5-8928-4ac78063b354", "value": "393d779b279452acafa3be6bafa76ebb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775845156, "uuid": "3da4baaf-17f0-4732-9577-7b3b8c741571", "value": "12288:xB1PLvjJtIGuYsl4wcxOSKyiG//87gRgYafcCxlNv//8G0pDdly8ECd9EgenPvq:xBfzml5c6yiHCPc/5vXL0pCC0gePvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775845156, "uuid": "83120996-b1f4-486f-a65d-ac44c2c41b24", "value": 2697216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775845156, "uuid": "896051d0-8f73-4b46-ad1b-c1edca057042", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775845156, "uuid": "6625656b-beee-48e4-99d6-3b07b58c0425", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c25c9cc6-351a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775852447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775852447, "uuid": "8c29119d-b8c9-4fb5-b7ba-e54015453e17", "comment": "Malware payload", "value": "dcf04df282f98a48203a51e9b79b4d46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775852447, "uuid": "a05677ba-d697-4dfc-8aac-6a4517f38716", "comment": "Malware payload", "value": "716d698765e5bc3f936f7d28edc5b47839dfe8568a1311a57d2f8dbf73654b7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775852447, "uuid": "1f148c3a-1636-4a84-8629-3db59b9a34b7", "comment": "Malware payload", "value": "8b8ed92cbdffa9259bf55ca58735a7b9f9ad3722", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775852447, "uuid": "01f3d4dd-9ab8-46a3-97db-c9595cd03be1", "comment": "Malware payload", "value": "45669cf9cdbe3905babf84f53dedcf8b9a3b8a5f9acd57a9ff3f1c29d8de9713c491883eedfb5b03004e49f0b5ca486b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775852447, "uuid": "c7be117d-ca47-4d11-ba55-2399f5d72f32", "value": "T141C21949ABE806A2E8BF0B356D72468647B2F0866523C74F09CD948B1FF779049127F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775852447, "uuid": "7913ab24-fc1e-47a4-bf3e-f34eeb9bf449", "value": "768:Y/0WS84xSf8JebY9c80FQr0BdpkvorjXego:Y/0nxGb85m9rjOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775852447, "uuid": "0d966954-15f1-4bdc-9b14-890a175ebaa9", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775852447, "uuid": "cf172c2c-d659-4993-9a17-bf0d81f74e4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775852447, "uuid": "d44780d3-4c34-4b83-9d29-86894524a58e", "value": "SecuriteInfo.com.Win64.MalwareX-gen.76411844", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275666a2-34b6-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1775809237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775809237, "uuid": "0f9cf021-a0c6-4b2f-9b62-9a3c836c9685", "comment": "Malware payload (ACRStealer)", "value": "746bc3d5af26c030cf632cd0def46a58", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775809237, "uuid": "302de7da-24eb-4622-93bf-c712696c79f9", "comment": "Malware payload (ACRStealer)", "value": "71a054886ac15a02a5b2ae4deaa26b17492838e2aae39ca1273f413f255dff55", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775809237, "uuid": "b2817de7-91da-45cc-8136-ef8e16c3750c", "comment": "Malware payload (ACRStealer)", "value": "58fe49c8ccf374dcc1ae04f3d45858d68f62063f", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775809237, "uuid": "57f0e07f-b2aa-45a5-9c0c-98c835564f91", "comment": "Malware payload (ACRStealer)", "value": "01feaac72863576574fda2fe2e4079fe13f6375b630cb6ac166b1b15f37dd23315ff2ad9cf8396821885d8c512510ab6", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775809237, "uuid": "464ded24-d975-480b-8d0c-5145e6bf0a09", "value": "T182F55B0BEDBD4CEAC0D9A5348433A1567E2478401B2173E72BD0B3A92E777F0A979B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775809237, "uuid": "49e65697-d5e3-40ca-a28e-f717e38dd876", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775809237, "uuid": "549849cb-3b95-47e6-b246-71cfdf5037e1", "value": "49152:i/iH7C3kbWIP1KsknM491tZN7btcjHQcQFb2:i/Cb5URrztB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775809237, "uuid": "011e4f81-4e25-4aac-b7e1-cd04727d3c57", "value": 3631128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775809237, "uuid": "269f6a05-1457-4140-99df-125d7fb03824", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775809237, "uuid": "6068b990-c53b-4641-ace8-9bdcf358ae47", "value": "SecuriteInfo.com.Win64.MalwareX-gen.85274895", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e11097f-3512-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775848708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775848708, "uuid": "100f85a9-32f1-4f0d-b1d9-64b003527792", "comment": "Malware payload (Mirai)", "value": "68e1db557143aded17692a33191307e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775848708, "uuid": "76fec2db-7376-412c-b1d2-a0df4dfb6b67", "comment": "Malware payload (Mirai)", "value": "71aab3aa8b7f19fad0138117906e171e8b5df20766552aa22f49428dbbae382c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775848708, "uuid": "6fc6c9e9-9a7c-44ec-bc12-bb8711b8865a", "comment": "Malware payload (Mirai)", "value": "17e5ff7551513859c367067aa93888d78403b06f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775848708, "uuid": "c9abee77-3972-4eea-a826-67f14b50d875", "comment": "Malware payload (Mirai)", "value": "434d6dda035e0b81ae6a87adf2abc3dbc5ee001911f4f5cdee29305ed9a55b7c0721e70bd34c40d76c3b48d5867a3190", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775848708, "uuid": "cd7157a1-5ea7-4a95-909c-7a38eb1879c9", "value": "T12F04B609AFA10EBBD86FDE3306AA0A0239CC641731A53B757674D524F54EA0F59E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775848708, "uuid": "38d5e408-042c-4e9f-8343-5ff47522b532", "value": "3072:VCpyxfDQ4zVLW3EDB/dALXZcY8+6A7mx+E5NEQrES:VCGfDQ4x9rocJ+63wCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775848708, "uuid": "4ee413ac-4ed6-4106-8809-6f02b422a0d9", "value": 184164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775848708, "uuid": "c03673b6-b282-4362-a0d8-504fa28424e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775848708, "uuid": "35a79354-dbc4-4d9c-947b-1946ec219980", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b3f35d7-3524-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775856569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775856569, "uuid": "dda14742-a7d6-4ca7-bf82-ae681fb1339e", "comment": "Malware payload", "value": "dc52ef9c85f79ed7da24f61c8a4586de", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775856569, "uuid": "8691a0c4-e078-4efa-9fb9-a25817d45fca", "comment": "Malware payload", "value": "72a1926728b5686426bbffdff9e23f4cd1f24ed7c6b75697739e05bebb9ed05b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775856569, "uuid": "b5b54f53-e711-46c8-93ab-2b4127cbe27c", "comment": "Malware payload", "value": "a2601887a9bd828af7371b483efa41d50e038769", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775856569, "uuid": "aa0d3da0-3c66-4556-bd02-a6a16482e79a", "comment": "Malware payload", "value": "0b0502a892baa1c1dba69ecb79c160120a63400293ffe5d53c37a7b37f80f02147fb73b5c93261f11b767876d7feae01", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775856569, "uuid": "900303c6-9c60-4df8-9ebe-446f6a6b86d4", "value": "T10641A7D37ACA00550058A00E4A27B55EF99EB9BF7C7846E2349938AF38E75E8959D308", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775856569, "uuid": "5ba1b23e-7ba8-463b-a68e-ad9a1f9bda4b", "value": "48:tJ64FEHw/uw86JRMXZQ+t+IM/4gJo8ecP28aQT/x5:t0a86JiMIM/PS8d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775856569, "uuid": "2f47d598-9ef3-4a6f-91d7-2875dc6437b1", "value": 2081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775856569, "uuid": "4233a702-65bb-416f-b557-04a9484ad811", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775856569, "uuid": "beae6858-e6fb-4cf0-9ae7-de0136731425", "value": "20bd88lqh.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a1564e-34f5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775836472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836472, "uuid": "2b8ee0e1-f6f2-47a1-a7ae-199eb16cb8df", "comment": "Malware payload", "value": "6e4bee69f838b632007ac324f389654a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836472, "uuid": "5deef04d-5138-411b-9ec9-f4a330c84c5a", "comment": "Malware payload", "value": "73688f47ba909b3a0eb57f36ce857ba82f7eeb6e8e1b1378a6d5d328086f9c8f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836472, "uuid": "42b84c24-9fe5-4098-944f-f2883533c87a", "comment": "Malware payload", "value": "5aad1ad8e16771764c4402f73d3e9153699e23f5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836472, "uuid": "28433ace-a509-420f-ae8a-4202596b1452", "comment": "Malware payload", "value": "6ca891a57b5f494d64cc68e28b60b4506ad38ad4ba8f8cd1c8b1094805b8292d2562aaa37d8c190b42509d4abe21df9b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775836472, "uuid": "4fc48c28-be76-42eb-9075-968998bd8b11", "value": "T14295F151F3AD986DECFB83314F32516551628E668F43E34798A0323C69BB5C0AFA1ED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775836472, "uuid": "a743af5d-75d8-47c6-a675-481eac127c89", "value": "49152:gexr0TZ8HVo2LDYF7QDdmjFENAOY3/spGjniiTIpdYgx:ge5+ZSRLDm7jFENlY3/6GjUpZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775836472, "uuid": "f33c5d60-9ed5-4765-99cb-a791867c6b2f", "value": 1907224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775836472, "uuid": "4a9bb331-6fc9-44eb-8a50-72f4f5b5bed7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775836472, "uuid": "4c36fc2a-8ffd-4f21-8e98-5b18b2090120", "value": "Google photo(6 \u0448\u0442.).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f834a1a9-3489-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775790260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790260, "uuid": "3d4c3cd2-ca98-4771-809c-39b7e8f7f2b1", "comment": "Malware payload", "value": "d5a091efc40ccd06b0533f4aaf0b6c68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790260, "uuid": "132f970b-13b5-4389-94f4-e6638633394e", "comment": "Malware payload", "value": "7446120b08796be76901c3d05b5598afab082aec3b71764f28deef0f9d22d111", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790260, "uuid": "8b45df85-5ca8-4073-b91b-a25536381466", "comment": "Malware payload", "value": "1ee71658d0310956384335a6844a654940606a0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790260, "uuid": "92877313-9921-493d-8c6a-204655384f5e", "comment": "Malware payload", "value": "2efaf148b34c039020344097b27e7d43746f9be565bc1d168b5d804fbc12aaad5616d19def2fb8eb7830976aaadd9e18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790260, "uuid": "3ea3e291-f4e3-487f-939e-1385110beda4", "value": "T18C533B22BA721C27C4D4657A61F70335F2F6838A14BC8A173DB10D8DBFA5A4036677E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790260, "uuid": "535d3104-3b3d-4d1f-9666-2579dc4bc176", "value": "768:uJVdeetU0cpZRHteO+N5RdIBR9mYc6d55iJWkreTVECD0x1tY7LsIc:uXQe20itsNejHx/5tYuKntYfsT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775790260, "uuid": "50114ac6-46c4-44b1-afad-c852672632c1", "value": 63172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775790260, "uuid": "0da4940e-f1ba-49b1-b9e1-25a378c984ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790260, "uuid": "4c98c5b5-b01e-4015-bb36-3006d443688e", "value": "Clipz.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa8a5c19-34a7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775803015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775803015, "uuid": "c5508ab0-86c5-4c5e-998a-8367d5b22b94", "comment": "Malware payload", "value": "da1ee981b85f72cd2e45e6a1ede1461e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775803015, "uuid": "231f0365-fc9a-4f7d-8638-744371700fe4", "comment": "Malware payload", "value": "760170915dfb3775fa540262fa308769818dd3fe908f9bf088c458df7de5ca58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775803015, "uuid": "4a2891b7-5cc3-48ad-a66e-c0cc5a379b7e", "comment": "Malware payload", "value": "e381c15d8a3a304af70392627976cc9710f299fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775803015, "uuid": "5d6641b5-f5c4-4787-aa72-fe0b079c3b3e", "comment": "Malware payload", "value": "314fae3c9264c4eb070c9d29875957b0ac5f689b890cf639f0f6ba09303fe2b7c2766464b18dc656c68fbf4811b5c071", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775803015, "uuid": "598caa38-4f61-441c-8286-a68b74fd6d9b", "value": "T1E7E57C87B2B65224D9B7C13886A7D52BD6727C46CF2065DF125CB3186AB36F01E3B318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775803015, "uuid": "20beef68-4e18-45a9-beb1-2b6242b0a32a", "value": "0c2cdde01d811ba2be59897dd7167604", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775803015, "uuid": "ad04c6c6-40f3-47a0-b486-8d2c88c57cdf", "value": "49152:rZcUUrF5aqMh8rZckSTWd6Rc0OdW6CUJHJsv6tWKFdu9CEPTvG7tepHFhh6DhqaT:r6XuCcyxXJsv6tWKFdu9CEiO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775803015, "uuid": "31618640-4f4c-4f18-ad79-cbc645277f10", "value": 3313664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775803015, "uuid": "176faeb7-219a-41e0-b9f8-707fbe249b84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775803015, "uuid": "7e7fc8c5-e100-4dd6-86ef-7c9bbe779556", "value": "_2026\u7b2c\u4e00\u5b63\u5ea6\u8fdd\u7eaa\u4eba\u5458\u5185\u90e8\u8c03\u67e5\u4fe1\u606f\uff0c\u8bf7\u5927\u5bb6\u4f7f\u7528\u5185\u7f51\u7535\u8111\u67e5\u770b\uff08\u6587\u4ef6\u5207\u52ff\u5916\u53d1\uff09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8456176-34c6-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1775816459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775816459, "uuid": "e9630f42-e3a8-401f-b2e2-bbd5020e569e", "comment": "Malware payload (ACRStealer)", "value": "5e7194d3e5d922627ba25d151d74b98a", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775816459, "uuid": "38290d91-299c-42c5-9ecd-7ff1a914f249", "comment": "Malware payload (ACRStealer)", "value": "77992a3513414dddec51e6075f23868121dfded9d48b1ca98615f93f80232e99", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775816459, "uuid": "b92e5f6b-a2bb-487d-9104-67aba375db64", "comment": "Malware payload (ACRStealer)", "value": "c02dd506966b8492474572d29863062cadb475a4", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775816459, "uuid": "b73538bd-493e-419e-81e4-24861c1b999e", "comment": "Malware payload (ACRStealer)", "value": "f3dd872c2ded736a83df74ffcedc468dd4f26275bf48500f8f9846aa0a55ded31d1cff0d1337d85fd7dd4beb3a071c2c", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775816459, "uuid": "76c32a95-94f5-44a4-b805-094c6628b5b4", "value": "T1CAF56C0BEDBE4CA9C4A9E1748433A1467E2478405B3273E72BD4B3682E737F0A975B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775816459, "uuid": "09a022f2-89cc-4088-928a-6a946392c4e3", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775816459, "uuid": "1b9d997b-1680-4c45-802f-ab6416a46d5b", "value": "49152:AG6Dq1TFGiukill2eHuTWp8TfyH+d9yXZW+KWEqYcJBpjKQcHO2THBK:AGzyXTuS2m+CJWEjBxHcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775816459, "uuid": "eb8a6e25-0ec3-47e4-a354-05e6515f4a73", "value": 3603984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775816459, "uuid": "8b3f2881-65df-4e9c-b059-cb7c048c4771", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775816459, "uuid": "25f6d76e-71fa-4268-b7bd-75b65d520f9e", "value": "SecuriteInfo.com.Variant.Ulise.596178.32490.12242", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e62f3713-349d-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1775798820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775798820, "uuid": "6fe6670c-50ae-4cf1-8324-2a295984e596", "comment": "Malware payload (ACRStealer)", "value": "d19214f629c068deaec85aaaad104b86", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775798820, "uuid": "86e3b6e1-0e8f-48f2-baad-0011472fb9ea", "comment": "Malware payload (ACRStealer)", "value": "784cde49ce9fb11051c005bcd0f27a68f043d64acaceece04f34108cbc2040e0", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775798820, "uuid": "fa07c5ce-102c-4db7-b0d4-ec5584aa8126", "comment": "Malware payload (ACRStealer)", "value": "67525ee280f279d64ec2170f5067d76004e04565", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775798820, "uuid": "b9e817f3-0827-4699-9731-c1f20fddbb84", "comment": "Malware payload (ACRStealer)", "value": "b723141e48f8d3658311015850a3381470beb8034d741ad4f3d4e1761a879f6101c23c88e189fd57c4c499f2b6d313b6", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775798820, "uuid": "3a2e7224-d2ea-4b0b-a487-d0a059c2da4c", "value": "T150F55C0BEDBD4CEDC099E234843365567A65B8400B3263E72AD0B3682F777F0A979B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775798820, "uuid": "d0956c4d-dabd-4c53-8fe5-d7614d13575e", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775798820, "uuid": "98305ccf-e568-4055-b02b-169e46e96f28", "value": "49152:PJZ3hmbNeqiMcLIyKl1Pq0hYIlBI7JPujR3wD6BveUEqQceCw:Pv7KcabKIlBclHsw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775798820, "uuid": "1bd8c501-48ba-43ce-af24-3bb20627b62e", "value": 3589136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775798820, "uuid": "18b24c75-f7a3-4dd2-a842-65669fe451ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775798820, "uuid": "f631845e-92fc-4491-9b9e-437a05cea58d", "value": "SecuriteInfo.com.Win64.MalwareX-gen.84446743", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16366ea2-348a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775790310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790310, "uuid": "7b2ef54c-8fcc-4551-bcdc-2a7a17b5355f", "comment": "Malware payload (Mirai)", "value": "0cad92bcd35f95464a0909cc90980960", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790310, "uuid": "e9869a8f-f556-48a4-92d1-2718a07e409c", "comment": "Malware payload (Mirai)", "value": "799425a1da05773c7a5db4d28b5fdca4116680b13649cbd293a196061fd10287", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790310, "uuid": "631cd90b-c0fc-4f28-94fa-91a774b76da3", "comment": "Malware payload (Mirai)", "value": "9a47833059ae28016309806e69fa27db3c55e2a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790310, "uuid": "89419698-744a-4169-8c13-c725cd02cdcd", "comment": "Malware payload (Mirai)", "value": "36246a683feafcc46ad8891a17b64f9db36576a5cfd9e6c787ab2d9ba02cc334fed853be805cb29b5424e15c94fb1e69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790310, "uuid": "c8d2a5d1-7ceb-4819-9d99-89b28e85d897", "value": "T1ACD2E0008EDE7C2256308E37ED7882C29A7D05B870FF31C6166840F5BB5003E97BAA93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790310, "uuid": "949e943d-fa7a-48f8-af55-f8c4984f34eb", "value": "768:A9mUccx0fFxFY59/0HG7hi8KC6OPGs3Uoz4:A9m6xiDFY1cN1OPrz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775790310, "uuid": "a4af7efc-d0aa-46e0-afb6-04a3008fef0d", "value": 29424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775790310, "uuid": "258b4272-a78b-4d78-8204-c789e94e15a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790310, "uuid": "3ea4b195-514e-4dc5-abab-698db3f8f6c9", "value": "Clipz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07021ea7-3519-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775851703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775851703, "uuid": "2cd8204c-707f-478a-a7c3-7892d8cec24e", "comment": "Malware payload (RustyStealer)", "value": "06cfbef7b396a4609f6cfae53f5a44e2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775851703, "uuid": "cafd01d3-d297-44a4-aa1b-bd61a08cf54f", "comment": "Malware payload (RustyStealer)", "value": "79bba91b5b7c98c36ad928dcfdc3ca19c7c24e2a9a9d8b05e94642dd11092ecc", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775851703, "uuid": "e7887c45-b634-49f6-af38-f96d54a84b80", "comment": "Malware payload (RustyStealer)", "value": "f586c1f16e2dd11dbefa04b04c894038b79aca1f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775851703, "uuid": "5a05bc3d-488f-47d9-a687-805ff543d485", "comment": "Malware payload (RustyStealer)", "value": "d68751e4ec7c5be06738bc56c2a18aff3a962d0962198e8ec45b9a872b32d169815d2f1152454db8ae3b1a63b70216a8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775851703, "uuid": "c1b3c7e7-9f75-4fde-af11-f61cb0660589", "value": "T1BEC512CD6B2513BEC258AEF7E283362E438753A0673FD4285C986B35F86848C55873B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775851703, "uuid": "1347b246-e25f-4214-b570-5a7d9fa86c43", "value": "944a358417389f0d0bc02b5eede0017b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775851703, "uuid": "e6998bcd-8128-438a-bd3f-c6136982daf3", "value": "49152:eKZ4fCu6ULVsErIWXCcTk3zfLsICkq031WheaEtkDAQ8D29os3694OlS2NoFEasT:eKiitEMWyc4jfLsu931WheaEuUQ3s4b3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775851703, "uuid": "71f85bc3-907d-44b3-b803-18726d2bcdf6", "value": 2696192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775851703, "uuid": "86fbccd4-ef3d-4ba1-91c8-2c15f7908244", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775851703, "uuid": "ede4190d-8002-4e01-8327-5ab3ad1197f6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fdde4f6-34f8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775837786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837786, "uuid": "15646843-4d21-48cc-9551-33185f56c856", "comment": "Malware payload (Mirai)", "value": "d08a02a778069a0b5bf9ab11a88d7fc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837786, "uuid": "30403f4c-c390-41c4-9021-6973e4f74e7c", "comment": "Malware payload (Mirai)", "value": "79be1937411b567b8c8b269a9a806c4c8cd6584213b79ba5176d290532d13c6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837786, "uuid": "ae0acf5f-ffaa-46aa-884a-69be589db8f0", "comment": "Malware payload (Mirai)", "value": "ad7956aecd60d7cbcd836daa0c71289b99dfc0cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837786, "uuid": "6234d4a0-e775-4824-b8e2-9a8a3ccecdb0", "comment": "Malware payload (Mirai)", "value": "cd775dcfa98fb5b208d0fef75e667a18202bde5639619e0cb5fa850ddc173b9c9e7e43cf07146c31f967a752b78f1219", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775837786, "uuid": "b7888e40-820a-4160-8bad-174b1f595237", "value": "T18D146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A9977225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775837786, "uuid": "e7a690fb-832b-4e46-91ea-4b1e6c88b125", "value": "6144:1R9Om5159ZA0mzoWcz4Mm4ztkES7IKTtL:BZAyFzQSdS7Ii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775837786, "uuid": "1b01bf4a-7b4d-4e5a-9c13-e5003fdb2191", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775837786, "uuid": "463e299d-9abf-41dc-9e2a-249589567713", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775837786, "uuid": "3c6ff555-f656-482a-8e5e-3e67a98855f3", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba5fcd2-3486-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1775788816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775788816, "uuid": "279663c4-d4ef-49f0-917a-b9d1e60deee5", "comment": "Malware payload (DCRat)", "value": "d2d09bb41ba57aec67de96546ca34278", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775788816, "uuid": "661c48da-7495-465c-9e74-cc1bf2b2c9de", "comment": "Malware payload (DCRat)", "value": "7a0fcbdc5963ad87ba3139ff1a69b035a5bb64628639699a37924b89a307c9b3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775788816, "uuid": "2f5bf13b-43e6-42ad-807d-107991885dcd", "comment": "Malware payload (DCRat)", "value": "e7942d9795ac59b8ff9634c3e142dc584775fd79", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775788816, "uuid": "b0049553-fa8e-4cbb-91c7-fc03a328b45b", "comment": "Malware payload (DCRat)", "value": "8dd95dacfc470833cc40a6f01a19e1941d3d9ea1220dfdd42f6966af9a745e0943bfef72e52802219f3a6b0a24268ba2", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775788816, "uuid": "bc4a6656-4848-43a0-9de6-63dfde61cb67", "value": "T1C1658C017E54CE12F0082633C2FF454457B4AC516AAAE32B7EBA336D59123937D2DADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775788816, "uuid": "79cade67-87b0-4dc3-9a5b-fbd810143f03", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775788816, "uuid": "2811db79-85cb-4c55-9bf1-63a6547380ed", "value": "24576:p2G/nvxW3Wk55/WZpCdB26mQV1mKw7ZpL6g5+QZqqqWgRRXiI40+5pP6XQ34NPqV:pbA3bvMCdJA66UIQRXiI4B6U+q0DJ0//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775788816, "uuid": "888bb72c-dafb-4160-982a-b68fe88ee44b", "value": 1508969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775788816, "uuid": "43a18562-647f-4a08-b7cd-c1b54c19cd02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775788816, "uuid": "76dfc923-d3e8-45ad-8b80-35a10d9ca0bf", "value": "D2D09BB41BA57AEC67DE96546CA34278.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c11a55-348a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775790306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790306, "uuid": "c5eaf3d0-5c00-4fb8-8c43-30d9383f1ab5", "comment": "Malware payload (Mirai)", "value": "882a69dbba8859e2365ff6b02bbd325e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790306, "uuid": "2fbe2748-3576-4470-a94c-469a1ce36917", "comment": "Malware payload (Mirai)", "value": "7b6510c31bc3b9f7ba3fba0e2560688eb2a90b9df939c2f6c0d5b5763369ac94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790306, "uuid": "396fef26-2e93-4340-b2d5-6abde7b2a2cc", "comment": "Malware payload (Mirai)", "value": "8d50af9edc9cc4945f9dd435ea66e5ae465dfb8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790306, "uuid": "6536230d-3ab1-4582-a686-c602d7f4fb1c", "comment": "Malware payload (Mirai)", "value": "3f3253d793f170f54edf980156ea0971f6c8312ea06e4347d46df3e55d0b997f7cb7d6dd25641b25ceb73c3e6ec200bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790306, "uuid": "cc4a8fad-0720-48f5-9eee-bcbf8935d753", "value": "T1EF236B63D9355E18C159D9F0B0318F755B63A4A5C1870FEE2062C27994A3D9CFE1A3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790306, "uuid": "f79024d5-37ad-4242-a1eb-2e25bf2468e6", "value": "768:aFj/vVvbADc+oDJJMZbDKpQ9VaQUfOtXOBwCZ9f/l5FCoyI:wvJLDklKpQ94QUyOBrXCoy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775790306, "uuid": "1d9c186c-7be2-476a-a93a-e4ae6a18de75", "value": 48076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775790306, "uuid": "4d54439b-b6dd-41a6-9416-67f20befdb36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790306, "uuid": "6c55416b-2853-4515-834b-1797cb0ed71b", "value": "Clipz.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc70535f-34d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775822372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822372, "uuid": "d5d9eff3-7c3b-403c-8703-f99bc1ec41cf", "comment": "Malware payload (Mirai)", "value": "0709acf6cdc43f55a5a6a0d1562aa1ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822372, "uuid": "7285a019-6f0f-44cf-8a99-56a022ecf2c6", "comment": "Malware payload (Mirai)", "value": "7d73b78095f105c41eb95557f7e1f2c74799cd5612c51527e006ee4001800875", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822372, "uuid": "0c463fb8-a3d3-46e3-b8f6-68d3749c0f9d", "comment": "Malware payload (Mirai)", "value": "20c1bb3c2e56fed01f6bf55d0324bd8c6b442923", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822372, "uuid": "7247534d-c2c9-45bd-939a-f8098c32f362", "comment": "Malware payload (Mirai)", "value": "4d4a7250b16d453fc968697167576e56989999fdfeb5f878b0ee5f1796be7726637f12b3295ee9aaac64de39b9f8c673", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822372, "uuid": "6212d0aa-b2df-4ea0-bb3e-d2a86a97e1ce", "value": "T1DCE32C56E6814B13C0D2177ABADF42453323A764D3DB73059928BFB43F8679E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822372, "uuid": "e4103a4c-54d9-415f-848d-b26f1f93bf54", "value": "3072:U+UgZWIx0UEaK0U4560zSlzhXRzM9hO3+keLUM/9g2JCVF:U+UXIxLEaK0U456xl9RI9c3+ZgM/9d8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775822372, "uuid": "f99f4b14-e117-4c19-8aa4-0d5bb6771f89", "value": 157131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775822372, "uuid": "129154da-94c2-47eb-bad6-54155a6d4e26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822372, "uuid": "982df327-8713-4d46-9e9b-053b6b9bc0a3", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "479308a3-3519-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775851811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775851811, "uuid": "747fad50-bf7a-4433-b5ea-79128225ad61", "comment": "Malware payload", "value": "56dbb594b3e633b743f2b3dcf3266db6", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775851811, "uuid": "7b1989af-a780-42f3-a881-7e69143d97ee", "comment": "Malware payload", "value": "7ddd3c4808372c91c916c4b77a07a09f61753bc26a592ff7da3bd71d12802a0c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775851811, "uuid": "eca1448c-c019-4c7c-b71f-c15ad945a1ba", "comment": "Malware payload", "value": "5d4378d1feb492d8e3ceaeb48fb32dc0b54a3504", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775851811, "uuid": "ae5187b8-ccce-4ecb-bfe9-62468946019b", "comment": "Malware payload", "value": "4948b8b49debf71ce6692f962c7668924dc1cb09e85714e4993231f121643add60a6985815a3167090b2aa24460696b0", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775851811, "uuid": "9e544a1d-60eb-4ef9-a108-70255efe85ec", "value": "T13C04125ECFF43869FEEAA33917C75B4336E2ECE1604802823913DC645DA1BB624465ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775851811, "uuid": "a567e2b0-7f97-4eba-826e-338eae5a99b5", "value": "3072:WhnccQq/uXlvi2yY+vKvvMkqzJ+6PHsFkKOAGZATF1ncX/2XWJK647IgmSoajaIg:kncouRijKM0gHAOAGZucX+G/43mhEtq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775851811, "uuid": "9a90e40e-4c2c-440f-9ad7-bdcd08d20abd", "value": 185093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775851811, "uuid": "cfe46581-47b4-44f1-a91b-cfebac3a022e", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775851811, "uuid": "abe92977-4951-47eb-9a4d-f14ab22beaca", "value": "Adroid 67 install_v1.0(1) (1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e0937e7-352b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775859526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859526, "uuid": "a8de4221-5f01-419c-ab30-5811887ce8c7", "comment": "Malware payload", "value": "129018c11adba7d48a55cb3cbdc1c003", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859526, "uuid": "56382e4a-9b0d-4c0b-9871-047c1ed73d94", "comment": "Malware payload", "value": "805fe1d55aa481c0b213cd69ea0a55e874daf8d644d7a5126efd4980cd7833b4", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859526, "uuid": "6a0702ba-5126-4c7d-b837-95ba89513246", "comment": "Malware payload", "value": "a1c9214018b95aee478ac9ac2bf17f921b0eb4a2", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859526, "uuid": "f0e3f939-a428-4462-8ef0-090e30c9ceb6", "comment": "Malware payload", "value": "7bec2e7eea641ca874bb424dc73a01d0b43667e1a39828b946cea29f843a020a31ea38232f63feac803cd49a9c5b430d", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859526, "uuid": "a1ca5113-fab2-4198-af04-cb77011e36bc", "value": "T118D3BFEC8A5E4BD987923C71851B110BFBF015133405D6E0F71FDA867F29A284EBADA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859526, "uuid": "8b31a8bf-6da7-44e0-b59d-0c561771c18a", "value": "3072:em4nlzf/LG2BrmN9SnkYB0aP5glgyQ5tpKgZgMvNb/AdswfclBtQqmz9aJVIgfTj:em4nlzf/LGrN9SnkYB0aP5glgyQ5tpKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775859526, "uuid": "046f7fc6-2f63-4bbe-b996-9be65d8b72e5", "value": 140888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775859526, "uuid": "c747044b-8d2f-44bb-a68e-6033c47382b0", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859526, "uuid": "cd906374-2a67-40c9-b4e5-5c9e2d735a78", "value": "Work_Gamma_Build_694.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350183d3-34c9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775817420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817420, "uuid": "1f339fc4-1fc3-4960-8d0c-b21a5722389d", "comment": "Malware payload", "value": "2372ed6cd5975873aff677460128bc18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817420, "uuid": "faa2d86e-e8ac-4612-9033-54f1e3cb57c9", "comment": "Malware payload", "value": "80b3c302cb1ab35193d4e54b3df270f5900a96d8848baa23f9505821b7d6610c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817420, "uuid": "a4b6cafd-3c7d-4613-97d8-4f17bacf7610", "comment": "Malware payload", "value": "1025973511567d5f6dc9ded79de5211554fd9025", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817420, "uuid": "878f08f0-f4d8-4672-9960-32d3d216dba2", "comment": "Malware payload", "value": "995a7320cfef084a7091288f123c1849566887e1073bea40fe9e07d98853bd5b8c04b3512f5888e44578fc21e02cd77d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817420, "uuid": "d8043dd7-8835-4891-9ef6-95100d7caf94", "value": "T19393D0F639B5058EEE735831B2F9DA5278307FC25F71855F5E90A1D00F62382969823B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817420, "uuid": "c63791f4-70a6-428d-83d2-9a37a48626c9", "value": "4a6e8d420f7acd5d98f7bfb61b4ca87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817420, "uuid": "724317a4-bf5f-4ae3-954b-9a57be6094e5", "value": "1536:NvtaBzC2JvkoQIm2AdorfVRtQq2zZ7+2aOeodOw2WnOsOu/9rF9fILtXA:NVjCvkoQImPmrfVf+t+hOTOwZDFeBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775817420, "uuid": "21ece096-30f0-4c90-9eb5-299ef9f12c8e", "value": 95712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775817420, "uuid": "e998e68f-4fee-4d23-a8a1-d7add4fff3a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817420, "uuid": "cd219be1-8cca-4a51-a5d8-2f85affea7a5", "value": "Dienstangebot_D_Sibrac_23-03-26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5eb1ef4-351a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775852453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775852453, "uuid": "1e724d44-3768-441d-aed3-29beb32292b0", "comment": "Malware payload", "value": "021ed5daa3d6a31aab6ffc2e0362ab30", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775852453, "uuid": "32fb27a0-1d2b-455a-a7bf-ffc3f02afc39", "comment": "Malware payload", "value": "8159c79c8a9b54ad363516f9b53c7cada3ea4afa0b2d0f6e7dc66fe147d03a93", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775852453, "uuid": "7f355026-a4cb-4340-8273-48d0237b63b2", "comment": "Malware payload", "value": "19e746bc10273df113167df889316c45fd6cd4cf", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775852453, "uuid": "c4631522-0ed7-49c0-8733-ec76235bc4dd", "comment": "Malware payload", "value": "68e0c74071eb71ce4e3dd37314ccaac763ce458988651e84d5195aa63a99acd686c4894ae6461901f094b08c428b9de8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775852453, "uuid": "7ddf4b19-5545-49c1-960d-c3f9263ae0dc", "value": "T1FC76125AD133B608DAFD84B2B580CF286311B5AA58278DF9603CD641B2533D73EA4B5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775852453, "uuid": "21504fdb-4515-4bba-aa34-cefe0e278f08", "value": "196608:oyXAqitAhk0tnMPAi9FGu+pDSsT3J6Ycq0paR:oywFEkKMoiPGD/J6YcjaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775852453, "uuid": "8ead7d06-5972-4101-9bf2-5522b8e299cb", "value": 7227520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775852453, "uuid": "54a93dc4-0fae-4c46-85db-9536903d863e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775852453, "uuid": "947e4679-0785-4127-8fe5-4c0c839dcde2", "value": "My Horror Domlopez 4.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1be53f1b-34f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775835417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775835417, "uuid": "4ae404b2-4134-4fde-a231-1c7aa535901c", "comment": "Malware payload (Mirai)", "value": "169457a3e60db046e2f67d5b1ecd0693", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775835417, "uuid": "cca76910-c1d0-4087-9dec-9f6325f998e9", "comment": "Malware payload (Mirai)", "value": "849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775835417, "uuid": "9e39b988-222f-4420-8902-7bd7bf5abdb7", "comment": "Malware payload (Mirai)", "value": "0fc1594c8a32aede708f1855c06ee9c9d65b02ab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775835417, "uuid": "64547043-2721-40b1-b8ce-e3d8e699ce18", "comment": "Malware payload (Mirai)", "value": "3088978ba99454f6103437494546bc8c07f9c7c0781a4379c969d72a4eaa403c0d2a617e9fd2d068a78c9cfefe000eb8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775835417, "uuid": "e6a32a1a-bad8-415f-8b9b-c1a9af6c945f", "value": "T126143B46AA408F13C4D6277AFBAF424533339B64D3DB730599286FB43B8679E4E72502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775835417, "uuid": "a1b42c39-6dd3-43b4-aa84-82770b577210", "value": "6144:ZA4V6IO2l5gP3HbHQw4DaAnjKc4VjL2Fin6M/9ZsuBwMWDM:ZFV6I+DQw4DaAnjKc4kgz/7FBwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775835417, "uuid": "28bf6901-2a4a-4240-8db4-253b29c68efd", "value": 199179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775835417, "uuid": "024d5629-9b3d-4920-9a46-9f24db7cc242", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775835417, "uuid": "6c5562f7-8599-42fb-a084-f67a9ba3c676", "value": "rebirth.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba69e90-352a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775859093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859093, "uuid": "bee3b0e8-e904-4ff9-b1e4-b457e4b516d1", "comment": "Malware payload (Mirai)", "value": "64c6964e6e8a3e9c53f6fc316a04cc90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859093, "uuid": "f2551410-3307-44d9-b92c-b3d9812358a1", "comment": "Malware payload (Mirai)", "value": "851b69004aa2c495d3361839f23c3a2e7925ee3a65b9be3019421e05d4227026", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859093, "uuid": "96ee5cfb-8c41-4ad0-8e0d-9721bf7899d9", "comment": "Malware payload (Mirai)", "value": "5beb316a68c722072ed43f80ca3143e3b2567ef6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859093, "uuid": "7eee3b78-d7f9-428a-97d1-044c7f5c2c38", "comment": "Malware payload (Mirai)", "value": "7f55ca5a32b33ca3821e646f4ed5c848d5da1c3d027d3c5c9ee12873311e2c133977ab99c4e3bc6b4a918b8984a3ef96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859093, "uuid": "ea47dd35-1772-4c0b-9226-5d2e2a6a2fc8", "value": "T199241A56B9528F11C1C115FAFF5E414D33132F78E3EE72129D24AF60678A8EB0E7A612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859093, "uuid": "297c4abb-2820-4d96-bb86-7a7e3f9f2ee2", "value": "6144:Kpbp1F5LMkeBRlIqLj9XEOgYAaayFxAhAAu/O:0p1F5wkeflIoBX/AaNFehAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775859093, "uuid": "eb2592d3-13cc-485a-8e91-a1145341cab9", "value": 218060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775859093, "uuid": "793ff151-cbaa-44b8-968c-7d406a5a40c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859093, "uuid": "0b869b1d-0ae0-4a34-907b-82e6ff0b35a2", "value": "manji.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb7ab28-3529-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775858851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775858851, "uuid": "85477128-ae59-4a42-b818-2c5a7c804f8d", "comment": "Malware payload (Mirai)", "value": "042bcaf87426d578afff79ff23072ce4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775858851, "uuid": "c875931f-c506-4cbe-82ec-54e401018234", "comment": "Malware payload (Mirai)", "value": "85dbdfc0f43dddd1082ff8aa68ed20ae988156959f3c062f986d3af13bece1bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775858851, "uuid": "c112b3b6-705a-43be-95be-e2437f658281", "comment": "Malware payload (Mirai)", "value": "b37088a5582c18304297001f3592096c9c150b66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775858851, "uuid": "d71ea481-6484-474e-9c07-191b8c235d5e", "comment": "Malware payload (Mirai)", "value": "5154eaefd637fa04bc21b37a8e6c99c67d32918dfe8ed0f4646c79d00af01d96c2c22b2d1fa30996abceaa8bc241f0ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775858851, "uuid": "12726f77-19dd-4d20-8bcd-48d6652b3a9a", "value": "T1EC241987F901DE6BF40BF27604A30C367920FB7258534E7362637A66ED252E5182BF85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775858851, "uuid": "1bc822ce-0014-4eae-96b8-3faca2500d57", "value": "3072:4T085Ad+CZnRnDFupUs9PJbZuuy2GqJcfDt5P9pv+svGVhjbipLXqA8OMH+R:zd+6RnDABbvy2/JcLthmsvBLXqAIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775858851, "uuid": "eb9ace25-1697-4f60-9cc1-64100088d953", "value": 223776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775858851, "uuid": "9b73829f-7492-441c-a46e-8c2de8022cb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775858851, "uuid": "52682c21-1a25-4030-be66-9a6a84882ba1", "value": "manji.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f993ae-34c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775817551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817551, "uuid": "bd1f38f5-2b8f-4432-afc5-47ef34354675", "comment": "Malware payload (Mirai)", "value": "20e976315b881826f10e30c2e60a1328", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817551, "uuid": "49ea9cde-f41e-4263-8980-b1d2d57b6509", "comment": "Malware payload (Mirai)", "value": "85ec1f150f40867cc9a5f4ff0f5760fa0f467183918f6837ea606b3b29f9edbf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817551, "uuid": "aea35687-f059-4f34-8306-8d4daa4a6f6a", "comment": "Malware payload (Mirai)", "value": "dae922ed424ee1cc9d1f14270c908429d542281c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817551, "uuid": "67adef67-64fc-4138-a49d-b939198949d4", "comment": "Malware payload (Mirai)", "value": "dd735e65f8aa604cf9053910c6ab6d4953866101595a6a6459f39b170b20c3bb5342307f725d53cb153901eb8f5cc059", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817551, "uuid": "6b27a60f-802f-4668-a5f7-f90d427ac38d", "value": "T12F731A46B8818A16C5D813FBFD2E018D332667F8E2DF7212DD105F6477CA92B0E67A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817551, "uuid": "8031250f-6d9e-4ca2-baab-32d3c34ca773", "value": "1536:ONn8UxkW50thqBtIC1R4/LsdH0ZBYcZvNNSVgfpnLMgiEy6uzGbd42+:AxkW0hCtIUOSqDjM8y6uzG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775817551, "uuid": "63350e8a-a69a-4e50-84b6-cc9111376bf3", "value": 75056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775817551, "uuid": "07def0a2-e600-4583-bc3f-98220bf0eb2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817551, "uuid": "b5f42dbb-3bf2-465d-826b-698330dd75e4", "value": "jew.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a5eeb7-34c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775817561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817561, "uuid": "20ebde32-c8bb-4623-a0af-1df59e706c80", "comment": "Malware payload (Mirai)", "value": "b9df9a278e8be6edeb1643630291bb67", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817561, "uuid": "613584ea-ec53-4a28-83d2-1a21d875f9c6", "comment": "Malware payload (Mirai)", "value": "8606bf2c5b1c46df441d3de4d23d4f2dd5832e621f1c3312102cfbd3026ca4be", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817561, "uuid": "9587add3-c557-486b-9024-40bfb2f9025b", "comment": "Malware payload (Mirai)", "value": "c376eaf7b9c40c94f1d49e5f2a3f46cb7ca5a6b5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817561, "uuid": "55d8f8ac-9f04-4cb1-aef7-10ef05685570", "comment": "Malware payload (Mirai)", "value": "3379302ad203d31e2b988b54a39510cc5e51f30ebb72d15ae4c458e2ca2919b684a93a3f1eb079ac17e737988298e46b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817561, "uuid": "c3a463de-0cc4-48f3-b294-b8790209d3e7", "value": "T17FD34B46FA418A13C4D513B6FAAF4149333297A4D3DB730699186FB43FC6B6E0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817561, "uuid": "8e5b7ae5-ce36-42ae-a675-c0059f00769a", "value": "3072:fVOaoBmxuVJgyrOP/oxpyaEHDokBzXTPV+84/M/9vDVdYj:f0aoBwuVJgyrO4xpyaEHcs1+8MM/97Yj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775817561, "uuid": "e75ec65c-4124-4145-9e32-19d57f99da4b", "value": 136482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775817561, "uuid": "70b45388-f0c8-4562-9edd-cfceafe7f814", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817561, "uuid": "9db8b2a5-c773-436b-94ce-22d52b10d88e", "value": "jew.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7277a6e4-3504-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775842864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775842864, "uuid": "19669c11-598a-44cb-84c8-321762682aef", "comment": "Malware payload (Mirai)", "value": "be0538534851fec09ec5fb4686423bd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775842864, "uuid": "8ef96e22-c06e-4954-a190-554dca9edda5", "comment": "Malware payload (Mirai)", "value": "8616c0e3c4329bdcd1f1410dde46f71b8571a120c9949df82f53b94ca9182d4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775842864, "uuid": "fa4602c6-7c2b-4002-a80e-291395178dbf", "comment": "Malware payload (Mirai)", "value": "7fbb9a0a15768cf44d6b0c4649875cc61ea678be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775842864, "uuid": "730e4c58-50b7-4fe8-a9b4-ec889614406e", "comment": "Malware payload (Mirai)", "value": "0a9fb5d61aeb10ec5d8bb0200b5a60781e47bea3d453330c41a994b3a4d142bb97b889e0f71af3fbbd2e56758b666e37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775842864, "uuid": "0e920d85-f0b4-431f-94cb-feccc89ef907", "value": "T109147120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775842864, "uuid": "e81d3ff7-9d0b-4dbb-9545-0ef4b36c8800", "value": "3072:IcHZcggt1NJmeDQBwnKUDMaVsb3pjr1lCRvUKG:IcY5JpMByVs9jS+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775842864, "uuid": "74ea7f6c-5070-412e-a2aa-979fc0024d20", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775842864, "uuid": "e6dc6aba-c0c2-43da-88cb-85ba6f96bf31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775842864, "uuid": "e8e6f011-d09d-4908-a7e4-a35d4049ed2a", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc7aa24-34c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775817566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817566, "uuid": "530b929b-457d-4259-a181-648f4432e8ab", "comment": "Malware payload (Mirai)", "value": "5f731822edaab2fd09929c41a268f817", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817566, "uuid": "d3c51848-aecd-4fa2-af48-c8b7d5544926", "comment": "Malware payload (Mirai)", "value": "864a182355f9898ea07ac0d30df88e3caf93c2ca29cc5880a6445878524c72d7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817566, "uuid": "9da05747-2bf5-4b11-a37f-cfa55b1162fb", "comment": "Malware payload (Mirai)", "value": "d4b33b8e28d50d8d2ca4b7f2bd0c70458e73ce39", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817566, "uuid": "c8858c5c-c188-4585-bcb3-3ad1faa25efd", "comment": "Malware payload (Mirai)", "value": "0579d70e61e1cb1fc2825e73dadf99f1234304116c0a4f4c2b5233d02e286d60a2b5b32d6a130adf41d35875fbaf6483", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817566, "uuid": "9f46b4e6-2748-4d3b-8368-be9efc8cb45a", "value": "T150438F36C47FADA8C5858238A4214A741F53F50882A7AFFA9BC187655047FFCF6483E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817566, "uuid": "93004232-54c3-4d06-8940-9ffc0099d20e", "value": "1536:L7dIsToytwtd1UGGX4WYN9F53Y7ImV1Ckod42+:L71Toytc3ZN5Y7ImV1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775817566, "uuid": "d423e3d9-58eb-402f-a8bb-840d12d3216c", "value": 55208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775817566, "uuid": "ad057ffa-a144-4e9d-9595-c4bd7af4bc3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817566, "uuid": "e29696d0-b6ff-4487-b887-bc929121fdc3", "value": "jew.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "092153ce-348a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775790288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790288, "uuid": "451a8208-cfd2-4985-83aa-b62a89eb1a08", "comment": "Malware payload (Mirai)", "value": "d694e1cc11c903409af9d776d0165f76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790288, "uuid": "60dd2fc2-21f0-44f5-9be7-775554504dfb", "comment": "Malware payload (Mirai)", "value": "867162eae09940f554a7f657c34ce969a5477e81229f43b94ae4a5dbeaace38e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790288, "uuid": "57c3e0a5-a326-4af5-af76-49dfc97d4533", "comment": "Malware payload (Mirai)", "value": "12e81e7e31328f31a663a31e1d76c6e5b8dc1f83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790288, "uuid": "05727804-ac5b-4605-b902-41f3cc15d8dd", "comment": "Malware payload (Mirai)", "value": "cb751e68b8b2581d4dae5d9b8e25e8ff9b0b6d84a6b67583698120011c0c6e19de8118039d1d05a5851e7f0d0294b05d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790288, "uuid": "c2927397-e670-4424-8d94-f428407f8740", "value": "T103E2D07D17596866DE1A80F66FB243641FBB09619993CD880642E7C3DDE8E8A3C43EC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790288, "uuid": "f30b10f1-8a68-4250-ba6b-726b62a5d780", "value": "768:I7kI6VDzaRmUEFXYLr6I+uPQvxNV1E6jiHp2/BMOjNnGJgGlzDpbuR1Jw:m608XYL+BuPQPVyyg2BM6wVJu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775790288, "uuid": "0d9921fd-59c4-49a3-b57f-d1fc67ce6a7e", "value": 32840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775790288, "uuid": "ec4d371d-b6a4-4947-910c-5b928981249d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790288, "uuid": "f989669d-9ccc-4336-8183-73313d3b8942", "value": "Clipz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904fd7c7-351f-11f1-a769-42010a9c0008", "comment": "Malware payload (N-W0rm)", "timestamp": 1775854510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775854510, "uuid": "bba987fe-794b-48fd-8a82-0f2119b2e3ef", "comment": "Malware payload (N-W0rm)", "value": "d609d5571d9715d29634ffe6e96ce350", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775854510, "uuid": "f287f274-41bc-4769-919f-043e49afbd8b", "comment": "Malware payload (N-W0rm)", "value": "887e30ad70ebf9b34f3052dd277117a36af47898320cd2fc3b95516ad976ad43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775854510, "uuid": "ef5d933b-c7eb-4c5c-8646-85692a2da221", "comment": "Malware payload (N-W0rm)", "value": "0f55499a946942716bde132eedb245196d520e65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775854510, "uuid": "febfafd7-6552-40a5-b29c-9ead5b91943a", "comment": "Malware payload (N-W0rm)", "value": "72d99a7bd48609b7d16b630a196fc37dee50d465f6599adc0dd7db3e263652966d322c03f9fd37aa0b2ee9d07d2678fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775854510, "uuid": "1f0729af-c9ce-41f1-a976-4369f4d0eedf", "value": "T136D49EABB2534E21D2442777C0DB9A4093A99B4665E3F74F318513D618473EECE0BBA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775854510, "uuid": "e1c127c8-48a7-49ab-b53b-f38e9074fbd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775854510, "uuid": "c171824d-79bc-4d85-97cb-f0f48725aec1", "value": "12288:rbd1Xe85s0MrenQffodylbIymZi7bWAgWjnAdfonU:lo0we6fo4qi7VgWrCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775854510, "uuid": "77a55c20-973c-46d2-bb48-83d621bf8c6d", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775854510, "uuid": "13d589bb-e2b8-4f60-9cc1-2e6b831183d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775854510, "uuid": "667d016c-f1a1-4cfb-b043-f0e990befdec", "value": "D609D5571D9715D29634FFE6E96CE350.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffad6ad0-351b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775852979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775852979, "uuid": "b274dfe1-97fa-4169-b55a-acee91efc5ef", "comment": "Malware payload", "value": "0d7f6693c76baceccdb744d30a5af4db", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775852979, "uuid": "72b688db-6e1c-48c4-85fa-2ec79733974e", "comment": "Malware payload", "value": "88ea80f4212a2f7fdf84461cdca2669b7a40c8fe42da20c3b52db29442048cc9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775852979, "uuid": "3b154089-b974-4629-91c9-539c72d820e2", "comment": "Malware payload", "value": "f7b7099dcefaf359326939384605da617d4ae00f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775852979, "uuid": "aeaa23c7-5aca-4cff-bab6-8a9452aa6116", "comment": "Malware payload", "value": "76f1ab124ae24475951b9bb9d9f5b55d690586286daa5120c799442caaadcd7ded321c311dba2b9ae0386d073de8d3dd", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775852979, "uuid": "4a4281e5-8bb5-4fb7-b71c-30c25ae29c2d", "value": "T1B631E76D5E114A43D80BFDBEEC6340460ACD57F822B2ABB76B1C9404C921EC58102724", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775852979, "uuid": "2459f398-5c14-467f-8fa9-5c9f818f9a03", "value": "48:9XgRnll2knqwsrQt6iMF7aIYTq0xM+15+H:xGwrwsJiM02OMjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775852979, "uuid": "75c1dd3b-1c9b-4d4d-a4da-f6da78354e21", "value": 1599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775852979, "uuid": "ebf0a3c0-2855-45f7-bb59-adaf3a6ff0cf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775852979, "uuid": "6393cfd5-dbba-44cd-8bca-2760b865a518", "value": "\u65b0\u7248\u672c\u8c46\u5305AI\u8bc8\u9a97\u8d22\u52a1\u4e00\u767e\u4e07\u7f8e\u91d1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa09855b-3489-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775790263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790263, "uuid": "d1e91a47-2a99-4181-9d30-8f7c64c3c015", "comment": "Malware payload (Mirai)", "value": "00b860df0f0b3900c23aa79b1926e008", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790263, "uuid": "e103a4a3-de2c-4bee-b71a-a24ab7b8afb5", "comment": "Malware payload (Mirai)", "value": "8a9617817b4fb8ab8c31c7e9c6803eacfb51c5daecf05b56d87f6190eed50df4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790263, "uuid": "2e793bc8-f86b-44e5-bdb4-c5cb45f89767", "comment": "Malware payload (Mirai)", "value": "36e10fc53fdbafd84281eda43d8f632cdb56fa88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790263, "uuid": "ef80f11f-6044-4f33-a22a-c7a884d04e3b", "comment": "Malware payload (Mirai)", "value": "3d23b0f6c63a4e4fc9571c8f72891c14270e7655ef8d43df151b6c1010fa8bb35f02662eaa188b4ddb7f0d10225a3032", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790263, "uuid": "5f3165c9-1a50-4c57-86dc-f5fb187c6b8d", "value": "T1AAE2D09D95396489CF9EECB55A4E1BB403C4F020729F9ACA3B1059CCDF06A8F7A4D1B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790263, "uuid": "66a2ec75-24ff-4ab3-ba1e-c44f6c36ea9e", "value": "768:r55rKXkS+rX+Z2IBB4Z/J7Fc0KkDMyQvWF:PuG+D4ZBRcKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775790263, "uuid": "2c4fd757-2808-40d3-a98b-6da74fc24d12", "value": 33116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775790263, "uuid": "4e8c27d0-7f24-4170-9c7d-2ff11b3acd24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790263, "uuid": "30acd2b9-0cf8-4a6b-8c06-a783e884333b", "value": "Clipz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038e63f4-348a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775790279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790279, "uuid": "5f2e30d3-0ded-4204-89c6-dfe3df70da23", "comment": "Malware payload (Mirai)", "value": "31e2854b483fc0213d1fb39fc80652b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790279, "uuid": "dda3e0ae-7aae-4c67-be2c-733805ee83e0", "comment": "Malware payload (Mirai)", "value": "8accc804c3cb20a869cba5bbf194fbc9ed7ae12b5d067531b1dda74685ddac97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790279, "uuid": "460906c8-5efb-4550-afe6-7bb201f11617", "comment": "Malware payload (Mirai)", "value": "42470fe7915116b880b510ac13c8062a4fae31c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790279, "uuid": "b86342ee-ba14-4a26-b2b9-9083ea36a61a", "comment": "Malware payload (Mirai)", "value": "ed617d1a871f07b844702decd1bbeb754e79312c4a4064bdc39adb63bd4ba6cf129b7635901f18b4707658848ef577ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790279, "uuid": "77582a75-e5f5-4371-b3ea-abc490bc3396", "value": "T127F2F120EA960599D7746E76EEEC86CD851E473CECBE21712146686DA9F03043FF384A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790279, "uuid": "f9c79bb3-959a-46ce-b65f-fe52277a41fe", "value": "768:TXp8M+iXQaynkvVqmrEWeCQbrg1Eo49fvh1cjCH/VK+Il2k6bw35u9q3UELi:iM1XQaykvV9r7ea94h5ztK+IlN6mLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775790279, "uuid": "9e233d0b-86dd-4641-b44e-d67cecb297e6", "value": 35504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775790279, "uuid": "48e3682c-3e5a-4a3c-9ea7-96829c88ccf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790279, "uuid": "09180569-2ccc-42e1-abe0-7c422dea7bbc", "value": "Clipz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83abc1d6-34c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775817552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817552, "uuid": "bece204c-eb1f-4be1-8865-4f9a3e18ba29", "comment": "Malware payload (Mirai)", "value": "bafc345f79740db8a32e89694653e7e7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817552, "uuid": "4c76e227-9d31-43ac-87a2-6e3e6fbd0b6c", "comment": "Malware payload (Mirai)", "value": "8c4bc1a1a43aed0f5de430760b5ceee191b643af915ab499fe3d8ca1064e7e78", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817552, "uuid": "b625225b-3e0c-4513-913d-c23e97205a28", "comment": "Malware payload (Mirai)", "value": "4221669640b36966c30ecdc8f46b302a54cd7339", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817552, "uuid": "fbb9a10e-13f7-426b-a801-e723072a184a", "comment": "Malware payload (Mirai)", "value": "48dc9a8d3476bc78759711aa550d0af54d60ee6a883843af69b94e483a03b1b71db6d68f88023a6b93c33013371acf77", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817552, "uuid": "6beeb299-3347-4f50-a6a5-79a6c6bf395e", "value": "T14853E64178819A17C5E422BBFA6E018D373563F8D1DF3216CD226F6476C982F0DA7B92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817552, "uuid": "ce49a170-7884-4a31-b4f0-86d3161e9eb7", "value": "1536:1PdIMPcUTCRfRpbY20ybvLzi+lG9Wcq8tJtZVd42+:1PP14AeziKG9bqsJtZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775817552, "uuid": "9082a64a-0d43-480a-a479-2738cfbb8c17", "value": 64456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775817552, "uuid": "0d3a6336-3f15-494a-88d2-727c010dd4b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817552, "uuid": "c8980b55-a4cc-4df9-be99-945fc33a0e4a", "value": "jew.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5177df9-34fb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775839137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775839137, "uuid": "cd517af5-066e-46cf-82ca-b3d8f90c50a6", "comment": "Malware payload (Mirai)", "value": "51e467c0916048fbbe9cd496237e7f57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775839137, "uuid": "e7c68883-bf6f-4886-8b2b-1e078499bbd7", "comment": "Malware payload (Mirai)", "value": "8c807c97aca5c9798ee57af6276220e1d2dd8a866784b33597042acadd222dd9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775839137, "uuid": "03e3bbbc-50db-4d3d-9c30-52d636e35116", "comment": "Malware payload (Mirai)", "value": "42979179faf341d2aa0e1df0d7b525971b36830f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775839137, "uuid": "ebd82bce-f53d-4cf2-8ae7-5c3a2c1edfb0", "comment": "Malware payload (Mirai)", "value": "c420de2cfe900ba5df45c7829eecbb97829147a02dfaa7eebbcd2af47af2c71efb8bb32eab0b5d16624d6513f5afa4c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775839137, "uuid": "4c7a7f6f-495b-4a53-aa70-c83cc4854197", "value": "T14F6302CF7E703F17C0D8E1B530381999C83A9DCAE2938A5C97E1A7954739432608CB1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775839137, "uuid": "9404c0fd-6477-4bec-82a3-b89635a598b1", "value": "1536:kaxZLmYKVDNSl2y08yumeJyGYVmIMGnTXIGN9:kaxZLmYKX+t08jmeJhYTDBN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775839137, "uuid": "be054276-0d64-49e0-927e-1dc0a9f44e87", "value": 70460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775839137, "uuid": "23f6f32d-b250-4bff-8a62-6bbec2fad128", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775839137, "uuid": "178e4fcc-12bf-41d3-8b4e-63bffa84270b", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d1aca98-352a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775859095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859095, "uuid": "ff3ce0d7-3448-4f32-bf23-5d14d6be8516", "comment": "Malware payload (Mirai)", "value": "3ac73fe5e2e88bedecc3e144dba04ed6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859095, "uuid": "353c5e6b-b5af-4090-83e7-648d6b04be85", "comment": "Malware payload (Mirai)", "value": "8cb0ebe8ad767bd8ead638db9d2135c4ef9f963ca4c180ec4e25b85dc065e799", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859095, "uuid": "7cc935b0-5200-485b-810a-eb4dc87420f3", "comment": "Malware payload (Mirai)", "value": "9b9f464267c3dc65d874673e59f7981fe285e9b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859095, "uuid": "02211a10-bad0-42dc-8ee3-5c94ba08a6fb", "comment": "Malware payload (Mirai)", "value": "2efdb501ef512cf6c27dae9d31145078aaa0cc2808c3db2c9a4b87a9aadfad5879acd8d25b62fa7334de5f2db84c1332", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859095, "uuid": "532d5b10-3a63-4882-8e2c-7bcee91922a4", "value": "T11654B6056B218FF7C8AFDD3706F94B1524CCB85721A43B3A7670DA5CB90A58B09D39B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859095, "uuid": "b21d3818-ae5c-4fd6-8e3f-4f427ebf9c99", "value": "6144:Z3EPzeIMU8Ive9cucgLiq/th+rtnmN/0f:UeCucMBtumNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775859095, "uuid": "a02b713b-5cb2-4056-8943-c6c79ec29bd6", "value": 299652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775859095, "uuid": "b479956e-4e93-4602-a44c-4adc5f961dda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859095, "uuid": "a197eccf-953d-429d-bfcc-fbac8854e407", "value": "manji.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "849b15ad-34c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775817554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817554, "uuid": "5315b874-3f6e-4569-99f8-9d2461490433", "comment": "Malware payload (Mirai)", "value": "9fc84da414c57f654f7529d34873960d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817554, "uuid": "450285c1-f9f7-4419-9232-a09660c36fc2", "comment": "Malware payload (Mirai)", "value": "8e7cb7fe8db99082ed0b5d5247ad35333d319a85e9879e0e35eac8d7b95d798d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817554, "uuid": "87e38b10-2943-4a0c-88cd-6f72d5e24360", "comment": "Malware payload (Mirai)", "value": "dbc68ee854c6b3b60fce9c308ad57611b88c408f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817554, "uuid": "4873c6a1-9140-4830-905a-c0435c2da2dc", "comment": "Malware payload (Mirai)", "value": "cba281b9972356f57f4770d8d3ac86aa27d6333524dca05487a37ac7407c6c8125d70aa797b83e850eb6201419c7fa71", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817554, "uuid": "86a351da-913f-4e09-ad35-36b2e61770ea", "value": "T1AA434B03332C0E17D9A21EB0253F06E093BFF95126E5B68A254FDB664639E761182F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817554, "uuid": "ea91196a-6a68-4c4a-ba67-b28883f40ad9", "value": "1536:Jt1JILhthQ+1r4atGKCjBTIdWtGqEd42+o/:Jufh/wDIdOGfr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775817554, "uuid": "46a0eb8c-0126-4205-b89c-a05fda4c191a", "value": 60040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775817554, "uuid": "1ed6bd72-a778-40eb-a0d4-5adceec15b86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817554, "uuid": "522e96dd-613f-45f1-bb9d-9da744cbe813", "value": "jew.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e2dd42-34c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775817549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817549, "uuid": "ed755449-ef06-4aa7-9f96-650f5a15d91b", "comment": "Malware payload (Mirai)", "value": "3f69acdabe1b8f1e0142b9ce3c288c1a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817549, "uuid": "1b0cb82f-a63b-490d-af6d-66aade8a2ff3", "comment": "Malware payload (Mirai)", "value": "8ef72a2df2a4d8a90e1bf300586b26057f1adf4baa367def2e9ed53d391cad8d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817549, "uuid": "1a1f66f1-313d-4ee6-b70a-9a0349eb846c", "comment": "Malware payload (Mirai)", "value": "f25b0f57677e94a3dca465e0575d7162ce2affe0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817549, "uuid": "74a0c395-2b0a-42b4-b67f-2bb0c00a3eb4", "comment": "Malware payload (Mirai)", "value": "b1d836f78fcf280fd9247a37710c3b0294d6030da01813d682636d28e54f6c17ce8c378e88afa0fc86fe2deed3486683", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817549, "uuid": "674644b0-a964-41f4-898a-a5ac9aaf5c0a", "value": "T1F443C552B8815A2BC1E423BBEA6E518D3371B3F8D1DB3616CC111B2477C952F1EA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817549, "uuid": "e3b98ff7-c716-479a-a362-ff036365bddc", "value": "1536:rL/BMZOlXxfoYfi0p25+DfaerBkeSNld2lG9WkQxud42+:pMZ2mFkfae+eS/dyG9/Qw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775817549, "uuid": "b8c40663-46e9-4b66-aec3-91e27d9ac7a6", "value": 55608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775817549, "uuid": "b7640971-0009-4f0f-9af8-28aab0069721", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817549, "uuid": "10ef20bc-533d-4f93-a96b-f5f94bfbf008", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec185173-34fb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775839202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775839202, "uuid": "825cf26b-9cbc-4b3d-b1df-51275f974fa0", "comment": "Malware payload", "value": "7303113c03f562ab24608461c1c27f4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NovaShadow", "colour": "#69E761", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775839202, "uuid": "b205f082-1393-4e9a-8917-b560a47930c3", "comment": "Malware payload", "value": "90365f2b76c3a4b667e6497f1c975420c917ab2441334d8e3e276ef206e52778", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NovaShadow", "colour": "#69E761", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775839202, "uuid": "92da9930-f62e-4b12-a044-d53f3888d5a2", "comment": "Malware payload", "value": "f2e9d1c995c635b08a7f662caf620c881e500b07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NovaShadow", "colour": "#69E761", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775839202, "uuid": "200ec3b4-6128-4dee-a6c9-a6fa5f9a22b2", "comment": "Malware payload", "value": "31cc378fe135a72b894e16bf91c7dbf75a25cb093bdad8004eac9439f32d8b8619a6bbd40d748557818e8447cd667fdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NovaShadow", "colour": "#69E761", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775839202, "uuid": "9278ef62-d7b1-4177-bc90-e4739deae483", "value": "T1811833D2865579D3E44EFAB494D5BA262D9BD1804D322CE86F8F305D0D28E10BE2C6F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775839202, "uuid": "39571f08-0edb-41e9-a875-8de7ad6f2f82", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775839202, "uuid": "c13b1185-3c0d-402d-b1bc-666455b5eb21", "value": "1572864:h4gPXMo9nWjWSV3AHyU9mxR074Lp2cUpJ42UhXJcsqA00F8/2ZQW2xT7:h4AcVCSV3khmPK344fA0+8/oWT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775839202, "uuid": "ac56ae44-9d3a-42f7-8ea6-ac7f501cad69", "value": 90230344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775839202, "uuid": "b93dc250-9691-4e2a-93bd-bf19fdd6a484", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775839202, "uuid": "f9db34e4-1bae-4138-8312-2d93da02edb3", "value": "dezed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc89f18-34a7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775803099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775803099, "uuid": "d1a742cc-b848-4483-ad98-55923c5fd288", "comment": "Malware payload", "value": "eaa71d70f797a4207fe32278731cb693", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775803099, "uuid": "07558593-21b7-4666-9872-f80c777bbb6d", "comment": "Malware payload", "value": "930de81fcc908d132279595cd9e23416116a5066f95509f49f586fc049fda534", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775803099, "uuid": "33ab1786-f340-44c1-b0cd-6823063069c1", "comment": "Malware payload", "value": "20afb44f647152ecffd3630e3ba39987904cd651", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775803099, "uuid": "11d4bf93-fbd0-4336-b54d-24a9c74ff9c1", "comment": "Malware payload", "value": "47eb30f5618a4cc7c5beaa24e1ca242e01e4f48dc833c7aad5b812d50a5e1cd03758b58b324c0fb48d1d1cbfe77fa39b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775803099, "uuid": "13dd2947-b05f-434b-b60f-c3a028e9ecd1", "value": "T124165B9EBABE53A9C5A7C1B0A7B38196E1317C019B3056CF2384735C26735F09DA72D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775803099, "uuid": "a54db43c-ed39-4d8c-a5ac-b8d1d519a049", "value": "baff4071a279938b756ddd24226c0da5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775803099, "uuid": "9ffd6458-c289-406b-a6ee-7e585e761d75", "value": "49152:HE2xEp5CjVFKejRrmM0jVN9EaOurQUxYkSSW0IbbJsv6tWKFdu9CPPTvG7JvpHF+:HOeZG7HRQJsv6tWKFdu9CPiW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775803099, "uuid": "292093fe-75db-419f-911a-0295b306b588", "value": 4193792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775803099, "uuid": "a9debefd-3b9b-444e-bcd6-75d6e2f352b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775803099, "uuid": "74182cb7-f50c-4078-871a-aba5295ac68b", "value": "2026\u5e74\u7b2c\u4e00\u5b63\u5ea6\u5185\u804c\u4eba\u5458\u8fdd\u7eaa\u540d\u5355\u4fe1\u606f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a51201-348e-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1775792349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775792349, "uuid": "3ac4c98e-8eb0-42b9-9b57-ef0c60bdbd31", "comment": "Malware payload (Smoke Loader)", "value": "5d18521ccf2e9f59114af48655c73e0a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775792349, "uuid": "d10378a5-1d3f-4c6f-8a1c-606ff1c23679", "comment": "Malware payload (Smoke Loader)", "value": "945f2d74612eaddf2998f63f9cb2905a9f2dd6d7e8e524f88d729dcabdcf1449", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775792349, "uuid": "7c52a4ed-e82e-42d6-a380-19460a2caa19", "comment": "Malware payload (Smoke Loader)", "value": "029a23c26a8e3921e0ef2e224f67cb57837602c6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775792349, "uuid": "ce8a2da2-d174-41c7-892b-ae3454ca3f78", "comment": "Malware payload (Smoke Loader)", "value": "5d6c457bf27043d04e89b6ed7bcdd8dc5f98ef0ce144bccd591f0555d38b212ba32ad2986f46e012b83d84117b248dd1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775792349, "uuid": "4c7267cd-d3a2-40db-a7b8-662ed3b09d55", "value": "T108A57C0B7C9149FAC45AA7368CB652917B74B8490B3233D32E91BA783FB27E05E35744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775792349, "uuid": "d9e146e7-24b5-427c-8b16-bbf71a78d0de", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775792349, "uuid": "07972e11-ccb0-40ac-9185-08ea644859f4", "value": "24576:v3VQMXdeMiy0L2YlfDbTjRmh7606aI+Y5NFhheleh29mhP2C1IRMB:vKMNZi52YlfvTjoh7UZ+mqs53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775792349, "uuid": "8a283157-de50-4a4b-85a0-3aeb032363f8", "value": 2189016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775792349, "uuid": "770b5882-70da-4125-aa6f-e05f461381b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775792349, "uuid": "d0a1974a-a619-4a95-bad2-e3c07bc5d428", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b402b2-3494-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775794817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775794817, "uuid": "515360d9-afc7-4938-bf6c-6856bc922e0a", "comment": "Malware payload", "value": "5e4f0f2771852e0a140b5556d6ae20e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775794817, "uuid": "ccbae752-fa5e-477a-9c3f-ae4a191b362e", "comment": "Malware payload", "value": "94714281345e7a8502f05edc3f192bb7889702a5cb2b31adcbae49e5d59c7b8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775794817, "uuid": "b92a0f6c-f550-4904-bbd6-fbadab7bd1a9", "comment": "Malware payload", "value": "9de3a539d00a7e7dcd691a68a03fb020ee9fbcfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775794817, "uuid": "855e49eb-7b75-455b-9937-1eb8eab9e91c", "comment": "Malware payload", "value": "8cc65cce56c0318dc03ebb5613b2da2a704e1e74d76f067e6889ea39781dab2b3304891ed94c3c1d058cdaad2271bcd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775794817, "uuid": "baa21c97-e7d6-4018-b403-95e708662c61", "value": "T125942322FB1FFB1E9085FDB56DADE54931876BEA361180C4C8485650CEDE0F874937A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775794817, "uuid": "b387b249-efbd-4aa1-9ab6-0bec808731b0", "value": "12288:113U7YbhHeF3wtTTIirjgyw41yJHEa5RuyD:3BeFAlTIojJwjmaDDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775794817, "uuid": "c91ddd2a-821b-4848-8f13-d50d395e4099", "value": 414042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775794817, "uuid": "b077df04-43ac-4dd3-87db-c6e8e5d976dd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775794817, "uuid": "c799db8e-b4a2-44e4-8a41-e3e5296d4817", "value": "Employee_Survey_Report_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42beda56-348a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775790385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790385, "uuid": "09d57675-cb26-4ee8-bf4b-0823d625d37a", "comment": "Malware payload (Mirai)", "value": "4e498d5be360cf4cbe607f6eaedf078e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790385, "uuid": "870d69f0-049c-49b0-a97f-b4f4483879ae", "comment": "Malware payload (Mirai)", "value": "94be9ec6180ba8f1dbc32d4a020da011a18aeb2fc7f7628bf9f53e5a3e620800", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790385, "uuid": "2489bbc6-81fe-42bf-99df-cbc4a4248724", "comment": "Malware payload (Mirai)", "value": "7d3ba0742d42aea9073142077aa9c51bfaa56890", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790385, "uuid": "f7585641-d550-4d40-81a6-fe2e32c4a842", "comment": "Malware payload (Mirai)", "value": "53c21d901a6240b6d089fb608e70ad364b9d420963f25b3eb76d78b999b5e5bae8b2030720d825fb13f442d2cf758354", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790385, "uuid": "7b60c3d3-dc54-4798-b253-453ced836ba9", "value": "T1B6035B4AE757D0F0ED071A71012FA77E8735DE215060DEABEB94BE61DC32B12A11A36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790385, "uuid": "08185109-815a-4086-bfe0-1df33152727a", "value": "768:cvH5GkQWPSeQD6DcjjH72qf3cF/tTZOlrordqzFE:yHTQWPSeYD7nf3cFcroRqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775790385, "uuid": "15595f9f-4057-426b-be2f-5566b5c069c5", "value": 38956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775790385, "uuid": "37e47884-7cc8-45a9-af0b-1afb7450fc6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790385, "uuid": "4ea32f16-6a47-4672-9f2d-ec3431eae3f5", "value": "Clipz.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf423847-351a-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyNote)", "timestamp": 1775852468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775852468, "uuid": "c50ccda3-7918-450d-9c3b-86c4525ddab6", "comment": "Malware payload (SpyNote)", "value": "15586b49f0b265d6892c48d63f0c52a1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775852468, "uuid": "f2e5694b-96f3-43bd-b2ef-9881321b7129", "comment": "Malware payload (SpyNote)", "value": "97936d7873348f905d119dd9399261374aae494296e1b5fb3df521ef3cc76405", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775852468, "uuid": "eece17e2-f1ab-43df-8ec5-ef0d95ce1d78", "comment": "Malware payload (SpyNote)", "value": "a7c67dc6a18824de9f587e10dbbf97b1f335696e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775852468, "uuid": "2ffc395d-967d-4a3e-af4f-a135106dbfbe", "comment": "Malware payload (SpyNote)", "value": "31ab36f97097f9aeeb7f4b981573ceb618bae1b5e90466263f18a7dc2a20570a20a3e41b02e51bb2b37e0d8c73380122", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775852468, "uuid": "53ec23e8-ace7-46f5-9dd2-34f1b6543a06", "value": "T116360203FB45CA97D8AA83F66F230DA91E170F64C642A7E34461762E2D776C14DC6ACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775852468, "uuid": "258f935d-8a2a-4db1-ba67-14ac2939e44c", "value": "98304:pbKJrrUAtAnjU5cYoO+NamzlzBkTf0tAX4Ucbd4UcbW+lS:xDkAnjGqpNVzYQ3bcbW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775852468, "uuid": "3ed70d34-791d-4b7d-ae6a-0fb41802962b", "value": 5168602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775852468, "uuid": "609bdc96-2cad-49fa-b68e-b80cbc0c487c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775852468, "uuid": "c56dbfc6-0f6c-4ee4-94ca-173df81e8c97", "value": "Standoff.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa9dc2e-352d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775860549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775860549, "uuid": "ccc30cde-c797-4de8-9b5f-93484cb7e30b", "comment": "Malware payload", "value": "a281bb62f53dcd1fa5984092851d3a72", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775860549, "uuid": "905e1a16-46b0-43d2-ab0e-f5e8db633496", "comment": "Malware payload", "value": "98d85d87282852dc67a634b698d5a5e7e9794e395ca44d7bbc23d3847364b689", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775860549, "uuid": "75d76379-1ede-4738-829b-8589dfb8ee94", "comment": "Malware payload", "value": "27e67ab6433112d3cae5417e09331085ac8b09d0", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775860549, "uuid": "bf542c02-07ae-4c96-8480-7169ee375068", "comment": "Malware payload", "value": "5c73d59d8e307c44599f01ed57227e449579439afe55ef87fe49495bf90f96e6a5661f4f4791d2aac99065fe51091b5b", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775860549, "uuid": "da12b2dc-2d8b-44be-b952-d61b40b4bcf6", "value": "T10D048A884DCA88E49B1F2568150F5C479E8D9227531DCCD2BFEE9F843F116B639AE6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775860549, "uuid": "16b539ae-39c4-4250-bcf6-e007b4e74ee5", "value": "1536:wTiG/8FstiMBrroHfCEVsxzbKfmBjNp4jIWTGUU7LN9kWkhMO:4FystiMBUUzbKHGUSLNuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775860549, "uuid": "11fc6dc7-9169-41a8-b68b-1aa1dbc9528f", "value": 177064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775860549, "uuid": "2d32be90-1631-4969-b1bc-da0f188a95d9", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775860549, "uuid": "38003c62-f720-4abd-a341-b37cbcdfddde", "value": "Local_Release_New_2735.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2beef38a-34fa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775838450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775838450, "uuid": "ce6217e0-13f4-42d8-b955-3c08a127c8d7", "comment": "Malware payload", "value": "31d98a773fd4f9473be9736f514e8571", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775838450, "uuid": "72294f1c-19d5-4329-ba09-a361387209b7", "comment": "Malware payload", "value": "9a2f37e6c1289b2619c6bdb2ccdf56d681183692419d82a6eee962c321233f7a", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775838450, "uuid": "ac5fc836-5e90-4734-b709-e901cb9e1e48", "comment": "Malware payload", "value": "b7692d40c7c3a46f609ca11ba8a9af448b888e30", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775838450, "uuid": "f1f3fcee-5513-4887-9c64-011bfe2830a2", "comment": "Malware payload", "value": "12063e0882cf9173d42986edeb11f899c9ba6faf9e8ff43b1caad87ed5df7094615a31f198b60df89612e81067d04eb4", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775838450, "uuid": "f77afbf9-d91c-4ccf-a6e1-62a6e5d75c22", "value": "T15936284265C74CE5D896A77C9E93E230A334BD22FAAB5B1B5604F5201D732F16F1ABC0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775838450, "uuid": "31d216fd-39fe-4996-9d01-68b9dcee8259", "value": "8b4d0760d426c9138154c52a7dcc4339", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775838450, "uuid": "bd243a69-88f3-46bc-ae3e-efcc7db7ae25", "value": "98304:R7iILCzY1GTaScIWScIWdHVEpNq5hoapOUo/WxET:R7VLC81GWkW5VE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775838450, "uuid": "cb5c33c1-3d21-43f3-90b5-f6367d068b96", "value": 5338322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775838450, "uuid": "7a808470-79e6-4736-be45-90175742d285", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775838450, "uuid": "acc66bf9-4010-455b-810f-6702bbc8e282", "value": "\u70b9\u51fb\u5b89\u88c5\u4e2d\u6587\u8bed\u8a00\u5305 (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd3381c-34f8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775837571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837571, "uuid": "2322f892-4f90-4686-9759-aebb07ebc29c", "comment": "Malware payload", "value": "6eb2d412e365f7bb8c10b59dc2195bab", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837571, "uuid": "c1bcebea-eec0-4245-bc33-3d84459c9c90", "comment": "Malware payload", "value": "9a39e48020332d07da064df5bb2499f041de178b8f2380a79a6a40756184b36d", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837571, "uuid": "fc35b04b-4f22-4717-ac4e-b97b26117df0", "comment": "Malware payload", "value": "23168db46a50a6b184b8b809c74e1d2f9e081cb3", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837571, "uuid": "cf35e911-0147-4cb9-9ef3-eccd20483203", "comment": "Malware payload", "value": "924b444782146feb17c80ddd51aba79968fc67f2f369b55dd4ce9ee52941450c35d0d98913279914ee3b32da19c67bfd", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775837571, "uuid": "d09076e9-cc63-4d63-aada-f34fe5f264a3", "value": "T1DF1633158167C8B3D8B50B75DE29A2845B1F2FC22E3D94947C89ACAE8B37BC4501E7D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775837571, "uuid": "e960b37c-542f-4d3b-b02a-33e2267209c8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775837571, "uuid": "3e835319-c602-4d31-a721-d96315f5b56f", "value": "98304:NHlVH8EHYInU5mhQzd5BDazUGhS4G0PmQwHhhOmreP48uzvP5Lb3i2eWbi:bVHbHYInUkCDiUGRGtQwHhzrMXUvPdmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775837571, "uuid": "3d321c00-b5aa-4800-a20d-95687ece5f80", "value": 4404071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775837571, "uuid": "90a5dfba-105f-4952-890d-0de315a2e727", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775837571, "uuid": "323e113c-2109-40d1-a755-b0fec6fc3ed5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "023b7e36-34f9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775837951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837951, "uuid": "a63ba4f1-5e56-43d9-8592-4c740965a4dc", "comment": "Malware payload", "value": "5c4813cd5b61af04b5833997ad9350a4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837951, "uuid": "b4cc6513-d6d8-452a-8cce-0ae246f5a3ae", "comment": "Malware payload", "value": "9aff583b812a3979394ffcd23f616d561a0eda4002f2e2a4b42ea5ba3efdbfaf", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837951, "uuid": "790feff4-10ed-46fe-9e6a-44339919bf19", "comment": "Malware payload", "value": "2e41caaa2d0e05f1031789fa3ae2e463a04b2889", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837951, "uuid": "b3b14812-8d9a-40b9-ac61-0c0e0411d9c7", "comment": "Malware payload", "value": "218b955f73f0faff5013867e820cdde593b9b7f2f1d8d14edba45b2871d7b3c5bb7e1e8f8a42c879fe521c3c8f1351ac", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775837951, "uuid": "3125b0f4-cbc7-4f66-bb68-7d08b5d50ee0", "value": "T171D50155FB999F1EC8F353360D396636547AE823C713C383D9692678288BAF00F452E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775837951, "uuid": "d02cd756-8ed9-4581-91aa-304713bd4e51", "value": "49152:zkrm/jqGFBwKve9RiBf4MgqHwUXIZbhsqZyg9C6BbO+buLDSI5sF9CcYD:zkrm75TgAAMgqHw48ONg9NbOW7DYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775837951, "uuid": "123811f7-eef3-4dd8-83c6-64e4a72da244", "value": 2995727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775837951, "uuid": "21a307f6-f897-47df-ace3-9d458b6438c6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775837951, "uuid": "8ee95a7a-72ed-4673-b533-7d4c2fc08c06", "value": "sagawa(3).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "248cd7fc-34f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775835432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775835432, "uuid": "c6a0b0c3-b826-4777-ab3a-9c0c96e55dd9", "comment": "Malware payload (Mirai)", "value": "04d0bab2c1bb225639e74eddbe9d03ed", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775835432, "uuid": "692a7b4f-9117-4cfc-a7cf-91be689d0414", "comment": "Malware payload (Mirai)", "value": "9ea665fe5d5d4c705d31d81918bccdec8038257fa316aaa10a97995c0e4d2c99", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775835432, "uuid": "98e24b9b-f3a3-4df6-ab19-87e7e67e0cdc", "comment": "Malware payload (Mirai)", "value": "8f2ddb27b5d5b1c0f291132fd81d895c7221b39f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775835432, "uuid": "140950ce-6bc0-47e1-8166-5e516b785963", "comment": "Malware payload (Mirai)", "value": "3448df893e9e7888b68805fb48572fa3cbead272dc86161f82402b0eb2afa86156338ec0679d6d5a4e01f868c6321c82", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775835432, "uuid": "42006ae7-1ded-4429-89be-119c6333c50e", "value": "T114F30945BC918F26C6D622BBFB5E028D372617A8D3EE3103DD255F25378A95B0E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775835432, "uuid": "0f256ea1-0e92-472d-976b-94e67e74b248", "value": "3072:zrMr/q3J46RUTRqdVjqtMWrMLQT4+Ppb+a0mLk3Wan7:zIrk6EHgzH4za0d3Wa7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775835432, "uuid": "60cf3582-2cec-4b4c-87d5-2d01b7e2fee8", "value": 162560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775835432, "uuid": "a425d4d3-fc7c-42ce-ac4e-e44e550b4ea2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775835432, "uuid": "b601f8dc-2297-4a24-97de-0b406d0ea96c", "value": "rebirth.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "225fb7f5-34b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775810088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775810088, "uuid": "3e3ae4e4-5704-4029-b4e3-2e7197c200cc", "comment": "Malware payload", "value": "22fd93a58cf0ee42bc2c84300b0350bd", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775810088, "uuid": "0cf3d437-4dbf-496f-936d-c76db3fb1ab9", "comment": "Malware payload", "value": "9f4d63ca2e5a6e855d740bc351588256bb6951100384719929dec01ac4584008", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775810088, "uuid": "5932e916-528c-4c64-aeb8-819547feb6ea", "comment": "Malware payload", "value": "e5104381686121fbfd1dc0219a95051ba4d7c246", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775810088, "uuid": "d99e8ec6-f22a-4c01-8d9b-2f252323c8a2", "comment": "Malware payload", "value": "5b4c2b66c0d5c9cdce71c2987d3a6d2b97422e1e629149979ba2820e746c9e6695d23de747d4e3c47514117a57286467", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775810088, "uuid": "342dd713-1d38-427d-b824-345bf5d00143", "value": "T10487124BF70CE81FDCB3B0B8DD9E015236536D89A2424BB76911F2286EB35C59E0A7C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775810088, "uuid": "dec2330a-8bcf-4165-a1fc-0957054c6ffe", "value": "786432:xUV8qS7coMwD7RGlPID2HarzfHzvjk93Tvck3ZSg0F:OwbND7RG9IhHv4Ukf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775810088, "uuid": "1daa0e0e-1066-4e70-b81a-bff7c55eba38", "value": 38942694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775810088, "uuid": "edc47117-c523-4874-9bab-81c98ea5b3a4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775810088, "uuid": "ec984219-7588-49f3-9aa6-0812092f2704", "value": "Pure+Messages_1.12.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4f63a12-3520-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775855028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775855028, "uuid": "e4089714-89db-4a1b-949c-fcd50f14dd59", "comment": "Malware payload (ConnectWise)", "value": "c1a6adc81a3ab214d1553179db1120c6", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775855028, "uuid": "f01d9713-cc7e-455f-b355-aabeddbcabff", "comment": "Malware payload (ConnectWise)", "value": "a038efc2f02a66df78b90d2263b74601c26cb26d3df5dc90f5cfac7eb9ee25ee", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775855028, "uuid": "6369c67c-a72a-49fb-8097-ddbb1c219088", "comment": "Malware payload (ConnectWise)", "value": "3133438ced9acddb3a3af04e624ec73783a3c8fc", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775855028, "uuid": "8338fc99-727e-473a-8606-98a245c6d3de", "comment": "Malware payload (ConnectWise)", "value": "2f6ee4973caf6a783c6bea0bb92073b6b4aa8d49a55cfbc14a301e996a16445d52f9feabf82626517904e01c6cdc5e90", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775855028, "uuid": "2ad790be-b6a7-44af-9e7b-6c58d7762f57", "value": "T1E9D6233267FD0918E1F36778ED3991E291367CA59F12D08F2610786E6871E8097A373B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775855028, "uuid": "035408ed-d4e7-4bdf-9e76-eb71fe5e738c", "value": "196608:ZrnLYG3zuhukOMrnLYG3zmrnLYG3zcrnLYG3zVrnLYG3zWrnLYG3zSrnLYG3zP:ZbDDugvMbDDmbDDcbDDVbDDWbDDSbDDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775855028, "uuid": "1b35c9e0-9363-428c-ba17-ee646da42702", "value": 13533184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775855028, "uuid": "cb55cf6f-60af-4b3d-926f-12b9a8015020", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775855028, "uuid": "43e7b6d8-f099-47ab-997e-3e1dffa355ee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97616729-34af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775806418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775806418, "uuid": "0ed01b0b-f676-40e6-b5f1-6a1e21f12bf1", "comment": "Malware payload", "value": "de04b253aa7ab49e0756f87d0687e2f5", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775806418, "uuid": "e1eb636d-785b-4427-b6ad-6e569c4a2b33", "comment": "Malware payload", "value": "a061ccffe0c986d0ecfe0147b5097df8df189b9667f0b63d19a96485ce751c21", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775806418, "uuid": "e633375b-c80a-40be-b767-d4e1f70adc5d", "comment": "Malware payload", "value": "b41b774b70c03938094abb45e13dac495a6dbb2a", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775806418, "uuid": "43140fd7-dd5d-498f-8732-c27731dfd8f3", "comment": "Malware payload", "value": "52c35cdad0543b8a12b2facdce1f5f48524dcd0c1c2c13520b88c1a6435d65caa24f9f5e7b3480b3838300f046fbad20", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775806418, "uuid": "33049602-b976-4966-9d06-6074802dfec7", "value": "T1DE14D733DB6284B9C4AFD1B0ABC6E5A27571BC194274B11E4F804B217F0BF60AF6D685", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775806418, "uuid": "0ae26d94-573d-4c51-8b51-e9afec3f9d36", "value": "fb3237bad2e3a80d9e1f2968c22a2d78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775806418, "uuid": "c511c2cc-0ce8-4156-8735-9dc3a1e3da4c", "value": "3072:9elDJutlyx8mpe3FyQmVQiMmY24YFZx6tnmq2BJP5L5m975mk:N3m8mpWFzUx6tnmq2BJP5L5m9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775806418, "uuid": "658c69e3-d5c6-4e7b-9a2f-45614fd014db", "value": 199496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775806418, "uuid": "7461ff0a-e425-488d-ab3d-36ee344628c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775806418, "uuid": "7f27d5e5-cfc6-47ac-b61d-be8b0fda5b10", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7bb673a-34d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775822337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822337, "uuid": "491ac870-bd3a-4117-8041-420dfb377ff2", "comment": "Malware payload (Mirai)", "value": "c5d1116b5cf0df5ed26ce92faa7e064b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822337, "uuid": "05a8b1d0-a1ea-401f-ad35-5e8f576885fd", "comment": "Malware payload (Mirai)", "value": "a0a1cb987c89fd4b1fa9faaab8c7641511ca98341778a71b76b40d19065328fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822337, "uuid": "c29d0480-e975-466a-9824-f402a3274d05", "comment": "Malware payload (Mirai)", "value": "3dd57747bad3244a028db5547b97db12c3181215", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822337, "uuid": "8726ce80-e549-40d6-afa2-be22571c99e2", "comment": "Malware payload (Mirai)", "value": "ef1866832cf87f46a29e31e44db420f1b04c4bf40b3334ee612dc71782161150f4d3222dab3705880c524a43e6aefe0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822337, "uuid": "cbed500b-74d8-4b0a-ba74-1ceb793364e9", "value": "T19803F13516212116CAB03C37EA3582833E5F53FC00FB31632BBDDD591286465EEA88DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822337, "uuid": "4b12999c-c8e5-45ef-b48d-82d607d95b81", "value": "768:OhbUpgfK/AwETDSmD7GKdNcBfpxycgETZ6H9bDC5u8Lf9q3UEL+E:OxUpgy4JHSjuNgKcgETQ90kLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775822337, "uuid": "2979b6f1-9dd7-4a93-b1d6-93fef5721c72", "value": 38016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775822337, "uuid": "70e5d4a8-a5e0-4822-9836-f088c59cd377", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822337, "uuid": "a8b6af64-248a-4060-ade0-47e406debc7b", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2abb4c40-348a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775790345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790345, "uuid": "be1a4470-f37c-445a-ac43-695467f934a5", "comment": "Malware payload (Mirai)", "value": "c4983802eee56e18cb0870956b7cd68b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790345, "uuid": "1dfca9d4-f8ec-491a-953e-f16b853a7227", "comment": "Malware payload (Mirai)", "value": "a0dad12f212f8b16290ec5312ea5244807ffe1187da889aa98e0cb0b638612fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790345, "uuid": "64395cfb-469c-49cd-9b47-51faa83abf5b", "comment": "Malware payload (Mirai)", "value": "f7e2622e16816e26d1c962911e5b61d4f0237f07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790345, "uuid": "fe3ee8f9-6870-49a3-b02b-19736ff1e4c3", "comment": "Malware payload (Mirai)", "value": "a64ddb6598b1d9d6ccf26eabe05fc786cbb7138b4ad5ca4d11912bff69f03f9723fe8eb6e4e1aa1d5eb439f25fd9fccb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790345, "uuid": "b397e623-1474-41c9-b636-ee181d7b2b42", "value": "T11F434A42B70C0507E1671EF03B3B57E1839FAA9121D8EA44350EEE4993B5D32954BECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790345, "uuid": "43ea5584-3f11-4f03-9d08-41750ba84bbd", "value": "1536:EuvcKu+fF6mTCwejpuH0qN7y4q+OrfCJ0l:EYCwKpO1ROr3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775790345, "uuid": "800fce98-1046-4305-a8a0-4632ea9010d2", "value": 57060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775790345, "uuid": "f3701427-5a33-4dec-8d58-064e09855283", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790345, "uuid": "88f98508-ebaa-484f-961d-caba01ee98c1", "value": "Clipz.ppc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc71c2b-34d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775822319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822319, "uuid": "3b95f20c-6c6a-47f5-8d5c-82f995bf6953", "comment": "Malware payload (Mirai)", "value": "1b0511ebe31f260c6052c18d8012d52f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822319, "uuid": "81f83f7b-f05b-48bd-a8a2-1156ce7dc299", "comment": "Malware payload (Mirai)", "value": "a0f3b832e05339d9b5fcb091ed620bdf103b931093aa924d6c79b50f6b7d76dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822319, "uuid": "93f0c389-7a50-4cd9-be22-122d9f61476c", "comment": "Malware payload (Mirai)", "value": "8820c2f980f21b61b0042c355325ae5fcb7d49c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822319, "uuid": "3dce8769-3b1e-4abf-bb37-fd1bb3da5de0", "comment": "Malware payload (Mirai)", "value": "cb3f8b1c7ede4dfc064b89de8a2b3e0e2ca8a41fe691b72ca406d0c30c9e4fe34ba416dfd601ea83ec984075705be97e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822319, "uuid": "fa9c6491-2775-4897-beca-522f38c77c52", "value": "T15B832A97F400EDBDF80AD77B4453490AB270A3A105830F36A39BB963FD721A45967EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822319, "uuid": "81c5e8df-afed-40bd-9151-740d7b5b66fb", "value": "1536:quKG91e4DgWxYRyRqwwrzPQtav8FjWtFUo/V6OXZJ7/aNSOFmA7ExtX1dT:q5GTHxYRyRqwazPQta6Q9VXXz4FmA7ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775822319, "uuid": "8831e456-d513-4015-8712-089d38932da2", "value": 81652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775822319, "uuid": "8e0c7a9e-18cb-403a-8cfd-8850b26b6018", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822319, "uuid": "a864fcdc-df32-48d7-ae6f-b5088f1d9fb5", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf4c3727-350b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775845999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775845999, "uuid": "4441ea44-eb13-4a69-8d7f-d498bc465c04", "comment": "Malware payload", "value": "4922999f7c8e6e3540a909735a6ea86f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775845999, "uuid": "c0a769fe-1b10-4621-916b-0603d9c6daac", "comment": "Malware payload", "value": "a2263d3214c6b5ca6a789abe53199699d443fc0523fb3c60517850d183d8725d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775845999, "uuid": "c04f6c74-0f28-4b94-aca7-6ba7d55bd821", "comment": "Malware payload", "value": "0673061419a630df1dc6b3f6941e18aa4e68f0a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775845999, "uuid": "37db69f2-8036-4d28-b726-bc15d3b9deae", "comment": "Malware payload", "value": "d700a924c48ce78499dfb810379196b49f1752d9788d659407a7ddf9d8f2cbf73dd07d337048a5b275bb2d59e78fb667", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775845999, "uuid": "0db590cd-b419-4ead-ae94-d2123be63922", "value": "T120F57D43E69581F9C46EC174C3969733EA32B88E0530B6AB17D4CB213E66F50AF1E719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775845999, "uuid": "a1819762-f90d-42a3-8a1c-56c9c7dc2371", "value": "60331cabb69911f9d7fed6703869e103", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775845999, "uuid": "740e8906-4196-406b-8611-e04d65ab9deb", "value": "49152:LJQ3Prpiv1Qw6AZvIXn/MbqG6pjUfA44px2vCyV9yzucjKRVt5moRipa2hMIU6is:63gvI3/ega4px26cTlg+QDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775845999, "uuid": "0d9cfa84-75ac-4596-aca1-2086376ad823", "value": 3417600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775845999, "uuid": "7c1a8917-3dbd-4d68-ae29-40a58ee8e1b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775845999, "uuid": "1a9b0183-d87a-4919-a95c-9ca8d6ba12e4", "value": "zzz_implant.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c914cd-352c-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775859989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859989, "uuid": "66d0c030-9211-47ed-b7e6-fba491ec34aa", "comment": "Malware payload (RustyStealer)", "value": "fac34acf470e3d18daea6c36e0b5cfc9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859989, "uuid": "eb5dd99d-147e-46d6-9a9a-44baa32d8f9e", "comment": "Malware payload (RustyStealer)", "value": "a5ddd570f993a85d32bba99dcfcb3c5b3fd0a0b18fccdaf3a3b09de216507709", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859989, "uuid": "f8cc83b7-7e66-4e88-bfe1-d7659d85b943", "comment": "Malware payload (RustyStealer)", "value": "8b52226043873193ac8dfb0dfb0b9f5c74ff101f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859989, "uuid": "98827c2d-d9b4-4437-ba31-cd5a5757459e", "comment": "Malware payload (RustyStealer)", "value": "f00fd7ea6fa3ae95e0e87a69f444ef4fb2f27745453adeca9eb08f04511dc0c6c190314086fd39cb3ff4c84966b50b89", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859989, "uuid": "86da05a3-decf-456f-880c-1e0b284e8cd5", "value": "T105D50206BD1ADF3CE80187B168007FB69AA56DD6258319AF31CEF24898F047F1A579F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859989, "uuid": "0a1b686c-7dbb-472e-a594-2dc7bb775d0f", "value": "49152:ip3EVbIsT1XnXQDTG3rR/4EkTTDSqtK/PqAkyLC/ry9wDG5Gn2ciD5VOcf:1JXXYORBkTnSqtiC6C/ry2DStv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775859989, "uuid": "213ea0bf-7613-4690-9545-0d76bf8e2e52", "value": 2785280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775859989, "uuid": "9689b78e-a25c-4aea-89f0-8beb9fe0f308", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859989, "uuid": "fbbbf6c9-7ee1-422f-9752-d8d8cadfade7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bbda42f-34de-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775826505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775826505, "uuid": "b855ea1b-9892-4402-bd1b-fbf927b7d719", "comment": "Malware payload", "value": "0de12b55e0b71af4c928e24cc7192ba8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775826505, "uuid": "c96bc90b-2ce2-48d0-9984-df7475c1dce4", "comment": "Malware payload", "value": "a64a4b5602c408bd15685dc9abb366422bddcc2b83872123445abde3cbc6290b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775826505, "uuid": "51750508-4269-4fa6-a788-15d991330541", "comment": "Malware payload", "value": "af314b4981948f0f638105b53c230edc79726a00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775826505, "uuid": "a5b5663b-dc2d-4f22-aa77-e55a813371e1", "comment": "Malware payload", "value": "5f9c1d6d8f6bff100b423fb29b591878c9cbcb423db5a614f542c9f2443f7cfb966147399d04244e1dc66ead6146cf2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775826505, "uuid": "ca1b5a02-caf4-4c2e-875c-be2d1debefa5", "value": "T17CE48D6676574D10C1882332E18BD93053B1AD86B963E70F75C42FA736573EADE0B2A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775826505, "uuid": "c9086805-a6b8-4ffb-8761-0a48ad8306eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775826505, "uuid": "75794bc6-c085-4c5b-9abf-ae655b8dd103", "value": "12288:gTICg7wpFyOVjhHYoAuRjIbPWtgi38+KApMt:g8Cg7qFy4YoArWEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775826505, "uuid": "3c264813-afc8-49c7-b60d-c5443781c61b", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775826505, "uuid": "094fa7f6-56c0-495b-a2aa-13ef2869afbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775826505, "uuid": "f78795cf-ad4f-4bb8-831f-b42c1e6d8876", "value": "exitlag lifetime version.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd5a55d-34b1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775807365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775807365, "uuid": "a1d655ca-03db-469d-9bd1-74c6e1cedbac", "comment": "Malware payload", "value": "307ca352bbceac0cdf9db70ee26c2f09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775807365, "uuid": "98a77106-d691-420a-80d7-31f7e178219b", "comment": "Malware payload", "value": "a90dca8b01ce7e70b9b1481a3ebe2eeebeab545983968f3fca8b9d9cef6d350d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775807365, "uuid": "da95a2d9-5db6-4631-9246-931abc8abb43", "comment": "Malware payload", "value": "aca465797f20ce94aae770ad587fc06e9ede0f64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775807365, "uuid": "1dd94043-c283-42cf-89a4-034f9ef9c717", "comment": "Malware payload", "value": "37a35b288730decb9ac4d88f91bdae70f4da59d5e04dbc9938e775f8910b2134bce4092a55d2c88aa6a542f92078b576", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775807365, "uuid": "ce2127a1-04f3-43bf-8049-4ca36e27f4ec", "value": "T1333412619281097FC01BC2B98E5BD43AF773B09D619A7B0719DAFE712E04D692B4EF01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775807365, "uuid": "96fdf39f-f85e-425b-bc20-83f2d088aaaf", "value": "6144:GFpAaoW+x7HPRj59NxyxF0ZObCMl8/69w4TdzSREhWqUful6oGQw:w+xVCHEOxlY69FxSRhvC6oGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775807365, "uuid": "41065142-54c3-494b-bb35-db52e55ed3e0", "value": 238109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775807365, "uuid": "5f409c49-19d8-4918-bd6c-a95e278468e1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775807365, "uuid": "766608de-7eee-4504-aefe-d4036d8b09c0", "value": "6nyoswt3ky", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb04f0c9-3521-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1775855521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775855521, "uuid": "55cbabfb-6f6d-443e-9188-4ea8e285b28b", "comment": "Malware payload (AsyncRAT)", "value": "9bca15ab41f9cafcd03bef32fb6d2259", "object_relation": "md5", "Tag": [ { "name": "38-180-82-109", "colour": "#8926AD", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775855521, "uuid": "35be6643-de63-4003-90cf-4108a5b68f49", "comment": "Malware payload (AsyncRAT)", "value": "a9814c12c8f86a7b13e2d8889f6d0b082bca0cb6574704501470775ae27e1f26", "object_relation": "sha256", "Tag": [ { "name": "38-180-82-109", "colour": "#8926AD", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775855521, "uuid": "dc0dd874-53c5-4ac7-97c6-fba478a5ed18", "comment": "Malware payload (AsyncRAT)", "value": "de2d94576d62321adebe4f356e67409f3af78aea", "object_relation": "sha1", "Tag": [ { "name": "38-180-82-109", "colour": "#8926AD", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775855521, "uuid": "9ea7d94f-4699-4a31-bfe3-a74d881d18d2", "comment": "Malware payload (AsyncRAT)", "value": "df5b7a94479deb81e10cef5cb2a1fd41eb33d2535a74b703e8daa707bf1c9aa42e641b08b326c1d9d1904a916792d776", "object_relation": "sha3-384", "Tag": [ { "name": "38-180-82-109", "colour": "#8926AD", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775855521, "uuid": "eb5f41a5-ed40-42af-a5bc-17dc96f79765", "value": "T1EA734C442BF9D11AF6FF4F7499B13241467AFA237A32C60D1D84249D0A22BC1DA917FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775855521, "uuid": "a35aab00-2ec0-4dda-8b42-d9d0817e0844", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775855521, "uuid": "bfc13369-0e5f-4aff-8f2f-9cd421780dbf", "value": "1536:I8CdnMi2diOpk8X7Lm0/55y8zN9OeQJ09nmXeb9hia1SknlWtRudOigrzX+:I5dnMi2d9pk8X7Lm0/55y8zN9OenBmuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775855521, "uuid": "f001fb1a-6911-49de-a66c-632055569441", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775855521, "uuid": "f985d71a-5b4a-497a-87fc-3289715754ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775855521, "uuid": "f0c7fe1f-a66f-4518-8fb2-15ffb575cfd6", "value": "decoded_payload.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7421fb69-34ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775832559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775832559, "uuid": "e76dcaaf-24dc-4d57-8e4c-28b05e88796f", "comment": "Malware payload", "value": "dc4dedc2b2609ec6f7ff21f3da002420", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775832559, "uuid": "226ec86f-59cd-4c80-96cc-9048cf3505f3", "comment": "Malware payload", "value": "aa094bd846706246061419110ade4203c6109b982672c188c7d4a1a15a4a840a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775832559, "uuid": "24990215-8910-4782-84bf-cfff7f4741d5", "comment": "Malware payload", "value": "efd1a4ff2e442a38a03c1e45a7751d6e9f46a5b8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775832559, "uuid": "27d5eb8c-1939-494b-992e-f24c6f32f0fd", "comment": "Malware payload", "value": "94f1adda4915eb325c3b51edeafc56274e28c3f838969c6a99286e6947d7ff54fd627e1363d7943a2c8bf73349cc6500", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775832559, "uuid": "8c62ceb5-06e5-4f3a-82ff-603f5ce3393c", "value": "T14CD5233D33A81164F9BBB278CA479262C2F6F0069351B36E1BB48B761F53915F12E391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775832559, "uuid": "e879fe1f-0dff-4870-bdfc-2a79771169c5", "value": "750036067e22aa459d69fd47cb23e647", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775832559, "uuid": "0acc6385-8123-450f-b0ba-8a0626002ded", "value": "49152:QH9hs/aSCIDRkIC45kAUZW2MlZ2heKTR7ST5IMldpg0v6jfPk1+6Oci1oUfsU2qZ:49l/IDRkIh5RUZW5QeKF7STtlxv6zPCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775832559, "uuid": "22e4e7d1-ebf6-4275-8ddb-e95a048db261", "value": 2967552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775832559, "uuid": "d7ef4d21-7700-46f6-91f2-3c88f32ab8d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775832559, "uuid": "569d3db8-bd13-4b75-ac2e-52b4e88dbe0a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe534cfd-3511-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775848682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775848682, "uuid": "132d1b32-436a-4318-ad70-4e4a6a22ed7d", "comment": "Malware payload (Mirai)", "value": "8e932133d057d6d912ecf4fe7ef388e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775848682, "uuid": "d13de9ba-1a41-4c4a-848d-f0c01ac247dc", "comment": "Malware payload (Mirai)", "value": "ab784fb6fa354921cfff3f7c1f8bd21ed5ebd6028946bba428875bb088e96ffe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775848682, "uuid": "a8618cb1-ffff-46d0-acb8-f6405f816042", "comment": "Malware payload (Mirai)", "value": "548aa0eba9592f9038c0284b06aeec7b3d14c7c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775848682, "uuid": "d2d99f33-4907-4ef4-b546-45cc7dc5e5c0", "comment": "Malware payload (Mirai)", "value": "907e31e09a13541e21fa3f434b9b4243c7bd5a43501f67e972e5a61f38fff7c9c3555b59fb36430ec09fd318c60ac1d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775848682, "uuid": "b98c82b2-049d-4299-8d39-773afc615d3f", "value": "T1D54302BDD4E96606CF2A0DA299DB16B52B48F3D972D556E8EF24A8CCC84439C30CF434", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775848682, "uuid": "18f1c7e3-d829-40f8-9b7b-924e7b4fd31e", "value": "1536:avMrRCm3S/TWVmVHLGSoMeQedGzeesWh9Q9:zRC8S/THHVBepe54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775848682, "uuid": "f4b883eb-50e1-40a7-b90a-a21cb8104061", "value": 55988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775848682, "uuid": "66fbd3de-0a7a-474a-9283-72af95216979", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775848682, "uuid": "a6e73cfb-7ea3-4ef4-84d9-877d19954d41", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8db476-34c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775817569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817569, "uuid": "70d1c1db-8807-4dcf-85f4-e3e165815781", "comment": "Malware payload (Mirai)", "value": "300146e7f05640519a709ddd0382dd3f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817569, "uuid": "50f05335-7a6f-48b0-831e-2ae8b661f937", "comment": "Malware payload (Mirai)", "value": "add376942b58b176f0346ece4ad104d942cac2e92429f49c2c5d56f64935a0d1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817569, "uuid": "0b33566c-5d18-4c7f-af47-92ddeff5577a", "comment": "Malware payload (Mirai)", "value": "2c42f49fecfeacf0ff3e58240f440bc47d973e90", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817569, "uuid": "3b4f67bf-7e4d-4cba-9a61-533ecbd08404", "comment": "Malware payload (Mirai)", "value": "21d1b3900dc43e81d6d5afd2a7e26c26b5117fd57bf23d83ec22536ba489abd3a3234e303f2f880d663de04e64dfc141", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817569, "uuid": "e6dce44d-4092-4035-84ae-323a36554263", "value": "T12D535921797A2F17C4E9A07A25B38315B6B5768E32B8C65D3C732F4EFF14640A0075B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817569, "uuid": "0516538e-ac63-4338-983b-16021d02f5b5", "value": "1536:k+YY8/acYmgBOwicSYmnWLI1fz/A0Lzp1pdYm+K:n2DZYmnFxoYp1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775817569, "uuid": "a19370f5-66da-45e5-b46f-73d428115eae", "value": 64400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775817569, "uuid": "40c379dd-f15a-47bf-a544-e4d10802814b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817569, "uuid": "6a994fa4-045f-4315-98de-8a444867ca88", "value": "jew.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cfea71c-348a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775790349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790349, "uuid": "b7cc1231-9ff9-4b4a-98ef-15e96dc3369e", "comment": "Malware payload (Mirai)", "value": "9f8cbef0248198c398851f302095b8bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790349, "uuid": "2ca94c68-0ece-4aac-b36d-57d758092c50", "comment": "Malware payload (Mirai)", "value": "afd7325131edfcd5340139c05c453b2e3918a19cf769ba6dfb3b2dec7af1e00c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790349, "uuid": "4941445e-5454-4498-ae10-63335434cb37", "comment": "Malware payload (Mirai)", "value": "b8b312948619fc683b8984a75c58ec71c5454ce1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790349, "uuid": "b5d063c2-ac1c-434d-8805-684fa29be774", "comment": "Malware payload (Mirai)", "value": "f2e67cde721bf2a03282080de7c4fb721ca7a334408d303dfe9cafe3a7a27668d43396e7c4e00323122760306df17721", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790349, "uuid": "7c05b533-a89a-48a8-89e7-9a8ab87a6336", "value": "T13163185AF9819B11D5C1157AFE0E124E73130B7CE3DE72269E24AB34778B96B0E3B409", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790349, "uuid": "9d5dd7ec-29ca-43d9-ba66-60cca15f63bd", "value": "1536:eYnFA0afN8Fek8brnsMTiq5Vqabdf5NPO1u5tYiR:7afN8wRVqabF51O1urB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775790349, "uuid": "e3a6e50a-de7d-41d0-9595-0f625b86bcfe", "value": 68180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775790349, "uuid": "74a1ac16-526a-4730-9423-ddd8c0e7085c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790349, "uuid": "a35fef6a-0aca-41f6-86bf-e32a168274b1", "value": "Clipz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "728088c2-34fc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775839428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775839428, "uuid": "15510c79-231d-47dc-8a4e-aead553517eb", "comment": "Malware payload (Mirai)", "value": "a612b28c82f7c49cf3f9d7d09b81cec6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775839428, "uuid": "1920eb19-dacc-4588-88ee-6124f42255d5", "comment": "Malware payload (Mirai)", "value": "b185cfad3664ef6fb071c55fd189b3259c4fa131171858d4ab31594761b39d30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775839428, "uuid": "b38e5f45-6430-48bb-8669-d776419e6750", "comment": "Malware payload (Mirai)", "value": "f10408a7f3c214ca1264fc20c9f6052acd539987", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775839428, "uuid": "f8d6f6f1-29b6-47bc-b85d-a6744cab4abe", "comment": "Malware payload (Mirai)", "value": "24932b09f26e5b20f730eb63c4eaa0f0d5aa04c37d25bd3e2adece8b1b853ce2f88ca5de1954a95b9d50080ca7bb3d9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775839428, "uuid": "64f3d190-29f8-4c1f-a948-92bee0e62b7d", "value": "T190B3E085B210AA55C02672FCB187099093B17E7B4B9A150B44B3F5B46DBCCD47E0BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775839428, "uuid": "3ea6d92e-99ce-4360-833f-3d7c4526fd11", "value": "3072:jx63zpjhO5z01nCU375P5wk5SOez7wud:as5zqhr5Nzy7wK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775839428, "uuid": "80debd3c-19f8-4a71-8d67-c08f98549f64", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775839428, "uuid": "5dab4fc0-cb22-448c-8a0e-6b54d1c34333", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775839428, "uuid": "90ad2c27-4eb0-46c3-bbd6-f2df8d3c5489", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85ff6b0-3529-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775858980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775858980, "uuid": "2a0be87e-6de4-4e57-9f4f-53e13c15d182", "comment": "Malware payload", "value": "08e0d9fce3c3a73580a024c942c37c23", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775858980, "uuid": "4a7fe342-ad23-4c7f-a6e8-a099d593f542", "comment": "Malware payload", "value": "b22ba1c4adc7b086630eca711a839bec41f3c3a16cd638042ff07293a892af69", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775858980, "uuid": "ca58865b-8a6a-4c90-bb5d-434a8d7fbba9", "comment": "Malware payload", "value": "35e25b1fbc6a48d9ca4ac0704af5f83707257210", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775858980, "uuid": "01694869-4156-43e2-ab86-c6dca35c98f9", "comment": "Malware payload", "value": "759029b6f7a3ae0bceed8514cd2aa359f2866aa94c226df1c23b2e6178dfdc3380f96e4c031c84815da1734f912dd967", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775858980, "uuid": "b0132090-e598-4e00-9794-cba7d0691451", "value": "T177A20805AA56534AF4B1187553B72E356439BE32270D94CFEF900A391274EE0FE3739A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775858980, "uuid": "5cf0e358-2d97-4906-b985-b321eabed06d", "value": "d0f945da54f20d8bcaf079f2d6ea9f63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775858980, "uuid": "75885eaf-9f78-444f-bcc5-f82f09b77a6b", "value": "384:bHu1OuPf4/S1fUrQFYhJ4JVB0WsNUnwnR:rNuPf4/IUrqY+xsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775858980, "uuid": "8b3a8238-07be-44b1-9ceb-4c0569cc6b75", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775858980, "uuid": "27a7bd17-e435-4d3e-8f51-bad54b6cfb96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775858980, "uuid": "2159b17e-470d-49eb-9c34-25d444dd24dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a37046-34d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775822332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822332, "uuid": "c8a141fe-2948-4b8e-968d-7c56930e978e", "comment": "Malware payload (Mirai)", "value": "0795d465520b9fcf14055586bb4824cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822332, "uuid": "20d131d9-320e-4371-bfb9-4cf8070b213d", "comment": "Malware payload (Mirai)", "value": "b356e9428b521645766bc4f940c07ef8edddef658e1890bf2ae284c49808a4d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822332, "uuid": "a24a1fa1-1660-4c15-9275-043ca012a2e1", "comment": "Malware payload (Mirai)", "value": "8fe81e06b4c4c7a365c4fdde48cd40a6f2caa0cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822332, "uuid": "8bff3876-4285-48d2-be1f-11a61e30032b", "comment": "Malware payload (Mirai)", "value": "df13565b474fba867e17c0af95096e67de3fda0e755567fa7654cb7749356a36277f94a7c1e789b6c782dff25029fb84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822332, "uuid": "e65a40d0-eb10-4935-9a19-67415f03d03a", "value": "T183735C22B9751D2BC4D0A87A61F30321F2F2478A25ACCA1A7D720D8EBF6564032477F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822332, "uuid": "2cb4b4ce-28be-4904-9450-3277c924ceab", "value": "1536:jP+SbCGR18pspTH1KDQ2tXXUN95s0xwlWptCMR8/pW:zf4yVUpENP1x6MoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775822332, "uuid": "1dc310da-ead1-4d76-becc-f62d427db72f", "value": 78528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775822332, "uuid": "1fab45db-be2b-4763-ac8e-b93060a34d75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822332, "uuid": "75ae74a1-912f-4e16-9375-6a05cdf49b58", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64af6fc4-34ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775819648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775819648, "uuid": "77755182-a268-49e0-8242-0e0c5ae991c0", "comment": "Malware payload", "value": "c399b7ecd94a2a5a6bce2cea3c8f0020", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775819648, "uuid": "3cd64473-7fca-41d4-8df8-3e5a8df1aa5d", "comment": "Malware payload", "value": "b48786f180a62a65b022ad1a331cda1b8bc6448b4629038abc03dbcdbf578325", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775819648, "uuid": "b340bf0c-ffca-40c7-8acd-01f6c59689a7", "comment": "Malware payload", "value": "7a41103acca680c16ee4c866a249770331a5148b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775819648, "uuid": "27c5cf84-49af-4e21-87f1-61c19e8f81a6", "comment": "Malware payload", "value": "9f6a50670d95b10952c40e0850de2df59d58f2ecd874629b3f1a0f7813dd92319eb056e84a129f69d508f3456ad50b8f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775819648, "uuid": "7d62ddd3-7b2c-4fd8-a22b-4a5df2221468", "value": "T1BF935B02B5C1D871F57619312874DAB49A7EF9201F619EAB3398077A0F306C1DE35EAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775819648, "uuid": "39d89047-9613-43f7-821a-0edfd55d749b", "value": "ab0877be454d2885696d827ea2b949f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775819648, "uuid": "f07e3b7a-e702-4cfc-8cca-264913ae0fb4", "value": "1536:bLSncfMrzezHm9q1Qo3eB2RTtE7xQpDSmL/ay3//NZxsWacdP/sHbOh45N:fSncfCezGM1QoZEdQpDJLH/7vP/sHbVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775819648, "uuid": "617b992b-c3c1-440f-bddd-6138be9c0441", "value": 89600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775819648, "uuid": "2159d051-524b-413c-8f3b-4fa5dc98e392", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775819648, "uuid": "fb15f5c8-2c22-4d4d-9daa-211e42e54052", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b0afd7-34d8-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1775823859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775823859, "uuid": "38aa6da7-ebcf-4dd9-b03a-bac58cc20cff", "comment": "Malware payload (DarkTortilla)", "value": "4c5af2a9fdea7bd68955f0487b5d8d52", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775823859, "uuid": "35997137-c35b-4db0-a124-8e09bec64445", "comment": "Malware payload (DarkTortilla)", "value": "b4a588d319d2f3789e66c4f1fec6ff9ad7aacd6e5cce69de76d648a424a4df2a", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775823859, "uuid": "89c01196-5529-411b-8a0f-3c594765bd72", "comment": "Malware payload (DarkTortilla)", "value": "02b84a29ce3309d1a580291dfe21de2efb36721e", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775823859, "uuid": "d854365f-1f5b-4524-a99e-18074d344bc2", "comment": "Malware payload (DarkTortilla)", "value": "da407484a7c54ca51d447ea9e5dca4b4b876d5c937d7de087561559a0252d97cfdf8a0d1b0ebec9dd60686395be5966e", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775823859, "uuid": "c805818e-27ff-4a79-ab50-a4b03b5e7654", "value": "T1E3D4BE211F861F9AE6AE4BB8C052185877F0D453E3D3DB276FEC44F92AA7F84CA46441", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775823859, "uuid": "6f9e597f-11ea-4c88-ad09-42f223b415e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775823859, "uuid": "2b59ee76-4da1-4ec2-9a50-be8933d7dfeb", "value": "12288:JTaebGf2X56DtozYgSpU5b7L9ig4GGdRoXA3GzuKp6:JTa86DtozYg5BR8RVWT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775823859, "uuid": "904214bc-986e-4d5b-b42e-a325779d8a22", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775823859, "uuid": "2dd98f90-d69c-485b-8785-0e5bd93d14d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775823859, "uuid": "9e63e400-05fa-4cbf-a5b3-762701932ddf", "value": "DYM_COTIZACION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19af79b3-34f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775835413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775835413, "uuid": "f42947fa-a50c-499b-976b-4cd71174adaf", "comment": "Malware payload (Mirai)", "value": "e2296e2ef7cd246a6b3bc2da0a09ee3e", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775835413, "uuid": "896d4b74-a774-4820-b7f3-f4e79ab95f97", "comment": "Malware payload (Mirai)", "value": "b79a0c376fa56601f16794f277b95239147443fb42a937ac22c4fede85548b15", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775835413, "uuid": "e0fadc36-f289-41ce-a574-59405d708c07", "comment": "Malware payload (Mirai)", "value": "f576cbf3b49c954af17616d8065dc05c1b99da40", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775835413, "uuid": "74b3f0d3-5901-4c6f-9d80-605c0bf75fe9", "comment": "Malware payload (Mirai)", "value": "db707d96835763174f614f81fa2234d9db2e17b5a1caddc0c2c694aef9481afb23c21948016034e9fa1a20420f04f418", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775835413, "uuid": "3502d864-a0b5-4a5f-bd8f-b35631882d88", "value": "T18E24A70E2E228F7DF268C73547B78A3597AD33D622E1D684D2ACD2151E6034E541FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775835413, "uuid": "2b936594-a156-4f99-bc4e-b45b465a2e29", "value": "3072:Wc6qANIMErR6ntbT/ESAgFPqhxMbscPLRH/AYCw0v1i6ftvGbG1WplKz5Y:Wc6qzJrR6tXMSALxM7tCpVGsW/KzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775835413, "uuid": "3e699337-3919-45d9-b3b1-e8fbe73497b6", "value": 224300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775835413, "uuid": "6157477d-9a7c-47fa-b8ec-381dc86eeb73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775835413, "uuid": "4a07b5c4-5dba-42be-9028-478fec17777b", "value": "rebirth.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0441e3c-34dc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775825895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775825895, "uuid": "f15cca6c-ae23-4a07-af52-66a7884dabf7", "comment": "Malware payload", "value": "d987ea62277ff68e47280bc36e15d71b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775825895, "uuid": "28a55d46-6661-4c56-b42a-6f1b32f4b726", "comment": "Malware payload", "value": "bbc1b37983cb295e3620e91eb49d8591265a21b5f67abc982151d841b32c1c25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775825895, "uuid": "0fb7c129-1f8c-4f80-8557-58b85c56dbfc", "comment": "Malware payload", "value": "91812a2c0ae09ffb2afde479fdf3a0b2d7b68864", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775825895, "uuid": "b83491ea-29e0-41b3-a7e6-e86c4602b154", "comment": "Malware payload", "value": "d3c1238130a99b4c31c5f82abf187a22b3c6577bd2230afb97fd575859e728baddefa6670e6a8c641233b29a1179072f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775825895, "uuid": "1feeb65f-d5f7-465b-a838-2789ac64dec5", "value": "T15A541283D7E8A2D4C1E89A32062B5777F5287969373205D78B61E30FAC3BBC1D179258", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775825895, "uuid": "f30eb76c-257c-431a-8444-56541975ca21", "value": "e81d90b230abc81b286482b9dba12e35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775825895, "uuid": "f31cdb4f-1f3c-44ab-afdf-b89e9f9df6e9", "value": "6144:VjOS5nYaAoWiyFVqTlBS1dAJvWwAcds8T9P7NJper4YD10:Vj11wjaK8bjG8T573Ir4Y6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775825895, "uuid": "795d6347-76b1-4a89-b911-39b58969aa3d", "value": 286208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775825895, "uuid": "ee14ff1e-36cf-430b-9b86-4a175a8bc2c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775825895, "uuid": "ef4b7d94-9444-41d4-a92e-8d13b6136536", "value": "PassatHook.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b06a143-348a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775790292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790292, "uuid": "bc28e3cf-0122-4f3c-b192-941bd86c24a9", "comment": "Malware payload (Mirai)", "value": "5d1b30f49ae7781904e180557a4e2b6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790292, "uuid": "4ae55e93-b651-4d5d-8759-7c5c80a4422d", "comment": "Malware payload (Mirai)", "value": "bbc8baf2ffde2eed4bcb34e486b7f073166326a512b6398a381ac7e9b97b88c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790292, "uuid": "709c3a66-e88a-4ca5-ae92-04b58f8a55bc", "comment": "Malware payload (Mirai)", "value": "cf7e6e9607526cd121813efedf641e8211883dcc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790292, "uuid": "d2e49827-d387-4188-bbfa-d23bfb6571e0", "comment": "Malware payload (Mirai)", "value": "e7342bc3f8f53b6320a1cc4879f351eef9d2b18c3fda9c89e7850dd89b5bfca8d47518fa85961f6948b98e1ec083155c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790292, "uuid": "1f351457-e53e-4665-bc01-96ad96b5897c", "value": "T1BED2E031F4E7D970EF5EE9B12C44D7C53B338E9B39A58AF11119D341A613C215B89EA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790292, "uuid": "8c465911-f1cc-4b2e-9cdf-f5527e5d530b", "value": "768:kbVp4KREhDP/i1iduQgxRXlQ+zQ7vFOLkcQdu4uVcqgw09X:AVSYEhDXLcXXns7dOLkHU4u+qgw09X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775790292, "uuid": "26b737a8-c3a3-4f81-a948-19cbb28b61ca", "value": 29980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775790292, "uuid": "c33fcb57-013a-4a9a-a2b3-5b8f46f17fd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790292, "uuid": "05f8f491-8bfd-4a5d-966e-e594189daf7c", "value": "Clipz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df28328b-34e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775829302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775829302, "uuid": "7e08c869-220a-43d6-9aa5-218589ce8adb", "comment": "Malware payload", "value": "a7bfcda0feb59f19e3ba46717782df70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sb[sd]", "colour": "#989195", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775829302, "uuid": "d6baecd9-c353-4b91-9770-e2e649f25a30", "comment": "Malware payload", "value": "bf72e59804540eab221a808357d1f3eff282b884835fec11f6541b8aa8ef3482", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sb[sd]", "colour": "#989195", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775829302, "uuid": "8309917c-f776-4e35-b6c0-8c6513b14057", "comment": "Malware payload", "value": "82731b3a575379972dfe0fd6d65310ead66a39a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sb[sd]", "colour": "#989195", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775829302, "uuid": "5e182164-eb92-4a8c-a480-5f21c0f7d700", "comment": "Malware payload", "value": "35abe360f3efe4a146a0dd3ecdb29f9b1901b1350a2a373cb8dbede831badf6a6827237a7f9e241905313f38ad5ba587", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sb[sd]", "colour": "#989195", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775829302, "uuid": "56e2c00c-9fde-4be9-aecf-737cfd57ea74", "value": "T1D8349D07B7E674F5E1BAC234C4629615E775B8340B215BDF47648A8A1F32BE0AC3EB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775829302, "uuid": "40985eb6-ed97-4712-98ad-acb0daf76c72", "value": "98542742d40ec559c0b2be1029d43198", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775829302, "uuid": "8fa15322-8dd1-4b51-a908-b8e72357d6e8", "value": "6144:IDLOnQ1n8N9yO1JKZOtz/LLvmpjEViaNdy:IDLIO8N9yuJcOZPupjja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775829302, "uuid": "0cf5e397-0716-4d89-a434-73fb75335845", "value": 236544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775829302, "uuid": "b7e99d32-7ad0-4e8a-90a4-bedfad2c0b48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775829302, "uuid": "5bafb905-9540-4ba5-b669-8197640f7a35", "value": "\u6587\u6863.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "692c7800-350c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775846284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775846284, "uuid": "b043899c-272a-4bcc-a29b-6c5f5cdf38ff", "comment": "Malware payload", "value": "c54475ae233deee13777345d98b8e24b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775846284, "uuid": "561cfed5-8752-4631-9359-80311e7249ad", "comment": "Malware payload", "value": "c0236ce269d085d5afe2cd2c21c4876bf67fcb81097ce5b255bb2c4fe2d589de", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775846284, "uuid": "5ed07c10-5395-4baf-9365-ed667592cb41", "comment": "Malware payload", "value": "06790156e5e3d5ace06d3e194bc4e4e8f74d417b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775846284, "uuid": "4863e789-f5ed-49ee-9ed1-4c8eccd5648f", "comment": "Malware payload", "value": "22bb2f690c2a11633e0b930377d8dc6131c4f55fd1f27e4407e11eb1b1ce23a79d6089b0e946383cd447fbd964f133e4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775846284, "uuid": "48499add-31fe-4a1b-b4f1-feb41e04e06d", "value": "T14612191A3E444171D6D109F116B65B8E9DBD02F32F82B5EBB73381450FAC248A043BEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775846284, "uuid": "4b5c1cbe-02dd-4301-8533-b515b01295e0", "value": "061dcb52602df02b8a4859c27c281f82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775846284, "uuid": "663081a6-7ef7-4a15-8153-6f6f45c93df5", "value": "192:dTg1QblJBK+7dZAh5YWqbiabixPFJxTEKmFh++7:dTgD+7dOh0iaixPFwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775846284, "uuid": "fa353835-8854-49bf-938b-ba2ebe7a1139", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775846284, "uuid": "485a28ad-6cb6-44da-8194-05f33dc28dca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775846284, "uuid": "729862eb-1014-4bf7-aa8d-5d82d4bf8935", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064f1865-34c9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775817342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817342, "uuid": "47dc6406-ecef-4cee-93f9-53f98634a645", "comment": "Malware payload", "value": "28efeb22f104c799fba4bb0091352e1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817342, "uuid": "dbe9ef34-9d81-43ac-a201-322a3091d9bf", "comment": "Malware payload", "value": "c08a59750b5a72761d457e7b9875aa251f71c64d0c6bf7e391bb5c5f35cefc3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817342, "uuid": "352b4abc-20aa-48c1-8d19-912c7548ef5c", "comment": "Malware payload", "value": "f94b990c3c6069b013223da5c9f0e34321242eb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817342, "uuid": "d565183e-d666-4367-ad9b-658687625362", "comment": "Malware payload", "value": "00e08ce8daecc1b1db42ad305aefb2c8392894dd2fb3e5a81291473992c681928642d4be9910e9a87a867f57dffd6d1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817342, "uuid": "98f62adb-5e75-4638-a265-051b361703dd", "value": "T120E4E086F39427ADC97FE639D916532FF63178925310870B12A58B633F235746B2E322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817342, "uuid": "063d6fc4-7983-451a-9ec9-1c1002ec308f", "value": "af18b23f8bd85b1fd557930d6522f233", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817342, "uuid": "c9ce3b77-4ead-49ce-957c-4ade1078735b", "value": "12288:5qI8d1DtZIZMOmVIiTU5bAGACJ0t+GatfAsPU7gKkKEOHXUI:5qvd1ZZabuIiOQt+LtAsPbK7EOHXUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775817342, "uuid": "d8d0b432-421f-4c30-a11c-2578cab15e5d", "value": 682048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775817342, "uuid": "c428eed5-461d-4851-ada9-0af716826f17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817342, "uuid": "b4ff5092-adfb-4d76-8a34-58c978c763b2", "value": "image20260409689.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b239004-34d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775822316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822316, "uuid": "2a4eb9a0-ca8e-4fe6-af43-ab23c506610d", "comment": "Malware payload (Mirai)", "value": "211d6c17339b1a95cc9d504996619d38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822316, "uuid": "df6bbd3b-26f1-4d63-b877-e31cdd67791b", "comment": "Malware payload (Mirai)", "value": "c18ed7a234fe4f26d89fa2b80f1d7366b0374a6e9416df2115e8676bb9a5edcc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822316, "uuid": "2deca2c6-0ff4-4122-8499-3591132be758", "comment": "Malware payload (Mirai)", "value": "f892bc63db316f766da405818f34e0a076ea6d5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822316, "uuid": "27994f66-30a1-4ccd-9539-4542caa7e7a3", "comment": "Malware payload (Mirai)", "value": "a80f9b7efc901cb0cfb237e9e23f829a40559b16b66876d534ee44bd3e0201a9124ad0334889bf2c21cdc98d34e1a16c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822316, "uuid": "b65ff93a-cb5a-4112-afb2-14cca0321a61", "value": "T1BBF2F120F1183731DEF19D78E11649827673A720EAABF171990C5BA6859C2DF30BC49F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822316, "uuid": "096cef19-f36c-43eb-b4c9-326893bed662", "value": "768:/ZAb2jdTWDPtuRl/dzCvCD4LIsS1X9kUv9EFTx79Hmnoe3ehH8s3UozW2:/ZAKjBWDPtuTcvC8LIV99Vv9ER9Zmnep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775822316, "uuid": "2e6c06ce-3501-47f2-ad27-b1c892e56b84", "value": 35556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775822316, "uuid": "9c5f00f3-0075-401b-89c3-875051fdab40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822316, "uuid": "af20264e-df06-418c-a8d8-a2b963abb9a9", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117f2fcf-3523-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1775856015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775856015, "uuid": "0f5f32ce-04ad-4f57-84fc-8559adcd171e", "comment": "Malware payload (RatonRAT)", "value": "6da70a83c904b9c1e6acab05f2b41974", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775856015, "uuid": "352abab0-fc45-4dbf-b8d3-2a9703d57182", "comment": "Malware payload (RatonRAT)", "value": "c1e0aa4d0217a4d1adfa91caaad5d09a1278fec8102870fefae310bf1fe6168b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775856015, "uuid": "c95bb749-3a4f-4d57-8772-80b879f38de0", "comment": "Malware payload (RatonRAT)", "value": "68134e07f5147d5ea58963074a4694c636de07bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775856015, "uuid": "36d27b09-3e7e-4557-81f0-aeb5d8c1cbc7", "comment": "Malware payload (RatonRAT)", "value": "edd53564641fd4294b289929c2f7eadea495fa0348edb5a461533a78f53a4bc95e53f4eed8f02687dac530f8b927ec98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775856015, "uuid": "c35490e7-0b1b-451d-b184-3163b367e1fc", "value": "T1E7D5010C33FACA08F2BF4BF4A87185654771FE169C62D76C19A579AE14B2F44BA10723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775856015, "uuid": "1c0b9d62-c3fb-41e6-8030-87539b2a7a20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775856015, "uuid": "65af2e7c-28a3-4b6b-a8b1-2c0f3e67feca", "value": "49152:n0gVUlsHjkmiGWU5FLGpMZ7iKPJ5W16sclR0BxMfzaRw4SsO:n0gVUuHjkDGjzqpgmwQ13uRxfzew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775856015, "uuid": "74e21fe7-1869-45d9-92e8-7e34ef5fc00b", "value": 3003904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775856015, "uuid": "20d8763b-af6a-4647-82b1-efb5d04644d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775856015, "uuid": "7f97cbed-a869-4f19-bc12-100f73eeb720", "value": "test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b604367-34e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775829162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775829162, "uuid": "62eb2165-a134-48b8-9c17-5d715eab0494", "comment": "Malware payload", "value": "8be8eb6f9d1cccaed6d922ad90b3169d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sad", "colour": "#07D9BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775829162, "uuid": "a9ce787f-c42b-4d1e-b939-94ad03866394", "comment": "Malware payload", "value": "c3c01c2747491454c69f556aca38e7ad8cb91e4c356dd94da5ebb4a430adc270", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sad", "colour": "#07D9BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775829162, "uuid": "db5b458b-3073-4da8-9206-20983d394151", "comment": "Malware payload", "value": "29412c629b1b79af0a78d86e86a0f74c77416dc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sad", "colour": "#07D9BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775829162, "uuid": "ce6f5c4d-fe39-4ead-b8f2-f1baefd62c10", "comment": "Malware payload", "value": "d209c07924ebf2fe848190772045908a72ba32c5fabe02535490d7dab4847d03437fece66c5544aeb1fbb00f865f6a32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sad", "colour": "#07D9BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775829162, "uuid": "2ac3ce50-c121-4c57-be19-b6005a96dfd5", "value": "T17C169D87B2B652A8D5B2C03586F7C62BD5327C058F20A5EF168877181EB37F45E3A718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775829162, "uuid": "f6a9a9f5-57e9-42bb-8deb-03a22cd4d956", "value": "f00bc39147e9d75e6df4afd9bdd83da7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775829162, "uuid": "50aa66a3-5c4e-4ca2-83ed-0b2e99562a2b", "value": "49152:NLdaZ/eMhSKhrvn3Y0wKtb4Bcbl1ps2k4xdmE7ZYeA+Jsv6tWKFdu9CiPT/G7Cwq:NgzhViGtbJsv6tWKFdu9Ci668U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775829162, "uuid": "09f1ea7a-3291-4421-aa34-55413bf8f21f", "value": 4242944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775829162, "uuid": "012c230f-71be-4d2a-8107-ba97e0098889", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775829162, "uuid": "a3f3ccaa-7b9a-4e80-90c0-948c5a65be02", "value": "2026\u5e74 \u7b2c\u4e00\u5b63\u5ea6\u8fdd\u7eaa\u8fdd\u89c4\u4eba\u5458\u540d\u5355pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af6c5e1-34f6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775836811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836811, "uuid": "bce9686a-005b-4af2-8530-f1cf7b7f2d5d", "comment": "Malware payload", "value": "80788cbd9dd8cf71dd53b454f53484a8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836811, "uuid": "f7f203d6-9216-4266-9911-7097856df74d", "comment": "Malware payload", "value": "c3edb04958f1fe5f6f2f37f5f1cc53dcb00ea7dfdb05c59edc4012463ebbd280", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836811, "uuid": "c3c120f9-8404-443e-89d0-2a7ab5bcc733", "comment": "Malware payload", "value": "090142cd7ce7c632df42ef3e4fa2194cfc5e3908", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836811, "uuid": "8a3501eb-e3ea-4be1-bf44-db5ceb30e69a", "comment": "Malware payload", "value": "404546eb1280d0d6a521a356e667a2b589912333b3c9f90ed97390f8b052038fd5cd26d1cdf03b79083959b770e2b618", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775836811, "uuid": "90b78bb9-0fe0-4a6f-ba68-86371f4fcca6", "value": "T156137D6566953C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775836811, "uuid": "2c36ee36-0ca8-42ee-8946-710c41648602", "value": "768:bGXRWNGxVm9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bilxBcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775836811, "uuid": "62fd2296-2569-489e-b63f-2748f60d935b", "value": 45503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775836811, "uuid": "f890306a-b21d-4630-b45d-f728d658fcb0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775836811, "uuid": "2008f039-b039-4dc2-b29c-2fba3801bcf9", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221f9da6-34f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775835427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775835427, "uuid": "f1249d51-6d7f-410d-a95b-f9694fab8a73", "comment": "Malware payload (Mirai)", "value": "f63b9901ebb6b9ca3d3c60abab21b9c4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775835427, "uuid": "f7bf3a7e-3d3c-415e-bee7-0384d6ec107f", "comment": "Malware payload (Mirai)", "value": "c4c7e3e6b161b8b7d530db995ec95e027f64b92f7cddab536724198fbd403157", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775835427, "uuid": "55b032d0-a243-47a9-92de-01712532b5d1", "comment": "Malware payload (Mirai)", "value": "9f4e1f8f463ef3c053a466c0a1c46621b612fbd6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775835427, "uuid": "8868e238-61f9-4eee-b06d-6fb38b79c996", "comment": "Malware payload (Mirai)", "value": "6a46701891e656a687f81a393b94daf1f393433a64dcd128dd5d714450aa09f74051576c858e83864749ad9c2d9615b1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775835427, "uuid": "cfabfb36-0aaf-4545-b0c8-a2ede978c2cc", "value": "T1FF041946F8819B15D5D112BAFF1E528E33131B7CE3DE72029D246F247BCA86B0E3A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775835427, "uuid": "9cefc7ec-cc71-4567-90c8-7bd7e33cf8d8", "value": "3072:ACbd1A3Tcm6VmymFHCbuVF3jXbNfuG0tea+TTc1EVhfMBCLy:Aiecm6V7mFHtV5XbN2PcaSwyfMBCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775835427, "uuid": "604bcabb-3a65-4ef3-9fb5-a7244c2aa6c9", "value": 180956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775835427, "uuid": "5c8efc03-bcfa-4418-a2c7-b52d972e0cec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775835427, "uuid": "cc7ac5c9-4423-4cd4-a696-55012cc764ed", "value": "rebirth.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf421ac0-351a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775852441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775852441, "uuid": "392bb0be-f77c-49f4-a7a7-0669f9574e66", "comment": "Malware payload", "value": "2444eb05b3d9e198663d0e07e97307c2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775852441, "uuid": "14809c73-f165-4d30-acfc-e9ee07dd1618", "comment": "Malware payload", "value": "c4f51ccde0525887b61fb919eefc5830b24ec35fdcb2af2aa3893e5f56957c40", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775852441, "uuid": "c0433e31-f02c-4116-9994-4f912617e0ab", "comment": "Malware payload", "value": "ad3dc43ff267bcff3e9c58828113e41df8a969cc", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775852441, "uuid": "9195bc6d-590a-4cf0-a87d-4b4060dfa382", "comment": "Malware payload", "value": "150461a4d3ff9d0b303a0a3a9bd182e4ebb8c1f57fb9b16e0142155c8d5e655e830bc5b3ab375cad544020fcd7710109", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775852441, "uuid": "66c414c6-eae9-4de6-9364-7ad875700714", "value": "T105E5238BA734067CF0A50F78A96F86F8D5A67D5D4C20DADA4981BF21617FA123F35203", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775852441, "uuid": "ca6aa7e6-a557-4230-b407-a4018bcb0927", "value": "49152:9rwOpRfUynrYLpsWN8NV/eg5CSMUoJNhTpuDIBR5uQJ/wlp:9rwOpRfJrYlQSBNhTpuDaRnJolp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775852441, "uuid": "651b760c-2c49-4f20-942b-0bde7ad01009", "value": 3269910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775852441, "uuid": "184e7618-b9ee-4e12-bd5b-49780d01154f", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775852441, "uuid": "9235c6c5-73a8-4766-a7e4-3654cd0d1c13", "value": "my horror domlopez 2 (2).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329f3306-34f9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775838032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775838032, "uuid": "483b6511-4224-4550-9b26-471e2c18c8fd", "comment": "Malware payload", "value": "164570fa6b961eaa55262b36512b274e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775838032, "uuid": "f47c5c0b-1578-4b6f-880f-72a32e5fafd8", "comment": "Malware payload", "value": "c4fec93cb53d0529dc4194d6adac414195d422f4914e9f3d1ad7ab5d444398f9", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775838032, "uuid": "049cf185-1375-488d-b7b1-fc54922f56d7", "comment": "Malware payload", "value": "1091160d3a7e9942f4483b85a4ec4a9651bd9d6b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775838032, "uuid": "2761bb98-edd3-4165-894d-f35dddbc8d92", "comment": "Malware payload", "value": "605ee5acac62bbc6e677b6516396a403e6f6f1ef5243abaf2827d0dbb172dbcaf6352d0f45ab92176f40b61ca9076153", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775838032, "uuid": "81b99799-5187-48ad-aa70-3431447d9849", "value": "T1F3C57B2135C5C133D56F03742A1D97EA8A796E203B7348DBA3EC992E5EB09C05236F97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775838032, "uuid": "a0fa99ad-4563-465a-a7a5-dd22650d15e3", "value": "49152:3tqYaZrf5jSTUialBJrMf+7UVZDEFes4vLNgmUESIEjPMN2lv+oBJYsJMV3eVouQ:6jSTB6q+x4veHjPMNa1YaMV39YAhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775838032, "uuid": "d9d45ec0-de84-4660-b6c1-e5692ab921f1", "value": 2642944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775838032, "uuid": "a2a842f5-76a7-40a7-82c7-17962f10af54", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775838032, "uuid": "a130a1a6-355f-4a8b-b029-ec8f7d5bdafd", "value": "vc_version.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e95d7a9-352a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775859098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859098, "uuid": "cb7283c2-19ae-4c5b-a5a5-000e27d4ffbb", "comment": "Malware payload (Mirai)", "value": "c5600ff3f3aa54533fe610df345da6d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859098, "uuid": "7625df4a-3610-4504-98c5-7d86db12d97f", "comment": "Malware payload (Mirai)", "value": "c501e99c1aa80f76924b29118fe6cb0a726ee83b41ccc2e0f016160893ba4123", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859098, "uuid": "71cc6cb4-9450-4e15-ab6c-5caec60ebf32", "comment": "Malware payload (Mirai)", "value": "e1facada7897942580ccbf4ac456c5137c14ddf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859098, "uuid": "bb5bada0-e429-473d-bc08-2d6bf61bf09b", "comment": "Malware payload (Mirai)", "value": "fb88f9d35e79aa9ba4add3d8961a0d1c9d4bb30983fe3ef00edfd48335e7f5da3ebc140a019cb2d95e7ab971047a3e08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859098, "uuid": "88aa5a6f-79a7-4f9b-a85f-a1ab75244a32", "value": "T1BE14F746BD528F13C6C225FBFB9E418C37176B79D3FA31039E216F50278A49B0A3A651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859098, "uuid": "2bbd816f-7e81-4251-ba28-b259a3f1018e", "value": "3072:w9rAa4yxKsZXEGa4Ka4suNniLZueeThpP:crGyx1XEGaRa4sGniLgjThpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775859098, "uuid": "abdd91d6-989c-46ab-b1dd-4e4be60cfbdf", "value": 205956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775859098, "uuid": "310beddb-4d0c-4062-9352-3914cd89b7e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859098, "uuid": "9634d799-1d54-44b7-9158-2cb9d56c44b9", "value": "manji.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "885965c6-3511-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775848484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775848484, "uuid": "998d5523-0a84-44cf-9aa1-7046cb3f9beb", "comment": "Malware payload", "value": "a049796696d2c9e9f03b258f79ef1e80", "object_relation": "md5", "Tag": [ { "name": "c_x64.node", "colour": "#895785", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775848484, "uuid": "38be43eb-91cf-41f6-8d48-0ca7388934ab", "comment": "Malware payload", "value": "c7ab7cd59325272f114aa5f77c1cd0efe0e7d93a5bd7414c0faff9d7c9f2e38b", "object_relation": "sha256", "Tag": [ { "name": "c_x64.node", "colour": "#895785", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775848484, "uuid": "e1d9dc1a-f5f1-4014-bb7c-7776c28ab2de", "comment": "Malware payload", "value": "57b2a25d996b15b8936aa666bf3670b2fd24409a", "object_relation": "sha1", "Tag": [ { "name": "c_x64.node", "colour": "#895785", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775848484, "uuid": "701a65d4-0f25-4291-9455-9e7f10bb36f8", "comment": "Malware payload", "value": "3e6eefc6aec9201c7bfa8a3202ad543441204e5be6be2e7f3762653ce53d4fcec20ba598a8cb237813d7c9f113784db3", "object_relation": "sha3-384", "Tag": [ { "name": "c_x64.node", "colour": "#895785", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775848484, "uuid": "9d04e44b-475b-4a12-aea8-857e130898f5", "value": "T1DD658E07B3B800E9C077C179D9161A17EBB1740513649BDF65A0CAAA6F63FE21B7E324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775848484, "uuid": "48d3634f-db3f-4e7a-9303-7ccbecb88f2b", "value": "d28b74c90862a3d1412c0dcac614f21e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775848484, "uuid": "d20d32a2-fbe1-45c9-acd9-649d6ecdd0f4", "value": "24576:xws5WklT9JgRMhL387WURFAxWk2UafoQAjz+cFZZ24Jodvz097i:d99TUjAxWkOoQAjz+oZ299", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775848484, "uuid": "4d4a503c-a464-45a8-882f-351530720b03", "value": 1491456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775848484, "uuid": "365e8424-118c-47a1-99c9-7bc734d5c2bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775848484, "uuid": "d31cacfa-ed43-4e5f-bc72-a0331004fa7d", "value": "c_x64.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48803371-348a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775790395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790395, "uuid": "0fa45b8d-39e7-4a87-9635-035297134ea5", "comment": "Malware payload (Mirai)", "value": "915ef5218669aefcad5981cf908555a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790395, "uuid": "2df42661-8754-4ed3-ae9a-87f9a623082a", "comment": "Malware payload (Mirai)", "value": "cabc763794c9ac16471f8cce9d3ea73efa527568e5329081041eb57ded9a1a7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790395, "uuid": "850e74e8-be41-4e23-a4ec-18af0d84726b", "comment": "Malware payload (Mirai)", "value": "b4f5ad8611cbdeaeec63ad3636e5e1ba3d45b362", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790395, "uuid": "5560363a-3362-42d4-8191-e3db7a53041e", "comment": "Malware payload (Mirai)", "value": "dfb68dfe9208f2f97d7073826eeb94420b3e41f1f204a6c898e893db083d4a5cef4544fa27e5da942ce56d80306fc6c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790395, "uuid": "3bd008c9-b7d0-4198-96d7-d867cd2f4766", "value": "T19F331A95FD429B12CAC15277FF5E4349772A1398E2EE3303AA259F31378B95A0E3B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790395, "uuid": "36af832d-d234-4e26-b2d4-5a9668b35832", "value": "1536:6RIrwPv3QYrOAtKDeXoCU65CI7/0mYgRPRcO4:6RIrwPvQ6KSYCf5Ci085RW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775790395, "uuid": "f15a5a59-b748-4723-842c-84ae79632956", "value": 55000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775790395, "uuid": "03af60c0-907d-4b9d-8716-e1d80d21304a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790395, "uuid": "2c6569b0-add2-4c13-8cb5-823e05206556", "value": "Clipz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d4b7ff-348a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775790276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790276, "uuid": "262c74da-610d-4702-92be-592debe7a5c2", "comment": "Malware payload (Mirai)", "value": "d9e4125017d28d04e7374ced6e424076", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790276, "uuid": "dce0e075-0e77-4aa2-a914-1bb5c777691c", "comment": "Malware payload (Mirai)", "value": "cf5912a34ac1af0e412b28315287fc995019c153ebeb9b618b04ad7836b7e29b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790276, "uuid": "57017aa2-4350-43fd-b77f-093403337dc2", "comment": "Malware payload (Mirai)", "value": "c2852481e9735be72a3a6ada8b90873b66d34d8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790276, "uuid": "6c858844-81a4-4f41-a015-6b88cf34140b", "comment": "Malware payload (Mirai)", "value": "8d67459197e5c9f1c4884153d94578de483b7d7ece5d6a0473e19231604d9dc74dbd612291c63900893b8b0acf1d2524", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790276, "uuid": "ee3030a8-b917-4946-a8b3-794d3bf008f9", "value": "T17ED2D074C2D27EA5DF52AD622DD0A2D09BFA0F253B6288A022C48F2172032167DF7DC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790276, "uuid": "ca6f1af1-dbf7-405b-9618-3c8109b50bab", "value": "768:p13qvMxD0bYl9S87nKJVG2WWr0ZRtQ4uVcqgw09H:TbKCU0S4u+qgw09H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775790276, "uuid": "ae28c57c-8923-4f35-98d5-8dbf8c6e9629", "value": 29860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775790276, "uuid": "d101e042-91c2-4293-9ecd-df8b4d2e9d63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790276, "uuid": "0c71c1fc-709f-43cb-aef7-7cf8cc7b8094", "value": "Clipz.ppc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b74693-34d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775822362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822362, "uuid": "3df435a2-e10a-4e4f-9792-81d551b7d17c", "comment": "Malware payload (Mirai)", "value": "2d249b11f7e34b1d2cef155a19ae737d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822362, "uuid": "bb518cd5-06f0-418b-b84d-b54b01ee916b", "comment": "Malware payload (Mirai)", "value": "d02be191dd30b0fad226464f414a4e1f531755bc95d098278cf85cc3dba27c52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822362, "uuid": "a101ddc9-be72-4f68-b080-d34ab0a8707c", "comment": "Malware payload (Mirai)", "value": "fb9995f364469c17fb9f92c4930740f1a3930a49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822362, "uuid": "e2f313aa-5218-4bef-9f40-d5012ce066f5", "comment": "Malware payload (Mirai)", "value": "34f8d8dba96d457a538c46631ae54861c1694b4a58fa7246e8c0255968f2892d351ac57f6be1d21e472f3c54c3ef81e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822362, "uuid": "8bd633eb-ff34-4e6a-8dd4-fa5343fd8af7", "value": "T167732A91BD815713C6D012BBFB5E028E372A53A8D2EE72179D226F2137C786B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822362, "uuid": "cf0b8e9b-1643-4a5b-bb98-335425eff66e", "value": "1536:86dz9MTC0XU66EeOpX5brAMjztPz+Sbjt+UvAs/hY:86dS6ET3rAMNb+AA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775822362, "uuid": "a3057cfa-04fb-41e0-9cb6-763529722f36", "value": 75392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775822362, "uuid": "27d2fe40-6b45-4146-8e63-64001aed26fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822362, "uuid": "0b6843c2-e84a-4b03-b620-97ec46f3e7d8", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "813cf200-350a-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1775845465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775845465, "uuid": "8245d7a1-5bf4-4822-adc7-52a01f0ed75a", "comment": "Malware payload (QuasarRAT)", "value": "561241e879c02689bbe0fcaebfbf2012", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775845465, "uuid": "510ad4f5-4c24-4a13-8581-b5b8d0d1ebea", "comment": "Malware payload (QuasarRAT)", "value": "d2e62ae95bb3b29044db0ee7f88c6c3a9839e6dceb41284214cf5b821bd268d0", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775845465, "uuid": "be6eadc3-1404-4bef-8d15-7c72e9d4dc9e", "comment": "Malware payload (QuasarRAT)", "value": "cbb18dba5c3a4cde95fae82f4942966f1cc0de7e", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775845465, "uuid": "1ac4e8a0-6a8e-4cd7-b573-35f9cecd61d7", "comment": "Malware payload (QuasarRAT)", "value": "968c564d48a3ea9661aa69e2e67382078ec769a9d7d10bb26ef96cd0a7d331ac1dfcbd7c74b644988a988b6781f50f36", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775845465, "uuid": "1956668c-8ec5-41d9-a01f-c63792a5263e", "value": "T1C565275303851BBDF69D0EC9C94B215B20F2D4677D251298EBB36EEBBC3B9849430636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775845465, "uuid": "e6e68975-9209-4d26-8fd8-dce2deb9b200", "value": "1536:dqdzhoE7o+LgivFFB0QyGd5zF4WcBXLn6gKXvDIG8D+BLiOaV0vvQRqc0Ahp1kAx:Uw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775845465, "uuid": "9d283bd1-6b65-4758-a1d5-3e544871b752", "value": 1542632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775845465, "uuid": "d74bce03-5693-4666-9d2b-4797bb01ae89", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775845465, "uuid": "63bb6fa2-bb35-4163-86d6-838f8d48b2f6", "value": "sloppy indian malware script.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e143c8ab-3513-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775849492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775849492, "uuid": "cf1625d1-155a-4327-a2dc-b1a6aef8ce41", "comment": "Malware payload", "value": "dc12ab8c3a56be2c76c526893da96965", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775849492, "uuid": "adc54823-6e95-4c8c-be6b-067f7a33bbb5", "comment": "Malware payload", "value": "d38cdd152569c93821a317095e0f1a6a7823fae0d756b7fb5000d41ca58c72ec", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775849492, "uuid": "5c3a3ede-3020-452d-8683-2731b5f03c79", "comment": "Malware payload", "value": "12dec222066cfb6fc23f2e14b83be4635f8ec543", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775849492, "uuid": "4e12ac34-d0b8-4af0-a808-5c50ee02be57", "comment": "Malware payload", "value": "6ec560c3344a364591d6fbc4c87059ba488de2cc59855cb081a15aaf39f61260c3447caef4862881b1a4537e6824559e", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775849492, "uuid": "68365f9e-227c-496c-bfff-8a790cd69e59", "value": "T19711A50BEE978311DD5BA5B8171BC3011B498821090AB9D394955C0C8AC13EDA4E58CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775849492, "uuid": "56bdabb2-7fb8-4cee-b2d1-4b7167717cf4", "value": "24:9TT3KO+tKD4m2ukN9+ljSQDy01C3af4WUvUvt:9f3KBtKD4mw+ljf2TqQWkUvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775849492, "uuid": "471767d2-fe41-4dd9-8883-a5ce854a53ef", "value": 1023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775849492, "uuid": "c9ed2a15-9921-4106-a92b-ee1d0e54ba65", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775849492, "uuid": "12c4dab0-4ead-4866-87b0-d7d2e4d5c09d", "value": "Terminovo_Medychne_Zaklyuchennya_Scan.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4877b81f-34d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775824325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775824325, "uuid": "0b660b7d-5d00-4f99-bb2c-dd4762064fbf", "comment": "Malware payload", "value": "f67a5322baf3a20701cc7d34e2672ba3", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775824325, "uuid": "a5922ed7-5cd1-4217-8709-21969c076bba", "comment": "Malware payload", "value": "d3c0823195c5335ef8ffb735d1faf6c3b092c825a3ddd600da73059e14106c1f", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775824325, "uuid": "98cfe307-8602-469f-ac92-0c4f9a12b6e8", "comment": "Malware payload", "value": "5c74b1f3822c32fbfea5dc6ad404bf21283de93d", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775824325, "uuid": "9f8a431a-ed10-4d1c-a19d-bb950c41470d", "comment": "Malware payload", "value": "9bd8e8c04aa55b6adce09a6f3773fe347d25deb698f4e36a17c7d7fa7458575eb8d42391c974c5c23e8ba525924b9bfa", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775824325, "uuid": "ee603b59-ca41-4289-b1ae-e4458df57861", "value": "T137C59E0B6C9445FAC49993328CB65291BB74F8090B3233DB2E90BA747FB27E06D75758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775824325, "uuid": "79e602cb-3466-4327-8d4b-83edc464f4f2", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775824325, "uuid": "68fd4374-fbc7-4977-aa9d-46e85f057b25", "value": "24576:wY6hN+7z+xZt03snWHmZxS4i17hzAOXC5qJfHtLmPJauqdvJG1ZHOESdTFhheleT:wYMQ3+h03svZxUzAUtesNvE/OESdks6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775824325, "uuid": "31b851cf-b996-4b1f-9d6a-9f8285543caf", "value": 2704600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775824325, "uuid": "b05d0d31-8262-40ba-8f05-dc2d8491c835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775824325, "uuid": "575bf63e-b4e6-4207-8699-7765c267090c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f6fc6c-348a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775790301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790301, "uuid": "6b14eecb-bad1-4758-85c0-b6b47823bcce", "comment": "Malware payload (Mirai)", "value": "bd4a9baf3aba356ea720de84a541f7e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790301, "uuid": "0d89a4f6-2e6a-41b4-a0b7-bc95e4a674e7", "comment": "Malware payload (Mirai)", "value": "d4c4d3f6bf8ecc215dc3863b89a3f9b9323026ef341786667f36790bdd5db22d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790301, "uuid": "986734cd-0082-40a4-b399-7c17a312ba21", "comment": "Malware payload (Mirai)", "value": "df80d5c5a518a5f90805ff05fe27b6bebcdda2b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790301, "uuid": "940eb5dd-94ed-46bd-bc9d-41ef3837f51b", "comment": "Malware payload (Mirai)", "value": "71bee8679e3e6c30eae23e834b14d882997cd9a79b2afa10699df3a58e547c5fe2850848fc4e0b3b0de5939ccbcf31ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790301, "uuid": "445a338c-d5a7-405c-a82a-3b378859589e", "value": "T14AD2F135900FDD79D365E2B5110B8E17B860477B6B25E9AA17488BE1CCD83CC62FAC43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790301, "uuid": "003ead3f-507a-4732-a462-7be962b5a5f7", "value": "768:4WNKcSspdGBfsUITb/iBlSaRP9V8BtpQLWGJsgkawDyVzzt:4WNrd7qFv07QLzq+w4zt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775790301, "uuid": "ab47f5c2-1e27-4b66-98b2-4ab2dff81c1b", "value": 28604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775790301, "uuid": "4b5c3f90-6d15-44e9-b0a1-149405bac70d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790301, "uuid": "150f2b93-aabb-4524-bd0e-87de8d510e59", "value": "Clipz.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a837ad6-3513-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775849159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775849159, "uuid": "d06a2e2e-37ce-43be-9ebe-eaedcbb23a1c", "comment": "Malware payload", "value": "aaedfce5397eb9fad737fcea98812e0e", "object_relation": "md5", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "Donut", "colour": "#D418E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775849159, "uuid": "7d527fd8-af1b-460c-a1f4-bb77a41de91a", "comment": "Malware payload", "value": "d60d85614bf1426773801e1e3b2d4614251c011f5a0ea9674336da64cdab0200", "object_relation": "sha256", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "Donut", "colour": "#D418E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775849159, "uuid": "85632920-75b5-42a2-9dc9-b3cd8e67876c", "comment": "Malware payload", "value": "ad6cd975bb088c810d39a027c7fcd64a410b4e6f", "object_relation": "sha1", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "Donut", "colour": "#D418E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775849159, "uuid": "ba815837-4001-4313-8047-3eb535064cae", "comment": "Malware payload", "value": "2d1bc1a158aa9493f6b7a2321d9d33dfba0df9d1fe809fd0dcb1efab1a8817a61815ee0281c780d0ac519efacb508612", "object_relation": "sha3-384", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "Donut", "colour": "#D418E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775849159, "uuid": "771e859d-7724-4630-b2aa-8d568169a732", "value": "T10D358EE3FB7D9FAFE155B07E461883264492A5160A22E0E0D3C9DDFFDD56AB00E30685", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775849159, "uuid": "5110f3ac-1263-40d3-bbfc-35c739afaeb3", "value": "59cf6205f0d55e08de66f73ba4498e82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775849159, "uuid": "cbdcec65-c6b0-48f7-93c9-1f9ac2658a91", "value": "12288:kH5GLcPgsF8qQstd7CzIzsDG9xFW/e/wu/0iW7OU/VwvmnclKjSlo4LcGPPmq8ZG:8u2BUYohCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775849159, "uuid": "222c3878-9083-439b-a43b-bb0befd4ed76", "value": 1115520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775849159, "uuid": "94e17d72-5e34-4428-a8a4-bfe364f59748", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775849159, "uuid": "a5e07a84-70be-4d9a-a990-a6b8223345e6", "value": "sqlite.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4dd9be-352a-11f1-a769-42010a9c0008", "comment": "Malware payload (AZORult)", "timestamp": 1775859310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859310, "uuid": "51d7bdda-699a-48cc-b228-38eb6af3b625", "comment": "Malware payload (AZORult)", "value": "d6fe1a58905a8d6477536a988f73333b", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859310, "uuid": "a9af81d9-45d4-4adc-850c-6a6fc710fe11", "comment": "Malware payload (AZORult)", "value": "d792d051caa23b98f546ca5eae5200f1714d5953958729f8d841ea37a3618b8e", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859310, "uuid": "cc9bb617-045a-426f-ac98-3bf09801c2d9", "comment": "Malware payload (AZORult)", "value": "29d8bc04b2cfbb26d3374c855b799570eb4cd39f", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859310, "uuid": "21bdd0f8-43f9-47aa-8b41-3129a399b129", "comment": "Malware payload (AZORult)", "value": "1c4f94baf74b53e96dcb42fe269faa83965b436dc078de92de830f062ab54a884af5f9258d9e838be93122915794104b", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859310, "uuid": "613e9a63-a27e-471a-9248-b54e832fad1c", "value": "T1C1356CC2DD9E5EC9DC430279C6656CBBE9220C7C53F1548713AB7EA10B3229AB1D3C66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859310, "uuid": "e693ddfc-5c0d-4103-8279-a66b396ccf59", "value": "a0822070808cff2c8d9180fd81953fb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859310, "uuid": "7182229b-1535-4d7f-a077-64b92b5ce4b5", "value": "12288:kVwTHFSU1ToX7miuBO3dSlZ476dxbCtlzb3b2BLUkEJ++aDpK5jMrqNmX/NoiBgU:YwTHJ1MX6iKdxCyBLUo+akpu/NWtui8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775859310, "uuid": "63e897c8-b2bf-45f0-a805-69aa1348f433", "value": 1098736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775859310, "uuid": "9390d58a-10ef-4935-b6b2-7e8715ed649d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859310, "uuid": "2ba6fde3-2498-4817-979a-a6300785f815", "value": "D6FE1A58905A8D6477536A988F73333B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a01f41b7-3511-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775848524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775848524, "uuid": "3c433b0c-d160-4b29-82b5-b1bb75e38f86", "comment": "Malware payload", "value": "f8a72e93c17a2a2c4246c739789b333d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775848524, "uuid": "64cff702-be15-49c2-9428-f193eb57985c", "comment": "Malware payload", "value": "d7b8bfb0c0e04329b9d226d42cbb5b5dec2a8409596a8abf99a139ddae17c8fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775848524, "uuid": "b2425000-c6fa-4663-9206-036aa97ebad3", "comment": "Malware payload", "value": "89d57113097db68a0ad68e6c9c395fd1c23c4783", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775848524, "uuid": "ab6dc4a8-5ff6-4d1c-869f-059d753e154f", "comment": "Malware payload", "value": "dcdeee33875d7fe90223e576531d446970a20011a112569ee9b5df6717ea734e9dc87c00bd7a26cffdb1b0ac4b8b4f68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775848524, "uuid": "a15be7ee-1c94-4424-859b-1e93e8394f1c", "value": "T1AA25BF83E293919CE01AC171562EA273F537BC459729AFF76390DA361633BD02B7A710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775848524, "uuid": "59983f98-7b34-437d-9f68-7d784b125287", "value": "5119aa243ba31aa561ba123ac413a1c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775848524, "uuid": "8bfeebae-a6f0-4a5a-90ef-a2bbd51b2719", "value": "24576:WKpGhA1Kv2twe0bzRCC+KY5bsY5b5Y5biCc:Wq1KGweUzR9YqY7YU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775848524, "uuid": "a06e5037-e896-418d-be2f-066223ae1371", "value": 1020416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775848524, "uuid": "05df7daa-bbb3-429e-a8be-981d88eab865", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775848524, "uuid": "f9495af7-6127-4915-89d7-4a76ecc6eab6", "value": "w.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "860e326b-34c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775817556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817556, "uuid": "d936b591-ae9e-4728-a48e-d8536f1224c5", "comment": "Malware payload (Mirai)", "value": "c53efa67bffdde47c0ae85ba4304eeda", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817556, "uuid": "66d4ecea-ca89-4800-9ab5-e3503f210060", "comment": "Malware payload (Mirai)", "value": "d8d19ea3f4cb76c515333486298c6962ab980565f4f3d91f83193b3f42087058", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817556, "uuid": "7284cbcd-9c16-4365-85af-d2fd943fe2a4", "comment": "Malware payload (Mirai)", "value": "1908f9bd61693900125577e71af6d18be6e78cc6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775817556, "uuid": "7224ca82-382d-439d-86bd-5a9a34a64669", "comment": "Malware payload (Mirai)", "value": "8e9b14ea3ed5747bf2b9085669e499ae9d96136590b82cfc9033021cc45b23c89116d343bf7805eb098afe9a2cf4f06a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817556, "uuid": "1e531f3a-3f3a-4d92-9765-a64288a232e2", "value": "T1F873A80A6E358F6CFB5D823697B78F219758339626A1C245D16CFE021F7024D341FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817556, "uuid": "d0008d36-a1ff-40c6-89fe-52011202776d", "value": "1536:lo89L2T27mQaXcn6EyvXqaQSjIHOVVU+6Y3zbNZtyQEc8LMk7d42+P7w:lo+2TIaXIE6aZjIHIVU+6ybNZtyHc8LT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775817556, "uuid": "630defa9-469b-4445-9d53-e4ae126c2bed", "value": 80188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775817556, "uuid": "3976e9ae-3e5f-4094-b948-dfc2b1cd5131", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775817556, "uuid": "95eda3f4-8296-45d3-8cf6-85c50a5b327f", "value": "jew.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e3aefa7-34e0-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1775827368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775827368, "uuid": "ff921fec-e1b6-4a84-888c-703291302d91", "comment": "Malware payload (ACRStealer)", "value": "0cd648133d0fcdcf160c1563244a3112", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775827368, "uuid": "217085df-ef1d-425e-bd69-0a8a74e1415d", "comment": "Malware payload (ACRStealer)", "value": "da2420fe041be562a172a1c1e862b6e2256d7c254e3db5ad2d4eb7da8c05e0f7", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775827368, "uuid": "7a27d176-a6c5-4530-a2da-6c68709180c2", "comment": "Malware payload (ACRStealer)", "value": "17e7df1e9e5c464a2fd0935e09d96e829e7b13bc", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775827368, "uuid": "3b87faa2-e5a2-420e-b796-2aeabe480be0", "comment": "Malware payload (ACRStealer)", "value": "285f2815a153f7e1ddeaf2717fcc961d8f11040e5a0f00fccdb4426d9321853e657b66de845d41ecc29ea4e3a62742b0", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775827368, "uuid": "1891a539-879a-4f08-bf13-01c3284e0474", "value": "T1F5F55C07EDB98CA9C0D9A5744473A506BF24BC401B3163E72AE5B3682F73BF0A875B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775827368, "uuid": "02e3f960-4df4-4fd9-bdfe-d4f1f3a940f5", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775827368, "uuid": "7e96ca1d-4d76-4ab3-ad7f-d4d3aa1e72f7", "value": "49152:xxfcF6a1gWAdIwTa0mStuTZa+jp4QclxYflG2:xB1fa0Eckf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775827368, "uuid": "903e58e6-c2cd-4af2-ba20-142ca4035e75", "value": 3556704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775827368, "uuid": "a0f62d4b-23f6-4648-a3ca-9c685e7a9f3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775827368, "uuid": "8105d907-ca70-4328-a535-c6ae90a98861", "value": "SecuriteInfo.com.Variant.Ulise.596178.15885.5406", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f16f981-34b1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775807076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775807076, "uuid": "5941e47a-c6d3-48d5-a6c4-580abe33e080", "comment": "Malware payload", "value": "73671fa1028155ed0d21166038292208", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775807076, "uuid": "ab5f7f29-c9a4-4feb-a0b8-17ea130bcf47", "comment": "Malware payload", "value": "db21c21a5a7505db984b42e75b926bd1e0662338937ab27ac036204eb5d6c8cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775807076, "uuid": "b87b7a21-176e-42df-a957-63028abbab8c", "comment": "Malware payload", "value": "3aa868498d9a2039858ac5ff5102dc26580a0da4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775807076, "uuid": "7ce19a38-dad2-49d8-9813-e17139743562", "comment": "Malware payload", "value": "9862390faf6d41327a9d8bea8c95907547c026332cf50d3f651607070813fda775f85830db8e4e4ebe957fbd519b83f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775807076, "uuid": "3bfcf9a4-51f9-41d3-b7c9-a83929134030", "value": "T10D4302742A0308CDD4363CBAB98FC65739C71B29701F049914B9E2BA6EF315CE9E9315", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775807076, "uuid": "3753ddec-c9cb-4db4-80a2-3cbfdf2027c1", "value": "1536:XtBTX941eYF8NblpuvnwanQ3zWYq40LZt:biMYFJvw6Yh0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775807076, "uuid": "c22d565b-6a3b-44f8-90c4-51068323a02a", "value": 59860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775807076, "uuid": "27ee8acc-086b-45e5-b4ec-d98fd3777192", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775807076, "uuid": "1b76b1be-78cd-4068-abb9-6087cd5a13eb", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78281f54-3492-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1775793911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775793911, "uuid": "21cceede-91a2-4db9-b0a9-2c9843214968", "comment": "Malware payload (AsyncRAT)", "value": "0a9a543425c4e93332027590960c59da", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775793911, "uuid": "5c09dd27-6ec7-4bf4-abb0-f1d5660e8255", "comment": "Malware payload (AsyncRAT)", "value": "dba68a3035a409a34c848cb1218399fb7c9be87e45d0ed618e2d56f5fba19fb3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775793911, "uuid": "de1fc49b-3a27-464b-b206-2e3b99ef361d", "comment": "Malware payload (AsyncRAT)", "value": "8b543cdeb1735da327f48819188d58e82cc5a570", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775793911, "uuid": "79dfa6c9-b0cd-42d3-92f9-f1dae7879b4e", "comment": "Malware payload (AsyncRAT)", "value": "919528b665b73db70c6f1662ada0361ed49437609d0c398d33a13eed12a3c5a404536180fb3c415e58bd56f6a3a13dbe", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775793911, "uuid": "352c1042-5e5e-4c1a-ad64-04ecd9a963cf", "value": "T139549D2174C0C432D8B6103545F5DBBA9A3D75301B24DDDFA7C42BBA9E202D1AB36B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775793911, "uuid": "49a6932e-0581-4117-a80a-30601f7d90c6", "value": "266756be1bed0cb27666e233ae9063b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775793911, "uuid": "a28cbffd-8f0c-4acc-baa4-fb1e0537ba8e", "value": "6144:2FxWrV9tpp1HGEwAsl+XL/axhj+D6ohMogYygN:2FxWrV9tpPHGuLiR+WcMpNgN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775793911, "uuid": "56f6a372-b45c-43f1-9166-ba080bc234d8", "value": 285696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775793911, "uuid": "d69a4ae3-8616-4579-9df0-0ed01fece50f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775793911, "uuid": "110c41a0-a083-4dc5-ba6f-27eb6f4768c2", "value": "RCE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cc77609-34dc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775825674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775825674, "uuid": "e5dda826-7d5b-4402-9190-50f26a211a93", "comment": "Malware payload", "value": "e4095c42efb29b2bda2d2b8a274fa6ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775825674, "uuid": "a95dd04c-cfe8-43eb-a63d-c5d5faaec6b0", "comment": "Malware payload", "value": "e065c3d6bc1470a6c4c162bb9ad28a2ebbc4aac4e28707ef5d7eca82511b7b23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775825674, "uuid": "e67e801b-8e5c-4199-9585-053922c6974c", "comment": "Malware payload", "value": "caa315d843f1f4ebd0ff8499a65c388aec58ba21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775825674, "uuid": "bf83412a-fea1-40c6-b133-39c4dbc0b8ae", "comment": "Malware payload", "value": "6845904e6df3ed17e94ea54f4d65dc6af56a6c5a0d2bda8dc52d2e5fef38d251e6ee26e4711961d3103e58c13eff9e2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775825674, "uuid": "9a90c094-dfd5-431d-a999-b8da58220238", "value": "T13454120A9B86A1C6D047977603E7BB33E81F3905476D01C72BF22B4A3DBAED109798D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775825674, "uuid": "6767dcb9-442e-428d-baa1-6f98ed1fc1b1", "value": "e81d90b230abc81b286482b9dba12e35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775825674, "uuid": "2ec24c75-89ba-4910-9cfb-30a7b2f42e23", "value": "6144:4rKu3E91i0WzVW84Hdpa9m8CYOuqazaNvg+R9H:4rz091mW8Sra9yakg+R9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775825674, "uuid": "370c20ec-e56e-4a56-b41c-bc3f77b602ee", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775825674, "uuid": "ddfdc0cc-24c2-484e-87e6-8ebcf5d03f41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775825674, "uuid": "050a3c39-35a3-4a1c-9b2b-82cf6369fb5c", "value": "Madium-Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cce5901-34f6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775836895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836895, "uuid": "39ac99e8-759c-43d9-a661-497e67c4baec", "comment": "Malware payload (Mirai)", "value": "aa1b9ba5c13cff66048a45de54e235cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836895, "uuid": "7f47f26b-3303-4670-b32f-ec8f7c504453", "comment": "Malware payload (Mirai)", "value": "e17336a77054a7e0435e811cd45cfcf7b670dfac7e6de7612d37761aa07a5df7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836895, "uuid": "305f4b7a-770c-491d-947c-bb1c2aa445f2", "comment": "Malware payload (Mirai)", "value": "8c02e69fef494f7fe8e0f9369e263c525a76e706", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775836895, "uuid": "d46fd3c6-c868-4a7e-a224-eae83897168e", "comment": "Malware payload (Mirai)", "value": "a157aab413268f4417877570efe750092aa5893313c7452eb893c7749fecb699c4e98d546865e6dc33fdcc1a7559e924", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775836895, "uuid": "37f9adb4-3c11-4bbe-92a2-908108d7f02d", "value": "T10DC35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775836895, "uuid": "73d0b178-86cc-4e56-819e-373125deb395", "value": "3072:3atpsoRNjmj1VGCr75MoS9SrPwVrx5tiygw:VoRNjmj1VGFVrRiyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775836895, "uuid": "f5cae3c5-db5c-4893-b6a0-114d1792df62", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775836895, "uuid": "cfe215b6-8259-43ad-851b-61f95f131270", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775836895, "uuid": "43992ed2-bd4f-49c0-91b0-b80175bab877", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da998098-3523-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775856353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775856353, "uuid": "e5dd1edb-1a46-4d19-9cc3-595db9265c65", "comment": "Malware payload", "value": "4be26f0e258058f9b8ac36fe4c28da1b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775856353, "uuid": "11b2ef49-2bf5-4082-9828-f695a00a7781", "comment": "Malware payload", "value": "e37b77f3ba7e26ff9331b0a12415f1350e074275702b9b8f8313e28d6e191517", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775856353, "uuid": "14c54b37-e93d-4a19-bedd-866be8e96682", "comment": "Malware payload", "value": "697f11ce53030e42df9920e6bd8f4a2532fb085c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775856353, "uuid": "9807e695-ad49-457d-91ef-2a2d165981a6", "comment": "Malware payload", "value": "53fc370183a6a1d3837116a4fc17fc3659d58348aa7bab382cf0044c708b4d02bd4a5a042fd959a6797289bbc80f7636", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775856353, "uuid": "4f944d4f-4b4e-4e96-ae27-80281f72830e", "value": "T10DF2E0916DC810A5E6048330B5B2AE44580771CEDAC53E8977C96AD46F02AE9C7FAFDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775856353, "uuid": "430f5332-106f-4cd9-885a-cd6623229c4a", "value": "768:VZwOJ1GXMuhbTb+6RBVI9u8xGyfy6cuP1mALhSt8q1m0Qx6l5Pw37asO:VZj1EMmbTOPGqp9mAlC8q3QAl5Pw37DO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775856353, "uuid": "17900927-db68-4dad-bb78-7c2faa8c5460", "value": 36870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775856353, "uuid": "b5ae8269-6bda-4c65-826d-92fb784f795d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775856353, "uuid": "662be9d9-c487-4ffe-8fc7-7ac4378a6ecc", "value": "Dienstangebot_Kensy_A_08-04-26.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1984f55-3535-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775864015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775864015, "uuid": "fb46b20a-5544-4f6e-95f6-6f4db2f925d0", "comment": "Malware payload", "value": "d5dabc5dfcf1c15ec264e947a068d071", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775864015, "uuid": "235da410-bc6c-4776-a5d7-fd4639d7e86a", "comment": "Malware payload", "value": "e48cf015b4857bf9bda81dfc716fcb6eb1722dcfad4e3dfdf45849ff4fd36080", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775864015, "uuid": "1d85128c-4a04-4f2d-87d5-a46aed847977", "comment": "Malware payload", "value": "65347336b989ca88a36dbeaf581e000b8c4e3b89", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775864015, "uuid": "9a26ca88-7baa-4f26-90cd-3512053f9e15", "comment": "Malware payload", "value": "57b71916dffef5fd0daa467b4c7d3c2861f7c527748d37bae6ae0e3f8641b2c1947da18d56bd2925a1d48241325f2d17", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775864015, "uuid": "e342c450-5b7b-4920-9781-a19e5b9790a9", "value": "T1E1C63360336062F5EC23C1734F4EE30995B8E2F5278A6F5751099E1EAEA32671A174CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775864015, "uuid": "6b4c4ace-c5e8-4686-883c-61286702a2b8", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775864015, "uuid": "394b7870-be4a-43c2-92ef-c91251e0f657", "value": "196608:+p6o8KFYTQj/v+IbnXoCAYtyAwKsNgUQTsbk9d+lmXVffJ2BcTi+dSPZVVWsFb:+p6yyY/2EXdtyABTsSzpfvT3AvVWsFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775864015, "uuid": "d116cd2a-8d51-42a8-a4c8-a4d381cf06a9", "value": 11997466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775864015, "uuid": "0ce90e60-8ea4-49a0-9ef9-21385bb6fb52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775864015, "uuid": "65c90a82-05b6-4c2a-bd0d-12fbad4df663", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd816fa4-3510-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775848197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775848197, "uuid": "da39f979-656d-4d71-9a07-c6b1700af1cb", "comment": "Malware payload", "value": "e2366ea1e4a979d64bd4b11256d3ad5f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775848197, "uuid": "4df8bcd9-e01e-4ff5-a76b-f73d365376fd", "comment": "Malware payload", "value": "e943b58112f58517b95424dba9334bf97c5dc2dd2f069dca04b9e75b9fec56ba", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775848197, "uuid": "3394488b-3f78-4516-b9cb-51233ce850f8", "comment": "Malware payload", "value": "8dd90aef0e675710a059cc71e3bb35aee86a5c23", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775848197, "uuid": "e6ee9d07-a67b-4759-a29d-e296cfb14bad", "comment": "Malware payload", "value": "edebb9da31d7493e5d67b7f52b7235d73e0d6e8e51a08287932a7256e176cc84ecf6d2050d32f804f86e2c761e22c1e3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775848197, "uuid": "a4e71ebc-6052-4d94-99d8-9777a695cf5e", "value": "T14E13E9E5FCA9D93031355638BACDD401FB670A3B055A3104719EAC187F3C799E1AAE2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775848197, "uuid": "8ba81a66-9c33-4dc7-adcb-7bc28791aa48", "value": "384:EcsKQ0VXvoQ2itS7s3RWA0m+EwvE4qN0MH8ns1irDy07Srgb6zakqpxYAVAK:EchQoio334qf8ns10DCx9Kn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775848197, "uuid": "dd568626-c309-4ca6-b106-e4f640c35252", "value": 45289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775848197, "uuid": "12a9e391-7fbc-4eb6-a150-faa883ec7de4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775848197, "uuid": "a287ffbc-04e8-44b4-93c1-3e9167fbfe29", "value": "ghost.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3159bf6c-34f7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775837171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837171, "uuid": "0adff0f0-6593-4417-92e3-2a9fde676bae", "comment": "Malware payload", "value": "aa271401a5549a1d3fe81aa32dc845f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837171, "uuid": "57ad3f28-00b8-49be-8eff-43718cb0e205", "comment": "Malware payload", "value": "eb3158cb96fef3760693eadfeea3e170bf165355abc9f37009318699ae7737a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837171, "uuid": "40b81369-02e4-463a-9f02-de7a19b7b806", "comment": "Malware payload", "value": "2ac282234ec9ebe2b8aafc1b1307df86152c75a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775837171, "uuid": "6bac7e35-d755-44f6-8b94-79a0740c3418", "comment": "Malware payload", "value": "981af238351dc61d04c4fbd97b3e7dbe2930ddedc11a4123aabb60eb2e7213662d5a52f9c96a255b7bc4816467541c96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775837171, "uuid": "b6fe40a7-b8c5-4e34-b2b4-f47d121c840a", "value": "T185083343F79541ECC16AC175861A5232E772B88907306BEF6AE84A213F53FE05EBD358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775837171, "uuid": "329d279e-cafe-45d6-aa47-d4945a756b45", "value": "6c46f7d0748ef0510db51cfa429597cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775837171, "uuid": "5fbf2c0a-524d-4b1c-8c5b-0cea078bea46", "value": "1572864:Cvp+IIIf423aaGrn/9i0SAJnr39MiQ0jrLvDt/FMg8twMHF22wH5HF:GVz4ja+6MrtjjPrFF3Ww/Zl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775837171, "uuid": "bd39e6ac-fb7d-4c6e-af47-c526172ac75b", "value": 83893480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775837171, "uuid": "cce43dc9-477d-4a9f-b3a6-dc8a6130b470", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775837171, "uuid": "98433317-436b-4249-bed4-3931681b8886", "value": "nvsvc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a02ef8-3497-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775796129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775796129, "uuid": "05c6cf45-8547-42ea-ba89-5ac7cb38a995", "comment": "Malware payload", "value": "cdc459a866361463d719bc89622300f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775796129, "uuid": "3d44d243-2f66-4f25-b8d6-e43e6ef321b9", "comment": "Malware payload", "value": "eefc0f986dd3ea376a4a54f80ce0dc3e6491165aefdd7d5d6005da3892ce248f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775796129, "uuid": "69921e23-68c8-4c31-8e5b-034428b2943b", "comment": "Malware payload", "value": "02a53d660332c25af623bbb7df57c2aad1b0b91b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775796129, "uuid": "f3f77bdf-5ebf-4617-9ea8-0bae31a5c46b", "comment": "Malware payload", "value": "e1da71bfd61179b1dff5d5dd0d3d64527a5fe5ccf8985efcfce68af873777f4636774583f94c998893497521348bb480", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775796129, "uuid": "f2f66576-7ea7-45c3-a34b-b0aaeef130ff", "value": "T14516023FB24B653EE06E5A3539B7E130583B6A62A5124C1696F4C88CCF650B11E3F787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775796129, "uuid": "17e2ba18-d45d-498a-8167-1851cb35e544", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775796129, "uuid": "f85d219d-62bf-4438-bb09-ca3f75b83962", "value": "49152:VuI2hj6XF18ahT8kRdwIcwcBQSuBP9HqT9LnTiHejJkT6Dt7ON9Vnc:V5Oj6JR8kRdwIHcBIHqxLnmMBJ+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775796129, "uuid": "319d0f81-050f-4463-9187-22d30f8dfedf", "value": 4233610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775796129, "uuid": "a4bac648-3e27-4d69-b4af-75c4984cfa22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775796129, "uuid": "96921c60-3e59-46e8-8872-f5fc2f58a40a", "value": "HWiNFO_Monitor_Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3feec946-352a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775859100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859100, "uuid": "d86c431a-9ae3-4c15-8ecc-b85639d3ace2", "comment": "Malware payload (Mirai)", "value": "811376f5b3c44bf204e23f5fef0d1760", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859100, "uuid": "ea3a6a3e-1f13-4775-8d60-d0184daeb386", "comment": "Malware payload (Mirai)", "value": "efd62281f4c12df203b4494d6da6209a394360629f93908b65facd57e04e4f61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859100, "uuid": "9447b853-130b-42b2-8af5-1accb58a7f70", "comment": "Malware payload (Mirai)", "value": "c5431749d913cdc8e083f4bc3af448bc6fc4bca6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859100, "uuid": "4522bcab-c923-49a8-ab0f-20a33cc7f07e", "comment": "Malware payload (Mirai)", "value": "aa4fb646f501e8bc954df8c8afd7382311e8ac3af5b8b81f6727a0ae1d7443bd9078dd922efaa0ae6318d9f0ccd684a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859100, "uuid": "9dc15cb1-a6d9-4b14-9e79-9339b9c6e6a7", "value": "T1E772CFA123C23558E332CF793BE8340ED05C491371695B146DA5A20AD96FB245CBAFFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859100, "uuid": "34a75246-3be7-41da-aeac-902f354bfa7b", "value": "192:KXs4Lyi82so2yzXtb1MQFGKVeKJRT6XXmBrdIQG2tdaOqGM5V6LsDdvrY6jdE7Fg:yb2eX3zAKuiNPZRwwqdvrrduMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775859100, "uuid": "13bfa921-9852-4db4-8bb4-3df6380a4921", "value": 16920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775859100, "uuid": "0a958796-447b-4934-9773-4baf15c80a8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859100, "uuid": "221a20aa-7eae-43d5-b031-be7f5fb2b664", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1039680d-34e2-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1775828096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775828096, "uuid": "10160170-6d36-4c39-b0d6-4b5f85277878", "comment": "Malware payload (RedLineStealer)", "value": "42d4d03e34133e506fc34374b5dd17b7", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775828096, "uuid": "1f90eee4-4a34-4c22-9a95-53d3a3b60200", "comment": "Malware payload (RedLineStealer)", "value": "f2f1ce463633713f8bdd95ac80b55a04ef28da729b768f622aea00fbc45bef0c", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775828096, "uuid": "54271e2e-9744-4a8c-81f5-a19121c5030c", "comment": "Malware payload (RedLineStealer)", "value": "5d882fd51438b55ad7623d2725d6b275af2c0a93", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775828096, "uuid": "572a4010-112f-4039-8d87-04a41fc0b189", "comment": "Malware payload (RedLineStealer)", "value": "a19ff61749c2a425571f64f92869067b5e2c06d342d299286798a720d648f29cd07f2ef46155b07e30d05d58fa3c8a64", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775828096, "uuid": "9dec122e-5e6f-4601-995b-36fe17af10e2", "value": "T1B2843910A6C18BE1C456F6B84EE4D630C7296CC81BA096FE9E7CFF558630DA0DE3059E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775828096, "uuid": "8aa43e56-edc0-4dc5-9af4-e89d6ff1352c", "value": "59f37c13d2cae7cc547b602d07aa7033", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775828096, "uuid": "46826399-9a40-4574-8ab5-1f7786e6e11f", "value": "3072:KXiZYkCItXCGpSFRSJyE18jSaCTBIJCfCr8OIRachyk2Wh/RgaaJzUxtVmj3qh8l:KHkCItizSJJwYmUU3yacEkMzUD0Fl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775828096, "uuid": "051587c5-0421-42ed-b98e-18281d40b9ff", "value": 382976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775828096, "uuid": "03d30f82-8790-4969-87ee-217bf43502fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775828096, "uuid": "105a26b4-c62e-4938-a925-2742d04f9011", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07307328-3505-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775843113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775843113, "uuid": "58eb6623-56e4-488c-91f8-6b294332dfad", "comment": "Malware payload", "value": "9b0c8c538f116d92a706255ef4ec67e8", "object_relation": "md5", "Tag": [ { "name": "212-224-88-236", "colour": "#4871DC", "exportable": true, "hide_tag": false }, { "name": "BTMob", "colour": "#3F15CC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GANGSTAR-REMOTE", "colour": "#BC4895", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "t-me-risadinhaxx7", "colour": "#2D9C21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775843113, "uuid": "cd08bd93-0a5a-4ad3-9b22-e39ac1d6e7d2", "comment": "Malware payload", "value": "f5eb88f83558ea80b8cf4aa890b356be1a2e88985e35aa538c4a0c0c6241b4e5", "object_relation": "sha256", "Tag": [ { "name": "212-224-88-236", "colour": "#4871DC", "exportable": true, "hide_tag": false }, { "name": "BTMob", "colour": "#3F15CC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GANGSTAR-REMOTE", "colour": "#BC4895", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "t-me-risadinhaxx7", "colour": "#2D9C21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775843113, "uuid": "326a55de-b9f4-4c15-9868-47aedc69cd82", "comment": "Malware payload", "value": "2132ad0316ffb615d71ff20fb21dbe69d5ec3c38", "object_relation": "sha1", "Tag": [ { "name": "212-224-88-236", "colour": "#4871DC", "exportable": true, "hide_tag": false }, { "name": "BTMob", "colour": "#3F15CC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GANGSTAR-REMOTE", "colour": "#BC4895", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "t-me-risadinhaxx7", "colour": "#2D9C21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775843113, "uuid": "fc52b3ec-d8f1-4b13-9cbf-098a0e988523", "comment": "Malware payload", "value": "9a28be462582daf37bd3e0031cff1567b660f55b3e0affbf020c2898a97bb1057b5b47907e12dbc0bb0b098f5cf05a6b", "object_relation": "sha3-384", "Tag": [ { "name": "212-224-88-236", "colour": "#4871DC", "exportable": true, "hide_tag": false }, { "name": "BTMob", "colour": "#3F15CC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GANGSTAR-REMOTE", "colour": "#BC4895", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "t-me-risadinhaxx7", "colour": "#2D9C21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775843113, "uuid": "c47ee4d9-ce70-4ed9-8e8d-5865b268c8d4", "value": "T1D617CE87A39A9439D49B02304C3A851E9BF47D0EC71E8D8BF28FFC645B72771B55620A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775843113, "uuid": "53748f52-bc30-4068-af5b-f939fb9df6a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775843113, "uuid": "79e1b228-6443-4be8-811f-f37d076e922d", "value": "196608:4s1wLd5sLdfZJHd5sLdfZJ923njibSTjCpAG5uHgOx9kGYhjfHrU6Q/m5u6U6Q/:4vdOZxJHdOZxJ9ujiGdVxzaTHQ6+T6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775843113, "uuid": "0963ccbc-a984-464d-8f3d-86ff25fb0114", "value": 19011584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775843113, "uuid": "e1c59f32-0030-43a2-ab9c-4cd4bd6c5662", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775843113, "uuid": "71aa7c04-f17d-42e9-bc52-952fb253bfa5", "value": "f5eb88f83558ea80b8cf4aa890b356be1a2e88985e35aa538c4a0c0c6241b4e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32ae348-34d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775823645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775823645, "uuid": "1f9d0ffa-7be0-45e1-b7cb-9e7751e4c018", "comment": "Malware payload", "value": "7022e2fd0e02769ed7a7a5e99758aa42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775823645, "uuid": "f55b545e-acd4-48b8-9925-fcae4b39ffb7", "comment": "Malware payload", "value": "f93c8086daec765e31b04d253d33a1b369242d27eb8d797109d1a1a350250937", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775823645, "uuid": "f7066ee0-330a-400b-bf3f-eeca88a35442", "comment": "Malware payload", "value": "bfd97adf7b9bf1286d1f5ca4748860b3aefc31aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775823645, "uuid": "afdf2f23-5df1-4d2c-a58d-61a9eca41f77", "comment": "Malware payload", "value": "de75426ce92fe9c702f0a7a72ed92b515559215a5075d74b0977c2fb4dd39d5ff1f4657b4430060093765acb013cb703", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775823645, "uuid": "24603ccf-2981-41e6-ab5b-a2ebf7d315ce", "value": "T142D733D1FA3F1F7AD8D9B1798C7D42930046DFCFAC20BB9B5F5E21A9A335A126200561", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775823645, "uuid": "67ba6201-8772-40e5-9545-bc89b4ee2683", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775823645, "uuid": "6e8673aa-a387-4511-a9f0-bbc414ac1331", "value": "1572864:E3R+qvDoeLH8oJaFOV+8iHdPNJo6l+wFAxG6DJLt2:E3HDZLH8+a5p57oWAxGS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775823645, "uuid": "ecb2d49b-8532-46ac-8e55-1ed613eeed3c", "value": 62492476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775823645, "uuid": "15de1f4a-d007-4d12-a27a-66b1cdae6319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775823645, "uuid": "bb083016-1fb8-43d1-924d-77b9c8438a2e", "value": "VolimorSetup1.2.6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e065c3f4-34b1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775807400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775807400, "uuid": "a52c093a-428d-45ba-90f8-fff8f03f5406", "comment": "Malware payload", "value": "2eeb47727d9b3829bcae170ddd6d9798", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775807400, "uuid": "f36a033b-ace7-40f2-9dbe-a59c7edd18be", "comment": "Malware payload", "value": "fa0f7a7789961d7cffc78d0413c374d2e1f8ff06438d9bd14ca4c4080a0704cd", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775807400, "uuid": "47506fd1-b8f3-41dd-acc3-724bc950569b", "comment": "Malware payload", "value": "f19368775d101ef0cbeb014a7fd1244095cf6d90", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775807400, "uuid": "5a7bc88c-fc66-4563-860e-b949499598e0", "comment": "Malware payload", "value": "18c3390d52cda5273395fc5a859a1e372573bf8abc2e7206cca0698834b1f3a7eac3242f2b403daca9739816ddc03876", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775807400, "uuid": "698ccdf1-998b-4a59-92a2-e61bdb54530e", "value": "T1306633ABD40F9D4AD990E4E1EF852BE4C95D52109FC2CAE5F64E10439DFB668B10A3B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775807400, "uuid": "b688136a-cfda-438b-93b9-50add1959c76", "value": "196608:JnfIZ+irZacKwPAu7b3Vln2OCk/VETK5y:5IZ+OZa1wZ/3VlxHETOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775807400, "uuid": "65b9971c-324d-4cf3-86a2-4d357f86eeaf", "value": 6850193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775807400, "uuid": "7f0fb31f-0fd4-4ff3-88b0-f649f494be21", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775807400, "uuid": "afb12b7f-0484-4ed3-b539-186bf20b4254", "value": "kamaspico-11-2-1-1_900545.exe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99751fb3-34d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775822313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822313, "uuid": "49ba1156-f207-4a75-b765-10997762af49", "comment": "Malware payload (Mirai)", "value": "9299d5abe7f9931d09fd18d305b5d14f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822313, "uuid": "7770bf4b-c42c-4c1e-84e2-5049396427e1", "comment": "Malware payload (Mirai)", "value": "faf66ec55dc5bbf41142f09ee4f50c967d937277388a3cfcb449a0a6ab9540b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822313, "uuid": "c9775cca-4b7e-4177-a3ec-44cbe21b3748", "comment": "Malware payload (Mirai)", "value": "f5fb716b5d1d2bc254db90bab467600c4ee9c64f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775822313, "uuid": "d38c9d5d-2906-4fd5-b236-a020a232335d", "comment": "Malware payload (Mirai)", "value": "b275b290e41cf9c90116b81cf0c526f21ef423f47f2785e179924a603b877c30c68c04099c3581b996ffc3d832a45520", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822313, "uuid": "535a5387-d5dc-4c7b-b265-9b0e4defe6d7", "value": "T1B603E1BECE5D65EBD4EFAEFAB16A030937097052319BC34D93444C19FE589AB31874A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822313, "uuid": "e95d9bb6-25f3-42a6-820d-070525c2a26d", "value": "768:cVyIwYjG0JFZa0TowHE8hPusdsgRIir3jwSj7LIg+M/WJ:cVyYjXJjaqowZm25RIirnj/InMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775822313, "uuid": "da78b476-24ac-4f5d-97a9-b6d79fa29dbd", "value": 38096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775822313, "uuid": "eb4ae367-db4a-474c-b2a1-5af450b3c3b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775822313, "uuid": "ba622f9e-2966-4573-b1b4-9f2114a45226", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6189a76-352b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775859781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859781, "uuid": "193d6274-a03f-4c7d-aac3-c0271367eb21", "comment": "Malware payload (Mirai)", "value": "7dea0d12f8c68c8bd539f3fbc8e3811f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859781, "uuid": "5db529b3-4364-4d20-87c3-0958a1809a49", "comment": "Malware payload (Mirai)", "value": "fd99c320f67a530785e33b3f5cc913c349a38edf9a503ee9884a4a0e0a7e6a06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859781, "uuid": "eb2c3897-dfa1-4a2c-b4e4-888c6d046d95", "comment": "Malware payload (Mirai)", "value": "448b30ea91f3d3a0c2c8a71ccfe537ab958bf33e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775859781, "uuid": "4eaa5b17-a990-45a8-a508-f89fbabad829", "comment": "Malware payload (Mirai)", "value": "180bb2e1cb8ea54486778072787bf3df546aad73068add28281d0df1524550c35576fdd747bedf1790d726c19ac2a16a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859781, "uuid": "a31fa622-abc8-47f8-a5f1-0f2cb475fb33", "value": "T19B730271217ADDA2D5B1843263837D59BD22887A037893BEBD79A72FF886E11580C44F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859781, "uuid": "d1fcfacb-105a-4e94-a547-31b88a4ff951", "value": "1536:n8zRnwvX0/jMQwZuOPFPijvDMwhQi1rYGhQZ9zWmAborb:8zRnwP0bMQ2RijvDZZ1rYGhG13AbSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775859781, "uuid": "8f1ed107-d381-4fb4-a419-f67dd4555e8b", "value": 74772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775859781, "uuid": "75d9f5a6-e3cf-4838-9c5e-5aae39e1435a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775859781, "uuid": "8dd51019-182b-418f-b4e0-3b41bb059148", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05858bbb-348a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775790282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790282, "uuid": "e963a95b-b374-4c55-8159-017631d4fa52", "comment": "Malware payload (Mirai)", "value": "e5adb6798d28bed8b29f5a36894e0862", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790282, "uuid": "81a22ca1-9494-497b-9f36-54ff0743e562", "comment": "Malware payload (Mirai)", "value": "fdaa361e18f2c0f7df81fe239d713672edc8f27166378431db183461001eb178", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790282, "uuid": "a120b16e-776a-4120-82f4-f0e82121f632", "comment": "Malware payload (Mirai)", "value": "2d59d042c12bdd9fa898015ab86f3439567d793c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775790282, "uuid": "439ee472-072b-494a-93ac-a9583cc9c939", "comment": "Malware payload (Mirai)", "value": "775c310ad6ec17dd3c28a444ea3824445cb477b2e08631a1af36e61c4fba516cc1eb558233a08cb45fbaa20792c26f57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790282, "uuid": "608b2072-948a-41ab-a9a8-5ebf07efe701", "value": "T1476309D7F800E9B6F80DD73B4853450AB230F3A20A821A767357356BED7A1991877F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790282, "uuid": "5e6ffb0b-4fae-4985-b4e5-aa3736733733", "value": "1536:tUcb8F+vAKGfyqF5URSw949I+Cp25WnrLU1ziZJgrW:6cjAffyqF5UTyK+G25AVUrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775790282, "uuid": "060c29cf-808b-49ad-8aad-978d8cbdef04", "value": 69800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775790282, "uuid": "d8fca821-f9ab-4aff-9d34-b1cc9a9cd58c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775790282, "uuid": "610bf13e-5fbb-4705-a308-3ff680276fd1", "value": "Clipz.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2a8693-34fa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775838400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775838400, "uuid": "fc0efab3-a1b0-464e-b926-81efa3f9d153", "comment": "Malware payload", "value": "a8c9c3387d47f77b83ff6b439a1ef31d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775838400, "uuid": "a4be5ffd-6d10-4098-ab6c-0bff4c20d919", "comment": "Malware payload", "value": "fee2388088ec2c4b7ce16dbd929a286461d33004e37dda397d95c094201c64b3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775838400, "uuid": "c8f62173-8aa7-441c-99e6-c21686085358", "comment": "Malware payload", "value": "2b6ab0783c641e39681d4d4a8c73fb499cc3702d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775838400, "uuid": "351e849d-1171-4478-939c-13f24a8f7af5", "comment": "Malware payload", "value": "8b5ed97b44d9245e71e47c1f50579412e57993e8fcf077c2f25a19cdc8aea191deb28d053f933bd5caf784e675f18f88", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775838400, "uuid": "b51d1af2-586d-41c7-b5eb-759a97dcfd2b", "value": "T15D06AE5AA2EC41D4D8AAD138C907490BD7B2F8650273C7CF01B58B5E2F372A25E3E765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775838400, "uuid": "26853115-8a37-421f-9756-d4f86b905152", "value": "d88c2a621973d4257ff4a4778788c617", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775838400, "uuid": "adcf4653-3be0-4f8f-96b0-3e894f229b77", "value": "98304:p8wVygrwzUQkit7dwKgxfzXTeuIrH15aeB5zMlsss2qinFBGq:ewprv07dwKgxfzXTeuIrH15aenMlsss0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775838400, "uuid": "14e87120-760b-4af0-9a95-4b131c4c95e9", "value": 3828698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775838400, "uuid": "d907bf6c-065f-4c2a-be19-518b671620df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775838400, "uuid": "d6c8e328-74e9-4bf5-a884-ac3862a48171", "value": "-\u70b9\u51fb\u5b89\u88c5\u7b80\u4f53\u4e2d\u6587\u5305 -(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3337911-34e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775829255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775829255, "uuid": "00aba005-44f2-476c-88a9-56adf38c2e9d", "comment": "Malware payload", "value": "692c8bd699e23d898717d0470cbc8b1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775829255, "uuid": "cd1c8f76-3484-4c30-a45b-fc0b757c5d3e", "comment": "Malware payload", "value": "ff6c730ac952c8d697ea9f02117355b70dde48600155ecb4ca660e4dcb0b47b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775829255, "uuid": "3b54fa7a-d9db-49b8-83bb-2466517581ff", "comment": "Malware payload", "value": "308c27b198978dcb0b1ff9ea00d5a4a40b846f97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775829255, "uuid": "8b7eda0d-7fca-4224-9ca9-ef667d4acad8", "comment": "Malware payload", "value": "b57e24b738d339749d35ac5e52a8be4457991e41e08d6c293905b1516bb02a6aa1cc965d383006d3878584cd94ad5696", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775829255, "uuid": "b2493691-8105-46a4-9770-3124d7b9aa91", "value": "T12E267CAEBA7E5399C4B7C1B0E6B38186E53038459B7096DB2384535C2A731F09DF72D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775829255, "uuid": "d3c57833-ebe0-4a43-910d-23bf8092ddda", "value": "8b58c25d39acfac15143d9c5019818c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775829255, "uuid": "869ef013-dc4d-44e8-b674-41f39ad67c21", "value": "49152:NjFCA7zd5/lAdq+jbASuEmBNj9WS7NQRyZmuJsv6tWKFdu9C4PTvG7D/pHFhh6Ds:JTXdrr2KJsv6tWKFdu9C4i2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775829255, "uuid": "be44eeff-74ef-41fa-8d4d-55458f3c7eb5", "value": 4469248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775829255, "uuid": "229260b5-d8d0-4fc6-8401-5ef8395ff37d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775829255, "uuid": "1354e49d-71eb-4fc5-bf70-e1bdad43daca", "value": "aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e631722-352d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775860547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775860547, "uuid": "2fc59335-37f7-4bd4-a27c-275f8689d578", "comment": "Malware payload", "value": "33007e9dff99a5c971f290ac5cc56186", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775860547, "uuid": "16182c57-4c8f-4004-b82b-0674c331d37d", "comment": "Malware payload", "value": "ff8b253d33a2c8313553471fbf94e2bb97cce71788a7f0bd44b5e97e87ec0482", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775860547, "uuid": "f801ef09-8910-4216-800b-73a8313c7379", "comment": "Malware payload", "value": "36fcb2b900c9fb90b1f01ff59b72e1a7c3dca2d4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775860547, "uuid": "f8de4df2-34d9-47b4-9a0e-33c36fb6005c", "comment": "Malware payload", "value": "e71c6b052d77bcdbc09773bba77e7716979e0c4b4fc4af3656d7927a3b1002eeab69b86d740d87d09d7371a00e206803", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775860547, "uuid": "d9e79b51-7bce-4451-bb73-4bcdb9855734", "value": "T16E136D6526953C25AE99883B5D7F2F0CBDA983E1304491DDBF8A3CF18C15A9CE318B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775860547, "uuid": "baeb0f1d-e8b4-452b-8db4-516ca2168f57", "value": "768:b/As9NyXsZztCM9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:b/dHusZYcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775860547, "uuid": "7542467d-a54d-44b5-bdc3-1f1f66e17a56", "value": 45515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775860547, "uuid": "7f0f030b-d8bb-4f89-8d74-4b6a3bef7dd7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775860547, "uuid": "d0b74005-d717-4e79-a838-48035d426f48", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }