{ "Event": { "published": true, "date": "2023-09-02", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-09-02", "timestamp": 1693699382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "a3a4c4bd-536f-4b3a-9699-0edfb7d6264b", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca6a6264-49cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693685870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693685870, "uuid": "a5d08859-bec9-4f16-9577-a47acd5a4c40", "comment": "Malware payload (Mirai)", "value": "3c9a4beccbaa2ec59da4e55d6c70f869", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693685870, "uuid": "dcfe0b32-b0fa-4c71-b18f-485f0eb9ca20", "comment": "Malware payload (Mirai)", "value": "01e322f369c270078e28f62d1051f9d139dcc8845a0f1d1f686edc19ac75624a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693685870, "uuid": "d5c932d2-6e72-4017-bfa7-a9e0f2ea3287", "comment": "Malware payload (Mirai)", "value": "e979ffba424d2379ba2a4736a531ca5463a4e2f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693685870, "uuid": "58a0b0c1-10cd-4675-a144-73fa2c7aac1f", "comment": "Malware payload (Mirai)", "value": "14b2080449e627cd48755ce16409128c6b1e1f26ed1afd95aae295f7f70eec12b0bd489499ba6c87042a5cb1226ddfb0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693685870, "uuid": "2011374a-ac65-4544-a81c-a3c54b5959db", "value": "T131332942B22C094BF9E65AB0353F0FE093BFE98024E4B585695EEA458136F331586F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693685870, "uuid": "c3ea2dd0-4d83-4daf-9452-274de4ae2e42", "value": "768:/KfsbnHAt1ezbnAgCN7RkIV3fgB1TRNRR7Eg3tbv6VFssuWXwdyrq:k6HAt1ezbnAXZUBt33tbC/3Xweq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693685870, "uuid": "bed727ab-f37e-495a-87a9-18d66a18d941", "value": 51332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693685870, "uuid": "fceb2015-2221-496e-9e2d-600200b69b9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693685870, "uuid": "50af70c6-2247-4138-8ac5-409ce7ae941d", "value": "3c9a4beccbaa2ec59da4e55d6c70f869", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c782aa61-4975-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693648070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693648070, "uuid": "4e2b98f5-c409-4ec0-be1e-0b85f28d7eb5", "comment": "Malware payload", "value": "7529eb73a3d8d2402f5b1b55f818bdce", "object_relation": "md5", "Tag": [ { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "pwhotelnew-blogspot-com", "colour": "#E68D7C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693648070, "uuid": "25e9957f-1d2a-4409-aeed-c0fc0e47d67c", "comment": "Malware payload", "value": "020edb36268ba44f3f4ffce59dfb5ea1f5f9e58cee207a59e4e575a15304530e", "object_relation": "sha256", "Tag": [ { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "pwhotelnew-blogspot-com", "colour": "#E68D7C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693648070, "uuid": "694d2982-ac57-46fb-8cd8-9046b054a27d", "comment": "Malware payload", "value": "191d7f850f36b9d9e1edbe6bb6ae5359aba06263", "object_relation": "sha1", "Tag": [ { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "pwhotelnew-blogspot-com", "colour": "#E68D7C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693648070, "uuid": "ae379e4d-1152-4ac5-a1d2-5fd00e73509a", "comment": "Malware payload", "value": "a71a486f7aa543068fa190e54367eb4d37bb21421b16788e21869f92eede2dd4392f8815cbc46d3e295173831ea0a43d", "object_relation": "sha3-384", "Tag": [ { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "pwhotelnew-blogspot-com", "colour": "#E68D7C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693648070, "uuid": "670caf18-6e10-4573-b89c-4617966559cc", "value": "T138D0A79A2B16968B170553EE253B3658E25CD8C1A03CC497ED12F04D1631E98ABA4700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693648070, "uuid": "289e01d7-dbc4-4428-ab65-2bbda178c086", "value": "6:OQV+GNXoF8RDKRf9K6CQB0RC2w8LSLHX0lP3JE++Xg:OQdFoYDKRf9Buvw8LSolPug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693648070, "uuid": "1a6e3201-3f5a-413e-be65-ff61ffbbe541", "value": 269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693648070, "uuid": "fcfa5035-adf7-41ba-a84f-a358eac14661", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693648070, "uuid": "b2a7fa8f-0a89-40fd-adfe-ca4c442ca31d", "value": "NIKKIL_LORY.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8bd435a-4984-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693654514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654514, "uuid": "399fcb9e-50bb-4cb2-b1e1-8460888d1b27", "comment": "Malware payload (Mirai)", "value": "a6eaaa6bf61485c4fb436f7014e0ce6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654514, "uuid": "dcdb6f87-51c6-4994-82f2-21d5bb22cb00", "comment": "Malware payload (Mirai)", "value": "0506716c9e4f3c15e2fdb77a880c62c7f09267683ea153c1029d7af32e31849a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654514, "uuid": "a7e2b00b-01e1-4d95-8f46-9bd37b00541c", "comment": "Malware payload (Mirai)", "value": "41275ef5ae56ddcbaeea620d6dca08b6b5105740", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654514, "uuid": "625d0e55-7e97-4997-a3d9-e9d7f4027a82", "comment": "Malware payload (Mirai)", "value": "36f667943f8df8ac71b5900e96b4622e85068c39aafd8408af7c1709851bce209e9e2fd608e3f6c20f27ea74faf2197e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693654514, "uuid": "1465ab96-2b39-4361-9dd4-b4579a66576f", "value": "T1FC533C9AF801CE7DF85BD77B4457090AB632B3D102821B3627A7B997BC731991D23E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693654514, "uuid": "6ea0575f-a0d2-4c48-a084-63a1f185bec5", "value": "1536:K04gnXHYK+T3mg8TD6vy+DG5T7D/juN6gayX8Yae:K01nolT3mFoDsTfurX8Yae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693654514, "uuid": "77f4372d-759c-434c-918b-111ec5eb8af5", "value": 61704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693654514, "uuid": "bb1558b9-178b-4643-a630-7313e2728c6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693654514, "uuid": "5ec47d39-ff3b-42f5-b565-b0adde480a63", "value": "a6eaaa6bf61485c4fb436f7014e0ce6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbc0dc1e-4984-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693654492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654492, "uuid": "7e50adf8-5955-40ad-a95d-fdeecb443bce", "comment": "Malware payload (Mirai)", "value": "ad2a9d0bdcaaf46fd524d59b614e2265", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654492, "uuid": "51cd301e-a580-4807-bbe7-6afbd9e9756e", "comment": "Malware payload (Mirai)", "value": "0753ca800fa491de25b6d936cce47f4f66cb5571ee76d922170107cbc71d9ef5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654492, "uuid": "b6e80bbd-069f-4156-b570-79a02982a1f8", "comment": "Malware payload (Mirai)", "value": "85e9a9cc0bb716b3a54d77d556849d23507d8687", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654492, "uuid": "1f9fa6a6-e4fd-4156-bbf1-486fe3d789a4", "comment": "Malware payload (Mirai)", "value": "ac92698f2ba037db330d402e2e48bbace843d12eac6a44cbe6d14040c19c354817045a7c4a049348927937450dd27890", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693654492, "uuid": "cd579cf1-42c2-4965-b7d4-8d6b6cfc089c", "value": "T11AC2E1A1EA116962CC302DB7DAAD5ECB19C10B3C21BFB2B759514A249FC39CB5FB0141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693654492, "uuid": "63fd8231-dea2-4ae1-bcfe-bbc2bb457c33", "value": "768:JMKyhegCCMqfmckeEUYgouvLhwrW9q3UELuT:OKy4qfPfq2wXLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693654492, "uuid": "1881216a-3974-4225-a906-2de4c48fe287", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693654492, "uuid": "f81331b2-0c65-4f5e-9a8a-5b0442dcd95b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693654492, "uuid": "fcf2dfd4-f124-4732-bd43-ea88d19d5202", "value": "ad2a9d0bdcaaf46fd524d59b614e2265", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a64acc6-49b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693674005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693674005, "uuid": "d5ddf025-faad-48b0-bcc4-b283c46c579d", "comment": "Malware payload (Mirai)", "value": "345f30630e1ec04d972796ace288b67c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693674005, "uuid": "970def38-4d4b-4aac-b432-1f8f1e9a4bf4", "comment": "Malware payload (Mirai)", "value": "0b184ae22bb7c8972e1d7de8c05d3c9543fdaa9545bf2539b047ff362ce3979a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693674005, "uuid": "b978c0f2-b9e0-4dc6-bcb4-ca80ad168933", "comment": "Malware payload (Mirai)", "value": "a6a6225cd4bc3267bc984a8095e6587476dcef68", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693674005, "uuid": "97290312-feb5-4255-af09-580783d8ebd0", "comment": "Malware payload (Mirai)", "value": "c289528dbf15f2b94fd6697746e0a3d5e8c3404f6c6a9a488b01c4f4c081d560bd9aa8417426016b0c317e69011d7e18", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693674005, "uuid": "9cea07cc-8298-4549-b609-37b7eed07bf5", "value": "T1E733026267AE29E292B09337FC33AC5A659C17F89C67309A2CF0591573C54024FF27C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693674005, "uuid": "820a5033-fc34-496f-ada1-bb396e6c5686", "value": "1536:s9O/ZMAXIxNUk0tELcPqF1aBexo4opKZbc:s9O/ZNKyBELGqFUFB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693674005, "uuid": "d98f1a41-591b-4b38-a5ea-c4f059475a57", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693674005, "uuid": "18a6deb3-9159-47b9-aa81-e61e23ed8fc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693674005, "uuid": "916764a4-ccda-4c93-9687-6bb6360c7bc0", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f3a5150-4941-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693625668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693625668, "uuid": "a1749e02-1b2d-4f0c-80ec-e0de8e378d22", "comment": "Malware payload (Mirai)", "value": "036cc2a530a703ef797411816784c43a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693625668, "uuid": "b877ef0f-5efa-48f1-80b0-c6ed2ef450c3", "comment": "Malware payload (Mirai)", "value": "129ee4185abc10a5fa0bf210d90de3be149826ae5c2c4930c7023247de23cae3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693625668, "uuid": "a950d063-7121-4d06-9e0b-96ddea2bddc3", "comment": "Malware payload (Mirai)", "value": "c9747283f656435314d9c82a850490930a55005c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693625668, "uuid": "3e86cc34-d8a7-4e3a-89d5-189a5d71d9c2", "comment": "Malware payload (Mirai)", "value": "9fa9855ff84ae2dd074a9a90a6c15850ac47b126d01a58fd8db1c4a32a057a8921886700df9bd05f6a8182062e45c7ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693625668, "uuid": "83e5f761-5f0d-4b98-9a29-da450577df0a", "value": "T1E453AEB2C819BDD4C8008234B522DEB82B53F50596671FB58E8789A15487EFCF51E3FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693625668, "uuid": "cdf03553-d63e-4b38-a7c3-2c600394ce5d", "value": "1536:JacFF3Ec4zhafwt14R6I55d/N2qbnvNL+XOCoMt:J3FFEc4zhoA8/vJ+XO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693625668, "uuid": "eea3974f-f0a5-4a12-afaf-a05a2d7fd371", "value": 63892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693625668, "uuid": "1957bddf-6ee8-4f5b-b637-a71794fe7ff3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693625668, "uuid": "ab1ab977-911b-4922-9be9-2d2510a56fee", "value": "036cc2a530a703ef797411816784c43a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c7e841-4932-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693619108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693619108, "uuid": "cd4544e5-fe45-4ba5-9c07-828cd55caf26", "comment": "Malware payload (RedLineStealer)", "value": "d9c8bc57eff19e15e8670881fa0dcb81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693619108, "uuid": "c3e54870-707d-4f0e-b60c-772bdff8e226", "comment": "Malware payload (RedLineStealer)", "value": "13a6113875ce9745029aaf46433a25ddcb5e7aba9912be66b09e84fedb688f22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693619108, "uuid": "a6d7d446-26a3-4e95-8624-91bded9a6979", "comment": "Malware payload (RedLineStealer)", "value": "f8f5a3b926bdec0be2630d83616506828934b538", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693619108, "uuid": "780c9a80-b2f5-47e3-907f-b8e315bb78fc", "comment": "Malware payload (RedLineStealer)", "value": "cb5525991d7328dda1904eb9f5a9793ed3ac1d19be682ef7be2271ea7285c06dd180fcc18f0c948a412c2d19bb6d74b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693619108, "uuid": "458f2452-1e53-471b-aeb2-f1266d666477", "value": "T1BF7429D43384A5CFCC4F8AF1616257648A70D4C2A55BBB537C8BBCF7386A344AE852D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693619108, "uuid": "7d09b091-f19e-42ea-97bc-b21e3d52578b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693619108, "uuid": "fb5d443a-8496-4f76-87ea-7bb4f8b2f6e0", "value": "6144:XRtS5qaNkaw/Py4HqtMRda71broYkbEVz5eN1a/Ti:oqXJ64Hw1QYkbEVz5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693619108, "uuid": "16b5b1d4-a943-4130-9ed7-714d0001d19d", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693619108, "uuid": "15518a6c-9155-47bb-8168-1adbd9f4e64e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693619108, "uuid": "fbdc9d5d-96bf-484e-a87f-fe176564fbc9", "value": "13a6113875ce9745029aaf46433a25ddcb5e7aba9912b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff4503c-4984-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693654500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654500, "uuid": "eb84c6a9-5ab4-4901-9cbf-93aa158a4256", "comment": "Malware payload (Mirai)", "value": "17d8724f1cea21c7d9ea6b7d7fc98627", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654500, "uuid": "214d676f-ce33-4517-90ba-757c93e42c55", "comment": "Malware payload (Mirai)", "value": "1407032d7c4144b9279bfc8b549dd5d588ec8507fd366756e7f2fa2b273074ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654500, "uuid": "45f260c3-72a6-4472-b5f2-86dc32a21ac0", "comment": "Malware payload (Mirai)", "value": "b389eaf6493d5a5ea6fee0fdf0a93018c95b045e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654500, "uuid": "abbab528-cef7-42c3-b1fe-38bbf15ea2d8", "comment": "Malware payload (Mirai)", "value": "0aab0efc3d0b0937a92ac5608eacce714394e3ff9dda212b7ce41a10f729c2faca7c570e44abea3f47a7e258cce63bf3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693654500, "uuid": "df3e853e-63dc-4dc4-af33-27e5d31993f7", "value": "T1D9433A31BA760E27C0D1A8B661E74B25B6F543DE26E8CA0B3DB10D9EBF715406503AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693654500, "uuid": "e6e08ff1-f1b7-4f76-8566-db5fd34a122c", "value": "1536:fvf20dYmgHg1We/mrYe6RQW+75MUtydNcA:f20K5G+VM1NcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693654500, "uuid": "db5185f0-b977-4e69-a5f0-4c29f7889aa5", "value": 59864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693654500, "uuid": "3c697487-76a1-43ca-96f2-5cd43dc741e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693654500, "uuid": "76447cb5-442c-4207-927d-ee9aa2bc6682", "value": "17d8724f1cea21c7d9ea6b7d7fc98627", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ba263b-499c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LimeRAT)", "timestamp": 1693664708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693664708, "uuid": "90d8814f-b356-41a4-a2b2-1383ac2eb3dc", "comment": "Malware payload (LimeRAT)", "value": "4c6675bcb4996241e68fd4ac2fad45c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693664708, "uuid": "b28fef95-6d62-4453-a03a-63ebbd867c82", "comment": "Malware payload (LimeRAT)", "value": "1612e6bb0cce702554b3db27bf98c140772bc85df30d210f2082cb7b01b5148b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693664708, "uuid": "7402e635-1cd9-408b-b672-faddf623c70b", "comment": "Malware payload (LimeRAT)", "value": "e62124ae24bc980199900e5a7c392191882118cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693664708, "uuid": "30054da2-3906-4c4d-9784-1811917f49c6", "comment": "Malware payload (LimeRAT)", "value": "2420d0b98159b05f316f4e08ec27e149a6200f5b08d8926c5bd1ea6d15dce37ea33f78d8a1551f2c9dcd731b67bb19b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693664708, "uuid": "eecc0dbb-4bc9-49b6-a8f2-0e1211794696", "value": "T1B275238A23881B2FC7AE0B76D9D86D507FB6E197F092F3CBA7E745F5004735199202A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693664708, "uuid": "ac443cb7-bd9f-44cf-887a-66f4b43cf733", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693664708, "uuid": "495c2fb3-81c1-4bd9-aaee-0f30a608add6", "value": "24576:C4Zv8wgIQYygkY9lA6pnLZGBrgxFdgLOjRFqD3Fd2U+1A4EKazGG7/52rhUVrp:CkYIhkeTYBrUyOjjU+1ArF/El+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693664708, "uuid": "d6189061-b3ff-466c-a19c-4b347a7a8076", "value": 1559552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693664708, "uuid": "8e7568d9-16c0-46b2-ad07-c22feb505bb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693664708, "uuid": "d2806387-6012-4d2d-b28f-678dc238feb6", "value": "1612E6BB0CCE702554B3DB27BF98C140772BC85DF30D2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84bc3367-49d5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stop)", "timestamp": 1693689189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693689189, "uuid": "a87135ce-ab37-4403-aa66-cf8c565dee01", "comment": "Malware payload (Stop)", "value": "5d21060735fa451daef340b707b32807", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693689189, "uuid": "570f6542-c94f-48b6-a442-ff701e3bb106", "comment": "Malware payload (Stop)", "value": "188c586ed738a6e28416cf49bb17d5a66ac19f767e095b959ca84ef900d22735", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693689189, "uuid": "4a228aa7-829c-42a1-a8d9-dfec7c0ebaf4", "comment": "Malware payload (Stop)", "value": "5d2a34c309d1fa2b71e9380489df5b5cbcdd7a78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693689189, "uuid": "edc9b4f6-83e2-44e4-9980-8ff3f8630b24", "comment": "Malware payload (Stop)", "value": "e55d4817ea71b333a8edb810249fad0c593007471a9089c541cc58f94f39891216d75be4551c78f98e84decfb6d35a01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693689189, "uuid": "fc4f0b76-627a-4946-aaa2-5f1df0667606", "value": "T10005F15375E3FC6EDC2407718F2EC2ED772E74605E156B8627542E2E9A312B2E69B300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693689189, "uuid": "4575b6c7-852b-412c-a9e9-a0d18c7ed69e", "value": "a90bfe185c06be0aa4a37134cfb76f4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693689189, "uuid": "0fe9d15b-396c-498d-ab37-fc6372ebab84", "value": "12288:vx4mzYpZz2Nez2uSph3XQySocIwMnKRQ7i2HQdFrE0rvfGWZp46GzuJjOD6ILFy:vnz/42DrqoRwMGDP1r3a6GzujQFZy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693689189, "uuid": "4957e614-7d45-4e4d-a839-43dacf336d2d", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693689189, "uuid": "2afd76dc-0020-4e73-bf44-66cb8021cc51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693689189, "uuid": "a2aeaf17-bdb3-437b-ab9f-01bf6ad5fcd7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df788e1-49aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693670710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693670710, "uuid": "9d05aa83-dd2a-4fb2-af73-ae81c27ba5af", "comment": "Malware payload", "value": "18bd6b80c064ecf021bff737c2f48ec4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693670710, "uuid": "89765fc6-e980-4c31-bc7c-760616e9eb5c", "comment": "Malware payload", "value": "1cc7feaee823df0807c49341b9f4f0e58a4c021e8bc974af7bf5eb02fe09731e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693670710, "uuid": "1f09f707-420d-48c9-afc4-030886e36ef8", "comment": "Malware payload", "value": "7388f3d30f22b27243b6851f702189757cd29f06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693670710, "uuid": "ca13fae8-bdb3-409a-b5d3-d02024ccff42", "comment": "Malware payload", "value": "8e607ab041692618b065094f6683fbff761cf4f08da7549894808319ae2a27b0c7825219d87e58a2af8f4c1d1e3aa27a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693670710, "uuid": "21c2e1e2-3b03-4729-99a7-956dfa2936c5", "value": "T1AFE49D55E8D349A1E8A345301191BA7FEB24EE534F87F2EABE1528B40EF1264D1E7F40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693670710, "uuid": "f03d59d7-3d13-461b-8bc2-ef83dbfc153d", "value": "e88a529caf2666acedc4a4b0f2baa386", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693670710, "uuid": "1b6f50da-c4a6-42fe-b043-9f2a52ff02a3", "value": "12288:mA+lX8n+122WJVjgF/tCZqqe+OK+EkJrMo8CquJCLv2v30N1sb1:M/An0F0DhmJF8g30N1sZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693670710, "uuid": "c5c01f70-ed34-418f-8370-0095b4e4f4a9", "value": 707424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693670710, "uuid": "650d48a9-8ebf-4dba-805c-aa05e998571e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693670710, "uuid": "3fd75e97-7849-4ffc-a4d2-bda5d1774879", "value": "18bd6b80c064ecf021bff737c2f48ec4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2be41cba-49b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693674008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693674008, "uuid": "af06474e-1596-4b48-8221-c653916fe035", "comment": "Malware payload (Mirai)", "value": "4eaa2f1878d5560f636c5c986a10ff5e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693674008, "uuid": "a4ac641c-6e1f-479c-adbb-b919e9e15caa", "comment": "Malware payload (Mirai)", "value": "1db0198b732430cf714a4ef8ba2bb457e0a99fb945d3df21224f04439ab2413a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693674008, "uuid": "7e8fc947-0d3d-4313-a8ea-f3b00270988d", "comment": "Malware payload (Mirai)", "value": "6bbd57d9baf7f76f31fac0f1c0ef02af5de30a95", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693674008, "uuid": "7335def8-154d-49e5-96cf-28085b9f5f6d", "comment": "Malware payload (Mirai)", "value": "1d715dd6bd3a6611ddfaf0612c541942f7a3ebeb7c5a3a310355ada31e073187da7c0ea368a33d48425f27d8972c8074", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693674008, "uuid": "9f717ecf-f838-4a8c-8887-64f32465353f", "value": "T19AD2D17092991CF5C2500AB2F67856C4BE420F7CFEFE28901104DAB77D82C5579EE88B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693674008, "uuid": "875216fc-4f95-45d6-a789-745fa0ec5cbe", "value": "384:kot/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEpbjjIImdGU5eT6Nu0:k8soTAZ3alkXLvFh8nNENMI3UQeB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693674008, "uuid": "2e2bd99f-33a0-4c50-8183-9dd726b8c4b9", "value": 28312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693674008, "uuid": "1e9be147-5aae-44c3-b696-b6483831c5a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693674008, "uuid": "badcfe5e-34e9-47eb-88c1-6d2e6caa4232", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1021f4cd-49d1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693687276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693687276, "uuid": "31fb30af-c198-427f-9e12-8b407f2de92c", "comment": "Malware payload", "value": "c66bc87ae6c065515d4875469ade7e11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693687276, "uuid": "6b3737ac-3374-4646-8962-be6c88aeccc5", "comment": "Malware payload", "value": "1f384673e558bafe76468a6ba5eff872c5fbef115dd509c6c2852562a47a2ef7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693687276, "uuid": "09230286-474a-45c0-9ee1-af553097929a", "comment": "Malware payload", "value": "f9da08fc89f8b782640bd5f6ff4e11610dbc1c09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693687276, "uuid": "3e893553-278a-482a-8d2c-aade1aa867c0", "comment": "Malware payload", "value": "d57f4977d13f33f4cd6a1c93fd465cf2df3ab1ce038da5e1087d5568a23f2449da4f67459fbd0a9ffce5258dd184c1be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693687276, "uuid": "1db9bc9d-a359-49f5-bd6d-ecb411c90af4", "value": "T198846B4220408038CDE61730DDB4A3A559BBEA804B79D9BF6F9DD267BA70241B534F7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693687276, "uuid": "1b356602-b6b0-49bf-846c-6ed6cfe82353", "value": "1d47b5e83937c2c0074ff2abc29f8771", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693687276, "uuid": "00ab6d36-72fe-41af-a5ff-8e904ba43191", "value": "6144:h08vfHJfjmufItYYFrIPU88CcRAOLHSdG65FPvIDLHCro0y:h08vVjmufI+YMgVHSdG65RIviU0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693687276, "uuid": "a0be862d-8696-425b-b351-6582227de823", "value": 386912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693687276, "uuid": "47d28652-15a5-4419-bb43-6e4508bd26c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693687276, "uuid": "232ec42e-778f-46d7-bd46-6a65bbf45acc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7185878-4984-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693654485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654485, "uuid": "3f39a0db-5756-48ec-9a37-19a9af110a18", "comment": "Malware payload (Mirai)", "value": "37924810bdec6b4a5ca61f8f9126d21c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654485, "uuid": "fb849d8a-f470-4d5b-8883-9a34e00d1f7b", "comment": "Malware payload (Mirai)", "value": "258319444d33876875810dbc6017f2ecb982ab6746b71a07c1e363ccc84647d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654485, "uuid": "0eb026e7-5027-4b59-bba9-0c4562a78203", "comment": "Malware payload (Mirai)", "value": "dbd62d43ca04d7b6d9125cb92277096b2fbc004f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654485, "uuid": "ab66def2-2849-43b6-ab69-dd92bd30a485", "comment": "Malware payload (Mirai)", "value": "0e49fb6cb0ae66a1416b2b3601a693f4f341085287dc98bcc412596c233d911bbdae1678eea36ffb99dc2b9176e1b681", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693654485, "uuid": "1378adda-d38f-4d39-80dc-2b8616dae4e7", "value": "T1E6337B77E46A5E84C086857075249F351F23F1C893932EBB16EAC2B95483DACF509FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693654485, "uuid": "243edfc9-185b-4161-b74e-b4e5105c0b5a", "value": "1536:oaini/krGATCWDMKwlGWE81CCVghNnKLT:oVniaGA1Twe81ChNnKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693654485, "uuid": "c2c23af5-cc7c-46fb-a348-5eefdec16af6", "value": 50580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693654485, "uuid": "f735f31c-618a-42d6-918c-3bfb446434f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693654485, "uuid": "d556a598-374f-4b92-b115-6204c277a69d", "value": "37924810bdec6b4a5ca61f8f9126d21c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6771c66a-49d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693688711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693688711, "uuid": "6b0abdfe-fbf2-4b17-9c07-ba02b9c900fa", "comment": "Malware payload (Amadey)", "value": "19ca164f14d33bf81d33df26bed45220", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693688711, "uuid": "80d5ba7b-9d4a-4372-a717-85ce3ad278a6", "comment": "Malware payload (Amadey)", "value": "2881880b13157c1973b7581a12181955f4cdc7e3bf83f51fb98bedbcb9f0a1d5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693688711, "uuid": "b0804c01-f6d2-40b2-8b8e-e058495d62e9", "comment": "Malware payload (Amadey)", "value": "93e3a8007eb26dbf9fd9687677853c6ba1b017d4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693688711, "uuid": "b92115d2-a862-4106-b052-b0813044e638", "comment": "Malware payload (Amadey)", "value": "1dcdc8546201356050bdbce398fc7ba46fc40bfd4b201bf6fac31b240417848763c00680c340de80d99b3a2cd77139f5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693688711, "uuid": "43d18ec6-dc01-4abf-8d27-0431ef9e0840", "value": "T16A552317F7D490B6E9A927319CF71E830A34BCA088B046633395E51B4C73956A13AF77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693688711, "uuid": "aa1cd4a5-1736-46eb-8a15-ba28b4ea2554", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693688711, "uuid": "48985b93-57b1-4df7-b25b-9bc381299e6c", "value": "24576:GyE03vQzQNznKNEqdwM1jGpSTewm21riCgORZ+LLzrG9VSUWY:VE03v/KNEqmM1y4FmeiCgORZ+3G2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693688711, "uuid": "582a1f37-5cbe-4e1b-87ea-129cdd559b92", "value": 1394688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693688711, "uuid": "8286d3c9-2c3d-4da7-a874-45cf26d8cc10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693688711, "uuid": "d0a291c3-4594-49ee-bc41-9544e27dd9a8", "value": "19ca164f14d33bf81d33df26bed45220.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3a1c2f-49e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693695004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693695004, "uuid": "770b8502-937e-4c5a-bbf3-bb9a98d7b03c", "comment": "Malware payload (Mirai)", "value": "cf2f6a276683693737a9226fe6c871e8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693695004, "uuid": "67fe63b4-d5f9-42e9-8dd0-9c3632e9f330", "comment": "Malware payload (Mirai)", "value": "2ee03e53c79e6be9066325c0061965e24de4317c933c7bed5cc852e27d11ed20", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693695004, "uuid": "699c29b8-6b61-43e1-98c3-0c9cb30b41b5", "comment": "Malware payload (Mirai)", "value": "d2c7ab503efdeb0fcb4cf01797dbf04ae0be61f9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693695004, "uuid": "a7e7dc94-229c-4a0b-94ce-594b7e6fe44c", "comment": "Malware payload (Mirai)", "value": "e6fdfb9524c41b966ea74bbf17700c5fa24a91911f48e8e7b51915b88c7c242c637b7747fac901f7b00f8647cd0622bf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693695004, "uuid": "6aedfc9b-a3c9-4477-803f-5a186d346307", "value": "T17CD2E16CDB59374CF4A6573254BFC13F34A6ECA3A22F42C28BD84912283944D6779EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693695004, "uuid": "0a5320a9-822f-4b5c-8f97-a45b4e49824a", "value": "384:MHGclfUDwDsOAFImUQSAAHCw9TKcSLJY7eoayfsqxRFpDU7/2L0G6JbV0Nyqx:5cmROmIIAi8KpLJY7Pa6tpI7/u6J5RY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693695004, "uuid": "eb173fb9-db91-4f77-a2b5-3da5370e638e", "value": 30008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693695004, "uuid": "026ff940-7ecf-4364-9324-3df1129643fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693695004, "uuid": "daad922c-072f-40bb-9c19-f9d4f4ba419b", "value": "akido.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a81bb4-496a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693643288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693643288, "uuid": "25da9c26-94ab-4bba-bb94-b1af3cecc5e2", "comment": "Malware payload (Mirai)", "value": "b6cb4899e499cbe88ec11544c7f83127", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693643288, "uuid": "519d9542-71ca-40c7-a730-7e946b5e9f3a", "comment": "Malware payload (Mirai)", "value": "33062c099963ccc65cc2b794408e2903520340bb9c03ad73ab4113d2b373fb41", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693643288, "uuid": "da5d66cd-878b-4674-ad02-75ee3b645835", "comment": "Malware payload (Mirai)", "value": "5050239e9a98d1934bccc07b154fad3d4e664277", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693643288, "uuid": "71afab73-389b-4e0b-a9c7-2f5ba3b90054", "comment": "Malware payload (Mirai)", "value": "f778a26d73b495349acc0d4b70453df28a72e79ac1c74fb3e6e6f655f5a1b870f86c25a093ab3ab64314da4fa4d5f2fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693643288, "uuid": "472a6d5f-c1d8-456a-8979-3c05d05fca47", "value": "T1B2830806EF654EBBC82FDE3706AD0A0634CC954623B53F7A3574C528F64A54B0AD3DA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693643288, "uuid": "e4315d5e-544f-4c49-b175-79ae2e48a99f", "value": "1536:zTN7oeUwJ+lK/D4C4MpkZfr4AEihRlxoI0+Hj:l7uwcC4pRD//D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693643288, "uuid": "be4bc0dc-6b28-4937-9e3d-935090dcf480", "value": 80864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693643288, "uuid": "6664ab74-165e-41f7-9aa5-10c7b23b77ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693643288, "uuid": "2afb9c3f-3b5b-49b6-beb0-f8b310da2e5c", "value": "b6cb4899e499cbe88ec11544c7f83127", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d30bc602-49e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693697052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693697052, "uuid": "d09f30de-c541-4c40-b751-3574d09345d2", "comment": "Malware payload (Amadey)", "value": "5f7b99739158d0b321c6c1e673365956", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693697052, "uuid": "1379af5b-0117-44c9-8671-d9cdbb31324f", "comment": "Malware payload (Amadey)", "value": "33cbdeba761fab35dfa4e60a03d0625ec53f77b17148385548a763b888c9b221", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693697052, "uuid": "a87d4831-22f4-4bec-9876-b949c7dc0165", "comment": "Malware payload (Amadey)", "value": "f22fb296a543017263c1ef507ca61da91203f490", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693697052, "uuid": "8681d646-8152-4730-915b-ede771d0d4bf", "comment": "Malware payload (Amadey)", "value": "0553536bfa44f470583c18d85b8948fa017459ec1ff7d7a74f52a2c287d54e363b67939de675a5a599fa2cdabc3dc678", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693697052, "uuid": "2e51e309-e698-4913-8046-cf3b1efe9f57", "value": "T1DF6439517916C032D96065721BB5BFF2C19D6C19ABB04AEF6BC00E76DA212E37930F39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693697052, "uuid": "150f2e26-c5fa-4f6e-8b0a-d0749750b2da", "value": "b5701a03716cd526591d6ce95c5326c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693697052, "uuid": "b66e02d9-7e15-48a3-bc91-b314a89e3b5a", "value": "6144:bkj0Jco5KtqvwxpMlMiXXwlnnN1Rm/HoVwu00SATNVuubFD2NfJLAOMJK7Xc:oj0+oo1KlXwlnN1R2oNVuubFqNfJLKys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693697052, "uuid": "dd0cf8f6-9f47-4dd0-8569-9778c3ca506c", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693697052, "uuid": "2021126c-40a4-4a36-a688-dea4e3484888", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693697052, "uuid": "b8c54e36-a4f3-4c73-9c81-a06e41ce0141", "value": "5f7b99739158d0b321c6c1e673365956", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87100ced-4934-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkTortilla)", "timestamp": 1693620044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693620044, "uuid": "1f3fb968-7708-4f13-9fe0-7e753d0389d7", "comment": "Malware payload (DarkTortilla)", "value": "3e1addce70b29934018089965733a491", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693620044, "uuid": "1a2ecbd3-c4f4-4d06-bcaa-2d1d688538df", "comment": "Malware payload (DarkTortilla)", "value": "39870c2eddf623cc813c0dc103b567a171bae82ba12c39772ca7064cd134b895", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693620044, "uuid": "78601bb2-f3ca-43f2-a7a0-d45426111a28", "comment": "Malware payload (DarkTortilla)", "value": "19e2d487d28d6c8b2f1c01e7950fa028e1864f1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693620044, "uuid": "a2fe17d0-a8d1-4eb3-8ed5-1cc2dfd9119c", "comment": "Malware payload (DarkTortilla)", "value": "1e4110333b4646bb0446108e3d334a8f5d7c1c78fd8f2a12cb8ebc0c3c603cda09197d2d8b223c5e32f60d067064ba28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693620044, "uuid": "abc764ec-a1ce-42a3-846c-df7a35484591", "value": "T16EC4E101BEC195B2D6711D325A29AB20283D7D301F24DFDF63E45A6E9A311C0EB35BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693620044, "uuid": "3ffed5be-94c5-4884-bf83-e30c3a125258", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693620044, "uuid": "642f43e1-2093-41b5-862f-03d11ee75ded", "value": "12288:aRZ+IoG/n9IQxW3OBsee2X+t4RbUNaKgb5Og8y2FVfMui8c:U2G/nvxW3Ww0tUsKg0pFzij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693620044, "uuid": "2b2c6e14-40a0-4be0-97e9-679ab3e10ec3", "value": 552448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693620044, "uuid": "ac5456e2-89d3-479f-ab16-3bdf1dd6fa63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693620044, "uuid": "8620ab6a-dfbf-4eeb-82e8-83a7dbfa47e1", "value": "3e1addce70b29934018089965733a491", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910530af-497a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693650126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693650126, "uuid": "0437ea9e-6eaa-46cf-b025-002028865b63", "comment": "Malware payload (Mirai)", "value": "3c97545910074b60077e4ff83a12c827", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693650126, "uuid": "e8bfc304-c056-4981-9d62-c093d8f84e0a", "comment": "Malware payload (Mirai)", "value": "398db7b487daf89b620c567c9312a74ca43cbe5bb95662c910e33735c5dfd9c2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693650126, "uuid": "860a211c-3fa3-4845-ac98-119897e3b342", "comment": "Malware payload (Mirai)", "value": "b319678e8f695e8272f695db24aa7df82d12ca2e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693650126, "uuid": "f4d8ed9d-29a2-4fc6-963d-5be16cd64a62", "comment": "Malware payload (Mirai)", "value": "00394bb7a3b21ed8ae459eb581e3c48de2e3437ea8fcf0646b20bd3e5685ef84fea892f40d568223b18c8cbdd6f55c4f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693650126, "uuid": "b3218b17-e5dd-4d77-b981-f115646a8117", "value": "T110330907F681C0FDC49AC174476BBA3AE93771ED0238F2A67BE4EA223D95E611D19C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693650126, "uuid": "57737a76-7b68-4ffe-af43-a2b54f682a25", "value": "1536:Ru31CxXVpHlCrxsNnVfvj5F+Hr2r4DaEXzd0OCUjCYe:Y1sXV5lCKNVfvj5oL0GaEDOVUjCYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693650126, "uuid": "01fc2e24-4be3-4869-b77a-d1f7d7b7b22d", "value": 55104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693650126, "uuid": "c0970f93-c6d3-44fd-a112-a41a30f223db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693650126, "uuid": "cca1411f-3474-434d-a8c7-bd5b4bfe92ee", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8edb785-4949-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693629201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693629201, "uuid": "e2ec0ee7-ab3c-4ed2-91b1-ed84d2ae3da9", "comment": "Malware payload (Mirai)", "value": "0a026e9ad739ce4a5ad92d20b400d0ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693629201, "uuid": "e43f5a2d-87f8-4fe0-836e-af4d4dcd4f2b", "comment": "Malware payload (Mirai)", "value": "39e6337588c5b03dc5ccd07de865152bcb375a2df526ceb6e1dbe52e287793c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693629201, "uuid": "6b0a4ed0-aed6-4e40-9e0a-7a4ac722cf65", "comment": "Malware payload (Mirai)", "value": "5cc3da8dae84c7131dd3622d485312323b9c6d46", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693629201, "uuid": "d86b1ff1-83cd-430a-ad30-874621ca6e69", "comment": "Malware payload (Mirai)", "value": "77e4044695a5074eadafde81c7e3b1320a199cbd245e51254c8c6a86d9797ae569b7df1079d36c93f5ca2643b24324fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693629201, "uuid": "b990b361-6c45-4eb2-b3cf-8a6af4378e2c", "value": "T13D93B586BF340FF7E85ACD3749EA2705158C591A62B97F357A30D818F24B25F1AE3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693629201, "uuid": "e061cb00-1f0d-4e46-9be9-f2b634d6ae8b", "value": "1536:yNgwspD3mW2SRMcrYvaP7382suSBMmLTZZiYI1wKYO:yNgl5mW0creaD3WlTZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693629201, "uuid": "b0102129-d90f-465e-9817-51d1871070f1", "value": 92600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693629201, "uuid": "aa39a610-d544-4764-9ee6-e022d8584a60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693629201, "uuid": "c21de074-51b0-4f62-9a7f-6ceb13ea2f02", "value": "0a026e9ad739ce4a5ad92d20b400d0ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa039e0-493a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1693622708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693622708, "uuid": "bcc71218-7d19-4234-8e80-e1f83734328a", "comment": "Malware payload (AveMariaRAT)", "value": "7bd00d190acedcc64aeefd1ddf94cb1d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693622708, "uuid": "0d424cc6-a985-43ae-b201-f481c0413067", "comment": "Malware payload (AveMariaRAT)", "value": "3a549857526733dea4da5c4916d7c0015d8172ad8d845acc160d6b12be418b9a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693622708, "uuid": "7fbb2e1a-fcf4-4847-9e52-eaacc3f810c5", "comment": "Malware payload (AveMariaRAT)", "value": "4d02ec8882c24eb5e51c07ce12abcaa4bd610c27", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693622708, "uuid": "d7f0736c-a3b2-4487-bfa3-8bc458f3c1a1", "comment": "Malware payload (AveMariaRAT)", "value": "7b4a455174bcba4cb58063ade67d81901f5044200af4a5ce619a322bc0a1e0b47b1782c442704285fbaa2354eaeed131", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693622708, "uuid": "5a95fa04-3677-43f7-8ef3-2a65ecd2299e", "value": "T154E37D227BE54039F7B705701AF93E25D7ACBE310E31CA4B5BD4488B58B1589E9363A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693622708, "uuid": "a5edf923-e39f-49cb-ae96-235c20ab3e3f", "value": "0145d2c473bdbcd7b46a054bd6893ec4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693622708, "uuid": "8226168a-f4ef-4fd8-bd23-4ee2c41c8a92", "value": "3072:2k4aHUBOO36YplMqBB3ZcPxlG+bBsDHqYzHKG0qIwj:2dx3wqz3ZcDeDKYzqG01wj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693622708, "uuid": "df5296e1-70c8-4571-9252-fa9f64f36549", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693622708, "uuid": "7eeb9a75-20b8-448f-a7f1-385e2607aedf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693622708, "uuid": "a93e7503-71fd-421c-a616-bb1bced0b0a2", "value": "3a549857526733dea4da5c4916d7c0015d8172ad8d845.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99963a36-49d2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693687936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693687936, "uuid": "a335e738-1954-4a73-8115-8aef9615f06d", "comment": "Malware payload (RedLineStealer)", "value": "4ec93ab1490e81addf1e5f70f3063c61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693687936, "uuid": "06e70a97-e392-4e12-973a-1deaf95546ce", "comment": "Malware payload (RedLineStealer)", "value": "3d6796860a796e3ed63efb6c4c1fb9c5eb6df481e63e40602feb24adbeabb179", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693687936, "uuid": "8ea36b5f-1fc6-47bd-8794-09edc22dd118", "comment": "Malware payload (RedLineStealer)", "value": "56c23900ffc25fff2fff7cc83ea7bae3b8c7766c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693687936, "uuid": "07ea3c73-6386-4441-b5f9-1a13ae757370", "comment": "Malware payload (RedLineStealer)", "value": "7580f0e0931da1723e1f6518f520b93e6851898b503dddc04d64a3649dcc3e2ad126e498c38c8dd3aa52aa54fd7d5fd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693687936, "uuid": "a8e37b5e-4d4d-4280-a6af-c4acaed3cf27", "value": "T1F1A4CF83A6D0FC39D42547359F1ED6FC3B2EB8604D246B962B446E1B18F32B2D69B701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693687936, "uuid": "89bf2046-2ef4-4df8-b116-d347d2346d53", "value": "515f729e8e6f1501a5196a14cf216d36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693687936, "uuid": "52f674d4-9292-4308-ada0-89ba5851de6a", "value": "6144:wV6a1mAiB3wUnpR7MRNL8ckDMtPClKYHhq3HFsE8w/xlmE+W6Ey:K6a1mAiBrDaB+MtNfHew/xx+ky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693687936, "uuid": "36944bf7-1064-475f-82b2-9ea34b6e4f88", "value": 451584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693687936, "uuid": "745fd11b-bea4-41c7-b5e5-c6857ebb70fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693687936, "uuid": "d975b140-0de3-462a-97a7-ae6efd3e055b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba8a300-49e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693697039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693697039, "uuid": "99cf29e4-618a-4803-accb-5b95eb75fdd2", "comment": "Malware payload (Mirai)", "value": "084c1630547e074a9b3cb0e8b5b49bd5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693697039, "uuid": "7276fa8b-a030-401d-bc3c-0963cbf3cb5f", "comment": "Malware payload (Mirai)", "value": "422aa44124d92f8d3d94b95b65ee73390db0204ddf9ba2b2791858bf93a18b35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693697039, "uuid": "39473708-5c75-43fc-a5a1-7e22802e54c6", "comment": "Malware payload (Mirai)", "value": "21a1c2115f61c20e38882b4223744ef151c121fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693697039, "uuid": "89b8d715-c3db-418c-a531-c4445254c1db", "comment": "Malware payload (Mirai)", "value": "c3339731946d2c702b1c517a9b4c0b347bce07842f84c8a905ab4fb78e1c8f72a4e2661956c5b93ac2f3f66ce42c8804", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693697039, "uuid": "a8a3acce-c523-47f8-87f6-795789822f47", "value": "T1F9539EB5C4E8ED98C6684578B714C93DD723900465D33DFAEB46CAA7800BAEDF0097B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693697039, "uuid": "88f8a91f-d84e-4aab-a122-54b40a082b6f", "value": "1536://BMsvJvJabwtlw3bqSsH6aOIy/Cfs32j/JQZI1qhC8ja:/JMSR893O6aO+f+uWZIYh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693697039, "uuid": "0815b1ef-ff40-432d-8448-30e75a76be7a", "value": 66368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693697039, "uuid": "ffa2aec3-19bb-47e9-bf3a-84a72ea3fc19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693697039, "uuid": "fbdfdd8e-dc1e-47e6-b3a8-4f92928738b4", "value": "084c1630547e074a9b3cb0e8b5b49bd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "484cf405-4941-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693625522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693625522, "uuid": "be457482-14c0-4df5-9a1a-182d606d3781", "comment": "Malware payload", "value": "f519d275a74776c00243901014f40df9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693625522, "uuid": "d8bae113-e017-4934-8499-22ee2232a408", "comment": "Malware payload", "value": "43e8635ac80bfba60a6ae696a9e10a0060372f50ea725c089f9e1a6afe702f1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693625522, "uuid": "3cd117d3-1d3a-448c-a541-c360fc2e47a6", "comment": "Malware payload", "value": "bbba4315aeb9879cb8fb13cdcaafe6fb12b87bec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693625522, "uuid": "22956256-ba3f-4b8d-95b2-eeb849d3433e", "comment": "Malware payload", "value": "91f770c7516dbc0d5b57b514e5f9b17d8a8f2a2c6c3e8b8770dbce00f01e7572a6f4a37e137481c9eeab045ec5021e2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693625522, "uuid": "e7481776-8850-4d75-9cae-241ffbdd306e", "value": "T15AC412A5A2759F67CECC86F600B3D0B761FF8B438457F51D4ECA27012F6006196AAE93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693625522, "uuid": "3d9208ac-701a-48c4-a5c4-db64107a1d5c", "value": "12288:215FGIs87Rk0OSHlSjG5TyJMC9SciyFB/06Km7PHt:S7nF6SFSikJe8a6Kg/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693625522, "uuid": "f5a13c70-846c-4f13-8732-a5b6666769e9", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693625522, "uuid": "b88f0d58-b576-4467-8280-09fb7762ff64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693625522, "uuid": "7cf84b35-c12e-4fa1-add2-f08142fc661a", "value": "SecuriteInfo.com.Trojan.MSIL.Crypt.26106.9259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80562547-49e8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693697342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693697342, "uuid": "e4155c6e-4720-4345-92d8-a55b08665102", "comment": "Malware payload (Mirai)", "value": "2a2cb87d28265bb883f32d90bfd5b61f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693697342, "uuid": "30d3283f-fe2c-40fd-96a6-8f03dd9d9aef", "comment": "Malware payload (Mirai)", "value": "44e6149cc8675e7cbd8baa7c752123fb831bb3b5f2bdca346e49e090aaf2d357", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693697342, "uuid": "a483a7a8-8bc0-4fc0-8b7e-ddd55270f9c5", "comment": "Malware payload (Mirai)", "value": "d304049818bc7b70113283e709f39e9389194e08", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693697342, "uuid": "b467991c-4777-47da-a43a-2b79c9ba2955", "comment": "Malware payload (Mirai)", "value": "c84e7442412b028e0153ee53e5bb90a2435088c7f696b32dc93003dfcbc964eef0f50910d32a97b2d2b9adb04c9bf55e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693697342, "uuid": "5cf23646-7fcf-4e3a-be08-e610fabba37d", "value": "T15AE2F1ACE9C428D1C5BF0CBD511A0FB25918F4A0B14EAB8573114D9CBF49E4B5C844BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693697342, "uuid": "0324da95-eec6-48af-b8cc-a1e859720e97", "value": "384:hn6Ppdqf3I54hJulN7s1kNYTA/fKiFs4V9B6f8Oj0bCwFtNKpugmyRzLRWGVCz09:h4YuDs1kNJ/fKiFUf8OGCgGzl1WK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693697342, "uuid": "91d045b7-be5a-40be-9a4f-88cccce96dda", "value": 32028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693697342, "uuid": "25b97ec7-20bd-4d8a-a6dd-a180cbb39de8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693697342, "uuid": "18071b91-58d4-448d-aa6a-df517e42d0bc", "value": "2a2cb87d28265bb883f32d90bfd5b61f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ebd6b2-49d3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693688252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693688252, "uuid": "5c77294e-5326-4b96-8f00-e3866ab73545", "comment": "Malware payload (RedLineStealer)", "value": "92dd8fcf5194cb14ba266c930bf7a180", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693688252, "uuid": "cbed8259-f6af-4e60-a166-a0e8a27f8fe6", "comment": "Malware payload (RedLineStealer)", "value": "4cd2c0f587430ac6add333d7edf854160e0a4d903edcb7386d6f87d2cbb4b9b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693688252, "uuid": "5f042ecf-62e2-4675-bec0-4edd8f6a1f81", "comment": "Malware payload (RedLineStealer)", "value": "5b5dcdab7c71df798ce66ca1b041ce4ca2cd95ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693688252, "uuid": "9356698a-0e56-4898-9c12-c6c9ef5017bb", "comment": "Malware payload (RedLineStealer)", "value": "8eb946412f48b43dbd2eb74723e7d8d6ae1f24c5dada105450e6d3b31bb4cef5a5277967169ef55d17f11e500cd9ac08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693688252, "uuid": "d7d241c2-d6db-40ba-abfe-fec4ce540b52", "value": "T10F856B2179C0D565EDEF13BAC6FDBA35416DE0B0071516FBD2C826EE8F106D2BA31286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693688252, "uuid": "64127113-a5c9-48a0-91ca-c6b43db0a3eb", "value": "93c4672bbdee49f80314f51c6dc0d89c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693688252, "uuid": "917d12ad-8310-427d-aee6-2443c36a5f92", "value": "12288:g+lpe01SU8uER2Gm/QiIPs0EID9Dn2MpbCulvQt9qWM2mp+1HgkWA1WuYnR+xnXh:vAU8uEtm/QiIE0d2BM2mpuWlEy19+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693688252, "uuid": "b8afce30-c2d3-4f31-90a7-bdf19bc3d3e8", "value": 1707008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693688252, "uuid": "98a89b9d-647a-4a17-8627-76b80d132bb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693688252, "uuid": "f1cad33e-b52d-4008-99eb-450b0ea98a6d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42dbbaec-4942-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693625943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693625943, "uuid": "8b09b996-0e97-40f4-b58f-7af94332cdde", "comment": "Malware payload (Mirai)", "value": "f397e6b0d3e46c64e8c2f28bf58a59c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693625943, "uuid": "f6aa9ae0-81c4-4331-b231-7995fb635174", "comment": "Malware payload (Mirai)", "value": "4d9f764c6ebba8f1399b97c8626e70e5f7b18bfc211a662f33c77df7af91860b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693625943, "uuid": "755db216-301c-46ed-869b-80c9833293b4", "comment": "Malware payload (Mirai)", "value": "c036d437e863fee5851bf9e0f18f191f7a091e88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693625943, "uuid": "8c20ae85-dcb0-45bd-b4c8-311cafb82228", "comment": "Malware payload (Mirai)", "value": "f6e7efc38e3b0cd9c97df5bd83817339866180b06371b4dd78d2a78727793c226b0ad9750f2e98a3d907d32fd9dcd7af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693625943, "uuid": "772ca1aa-5bb3-49fe-8932-ecce6d8c198e", "value": "T11293E91E3E258F7CFBA9C23947B78E259648378A3AE1C184D15CE6015EA034E741FF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693625943, "uuid": "f1cb0e16-2b0e-4bc6-9689-8ea6af502c7b", "value": "1536:hL9Mecopfn0CG5Uvn1msOPox+FNW/tUV81QDFCm0ywp0:LMevf0avojPogF6tUV81QDcmVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693625943, "uuid": "3709d4ae-2b05-4e08-aadd-38d8d7f4f780", "value": 89776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693625943, "uuid": "6f495d67-cba1-48d1-a0a1-caad4bd92a6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693625943, "uuid": "8673f2c2-666e-4eec-a79d-1c096096933c", "value": "f397e6b0d3e46c64e8c2f28bf58a59c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6372be9-49d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1693688870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693688870, "uuid": "7d32a9e1-2aad-4afd-bd18-9c037ddf701b", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "a704e167d409708347df0c2c7317229d", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693688870, "uuid": "afd7361f-98f5-41e2-a3f6-b194d2430607", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "501283772e11d99ca3cb7bb173b79029de83d237cf68eddd07b6b105a1b39cb4", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693688870, "uuid": "a1695ced-f22a-4319-a49f-9cf6d45d6448", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "6413356ae34a5f4973e8f5345dca2eac484f6166", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693688870, "uuid": "75736cb0-fab2-4368-b539-b0f244a536b8", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "e1be2fbc1a10fd12f5d7f7c9732cc9ac70f2d643b58f6ca1aac85a47fdd30eb975dff5a08482eb73d6f8827ab6cc60df", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693688870, "uuid": "5b840152-6119-4256-8ec3-e6ab83684ef9", "value": "T179252343F6A1D5B9F571E8F00C99E600543679A20878A29937FD5F8C5F33EE8EA50728", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693688870, "uuid": "1da09a1b-9f03-47e5-a090-080a41244d75", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693688870, "uuid": "63d842c6-3844-4af5-98ff-9784b445789d", "value": "24576:WI39dAcA1YObmDSgpYP9+D9a9b8DjdVPQHzGkyFV/uN4vxt:W6dAf1F6DNO9+D89b8DjLPezKuCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693688870, "uuid": "6298c48a-f620-48d6-bc9b-cd9736b5b907", "value": 986101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693688870, "uuid": "93973e9c-debf-4550-8874-5369b31e91f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693688870, "uuid": "8be83b15-5aca-46ac-8afb-96e1b8941dcd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ede275-49a1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693666804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693666804, "uuid": "66c6e57c-f25c-4bcc-8dd0-ff13f6769094", "comment": "Malware payload (Mirai)", "value": "f7f64d43ba7cd8b6a227c2e095905a4b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693666804, "uuid": "4524c01b-976c-4150-9d9f-bb0d446d6b28", "comment": "Malware payload (Mirai)", "value": "504995cd2612674ae5b69aeedce0e72da5bcc446f85698634a3e74b9a59ee529", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693666804, "uuid": "69622fc9-9421-4474-90e9-e03b296edbd5", "comment": "Malware payload (Mirai)", "value": "94a7ec70302a2004d11771e5d5b007620c7f9f1c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693666804, "uuid": "68858fd9-cda5-467b-9bf6-eebf83cae5f2", "comment": "Malware payload (Mirai)", "value": "e275bd3279f71fc67a5203914a779185473d615572ac0eb80034e8c2ae54a2e2f306e6233014356b6ecf91092a30bbb5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693666804, "uuid": "d578d779-d22d-454a-8248-f0e1d09b4871", "value": "T170E32946EB808B13C0D22779FA9B425533239B54D3E733069928BFB43F8679E4E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693666804, "uuid": "519de2df-f690-4385-9a3c-73150fdd77e9", "value": "3072:KL+seje5L4aMZEylws8w44raaCSfhafO89dM/9CFyk:9Ra4aMZEylwO4PaDfMfO87M/9nk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693666804, "uuid": "3f8d4d02-20cd-40ab-9477-a128109fbb92", "value": 152236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693666804, "uuid": "4ba30912-76c8-4a8a-9792-884b5118f0af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693666804, "uuid": "b424cddf-7c48-458c-9660-e79ba031a982", "value": "skid.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f7b1db5-49cb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693684805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693684805, "uuid": "a3c9cf96-5bc9-4049-b278-e9e7680caf23", "comment": "Malware payload", "value": "c694347ff0ef4c3536e32d3c0efd6a1c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693684805, "uuid": "ebeb34a9-6199-4d46-8e6a-cd5a1b938185", "comment": "Malware payload", "value": "51b81191f8a6a3a55211dcdd0310ca45c1a4b4fbd09b8f60261ac695e7f6af85", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693684805, "uuid": "418c3fea-e08a-4cf7-b01b-9d9e57511d83", "comment": "Malware payload", "value": "b1b429b78a4898536dffc275a544738a50704157", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693684805, "uuid": "00615dc5-a7c0-480f-9cf7-ff6c2d9c0915", "comment": "Malware payload", "value": "3f262f63faf85d7e81658addf1521edf41cb4f926f4b77953722ab13649df5ac07b2fa52af95dd5d46374f8db418ea7f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693684805, "uuid": "f9e1c7fb-a8e2-4ceb-8850-0453e0ef19c2", "value": "T1E1233AC4B583F8F9EC15457C307B97729EB7F43A603AEDABC39994239815601AA072DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693684805, "uuid": "1bf3077d-4c50-4a83-8aae-276387f6ef96", "value": "1536:4LInPCqAAXJLE7cxtdG8NCqBNM7vk9YXPSP0Hoa:FCqxpE7cxtdG0Cqvsvk9sSMHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693684805, "uuid": "f6d2b27d-edb4-402d-b339-2404a2576c3e", "value": 49752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693684805, "uuid": "2c11ba5a-9b69-4685-8f2d-f1526c561cf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693684805, "uuid": "7a53c3d8-6925-4a30-ada6-9e560571bb46", "value": "Josho.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54cefc6f-4939-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693622107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693622107, "uuid": "4aef3fb0-8dbe-4acf-bbcd-4cffe2d44590", "comment": "Malware payload (RedLineStealer)", "value": "dd4877a6c73f6665a5ee2c1d91de1a1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693622107, "uuid": "ff05556a-8fcd-4702-9d72-f42933f38e66", "comment": "Malware payload (RedLineStealer)", "value": "51f48864b1dbce8ec713268412006091f8c3c4c070a8a1a69fbfaee1b1a4ed4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693622107, "uuid": "3d1a02ee-6c70-48a5-b605-8f3b98d3dff9", "comment": "Malware payload (RedLineStealer)", "value": "c6d09d59eefaad08cab3584ab8e12ae639ddb50e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693622107, "uuid": "1fc6f516-843d-40e1-845d-1804339e82e1", "comment": "Malware payload (RedLineStealer)", "value": "64d7a93af8664b2905b45eb48f7f4e569b354144f9ab55219a6bbb2a06b9e28b5fdaf8e0867a11de36fbaf3d193a99c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693622107, "uuid": "bbb0c276-5c5d-40f6-b9b8-b0cc20f714a7", "value": "T1A6152315BAEC8823D6F51BB058FB129707357CE29C78812B268195DF1C73785B9323AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693622107, "uuid": "0628f881-10d3-44ad-a4c7-3c43e45961e9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693622107, "uuid": "796843cb-6007-49f7-bfad-6e2c6f42aa2b", "value": "12288:ZMrqy90B5DTogiQpk0RncPZuMi1q/jubnHgQEwcjaWaTAPSgxS+NpMOKx:byIfoginZuMuhHRrc+WgAO+Nmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693622107, "uuid": "f255730b-40f1-4e68-bf11-2faebe28a2f2", "value": 952832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693622107, "uuid": "84329e2c-27dc-47e4-bbe9-0608972ba4d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693622107, "uuid": "97f0005b-a01e-4584-8e19-0a7f6aca948b", "value": "dd4877a6c73f6665a5ee2c1d91de1a1a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e00f4b42-497f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693652406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652406, "uuid": "fc42d12e-0805-476f-8286-9cf1aeecc8e9", "comment": "Malware payload (Mirai)", "value": "9a86bb5fc23f476365c97fb0a9eb57f7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652406, "uuid": "f0442cb4-b6d4-4477-ba8b-f14b0560772e", "comment": "Malware payload (Mirai)", "value": "5359dcc13dad63f34f26640e8a7830c334d833f8f9bfef1374d136a12cdda529", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652406, "uuid": "d70914ed-80fd-4c22-a499-865bde0b2325", "comment": "Malware payload (Mirai)", "value": "9ec90a11eadb897d55f2a1a38ccd0ffad1d71f7a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652406, "uuid": "99827647-e88d-4840-9b0e-f9c9206162db", "comment": "Malware payload (Mirai)", "value": "dd9cea4862a258a63f340bdc94f49a2be8a1ad6fa661424e2cb568b87d2b5dcdf9682e5e3bbfeff936242099c2f3f924", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693652406, "uuid": "61d8ebd0-a467-4e30-865e-65b5362df228", "value": "T1D8A2E015BE1C828BC832293444E9EAD61356FC71F2EDCC492940D16FF5A33A96874F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693652406, "uuid": "ab57d90e-ae9d-4ef1-93c9-5f7c5a29cc2d", "value": "384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkOaqOKV14b+502F2vwA9dWuMW21bAK/:x98o08kxofBE+ZkOaqGbp2F2TWul0c5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693652406, "uuid": "060404cd-a4d7-445a-bb5c-4829a927a205", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693652406, "uuid": "30b8c788-e549-4bca-b29f-5311806fb617", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693652406, "uuid": "b74eeff7-108c-42ae-af5b-7959f1a9322b", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909d4780-4954-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693633804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693633804, "uuid": "07fd5128-108b-4824-9a9f-a3600795236a", "comment": "Malware payload (Mirai)", "value": "55da5977288f560791a13f8423c23483", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693633804, "uuid": "349405e0-c164-453b-84c0-e9ea0f120ef5", "comment": "Malware payload (Mirai)", "value": "53f73467ed569f2155baca5087da36bbe49a03d4fdb05b5a3aaa41556ac59493", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693633804, "uuid": "20be37ad-de76-4917-a110-8b717985654f", "comment": "Malware payload (Mirai)", "value": "1fa9fdc0763f91f89f188af400531859bb73319d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693633804, "uuid": "d4615998-9b55-4307-bb14-973060d37204", "comment": "Malware payload (Mirai)", "value": "db09551d81366b9a2ece5a371f73b198b1447d5f9c3e56b5d35ec6b089a43d9bc8022e8cbf81d3fd95a1667222aba4a4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693633804, "uuid": "6e02b746-0813-4c34-847a-45444ed37147", "value": "T189C32A56EB408B13C0D6277ABADB424533239B64D3DB73065928BFF43F8279A4E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693633804, "uuid": "dbb185db-e061-4bea-83f4-c0f9b7b996da", "value": "3072:8dRtU9zai5NWEUo8Xkkoh4/PPRNTqM/9av7E:8dRAzai5NWEUFXmAPPRNeM/92o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693633804, "uuid": "073ac23b-4b8d-40de-a53f-6ba2db8cf6d9", "value": 129042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693633804, "uuid": "4c8c7432-9234-4876-a253-04153f71c73c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693633804, "uuid": "a93ebab9-646c-43f5-b0d6-03e91eeaa4c9", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f4c205-492d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1693617227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693617227, "uuid": "c2e9cbef-2fb8-4618-8293-6e6e52e999c2", "comment": "Malware payload (Stealc)", "value": "03b75cb65dfc55f7594704128d3c2bad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693617227, "uuid": "ddff9e18-14b4-40e3-b429-f4aaa1ac00bd", "comment": "Malware payload (Stealc)", "value": "5401590c0dd63cae68769ddba894fd5fc7f5b7bd97acb325f2d9c6c43798a27c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693617227, "uuid": "c75919f4-6d29-47a7-bd0e-1a15fcf3db66", "comment": "Malware payload (Stealc)", "value": "860fe6106d80aca1dfbfe2e2b42464b127cc4f02", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693617227, "uuid": "e0faa946-caa9-4f90-9ed4-b9f856e72182", "comment": "Malware payload (Stealc)", "value": "a6d1de5234cb174bb0b1301a027ba0795cad918c3bfcb706a420ca5dad8cd558a9f98f04955a2965d74bc82013a926f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693617227, "uuid": "8e7497bb-941d-41ce-9b91-a12e0286a2ea", "value": "T1F3A3D500D640582EE1A540FFAAAE5BEBE85C3E741300D0C3EBB16D792AE51F5A4B457F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693617227, "uuid": "f613d5c1-7fd3-4f03-bf0e-130a3eaf7f68", "value": "372dad7e771f409df9ab1b912548c291", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693617227, "uuid": "c8a87287-a583-417d-bfee-bd9158902fa8", "value": "1536:lI5Llf0xro4tjPwkqp2kzi/15ERKwAHLFGzKjhqgUZdb4JElJL4gvjMTf9L6J8vL:liZkPwbpTK8Q5Uzf4JElJvIT4uURq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693617227, "uuid": "2f8f3a8d-0ee1-4865-923d-27bf3f2e83be", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693617227, "uuid": "95902ad8-fa85-42d2-b1a1-1a6d54a23818", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693617227, "uuid": "b0d3ac0b-e295-43e4-b43f-2af83bf644a5", "value": "03b75cb65dfc55f7594704128d3c2bad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3941b1-49b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693677151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677151, "uuid": "90d9bd60-5dcb-493a-9061-418d78b72b78", "comment": "Malware payload (Mirai)", "value": "be62c3d566390d9e1f04ad3eee77f986", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677151, "uuid": "aeb3c64d-5d98-4dee-9078-70356eb4ebdc", "comment": "Malware payload (Mirai)", "value": "55475c01a04def9c8b70effed96ae62e8ff58bcd04a5cb00afc7649985bd2d8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677151, "uuid": "a66c935c-e79b-4848-aa5a-f9b2809e29b3", "comment": "Malware payload (Mirai)", "value": "47bfee456fd2f7ae19f3e3973e7d42170220b6c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677151, "uuid": "36f02f20-3d95-423d-b492-dc6dcbfda11e", "comment": "Malware payload (Mirai)", "value": "e1495a8c516a865272c98198fe900c7180926e045ba01db7312f9e3a82148e6282b8d4b41e0178a5c9b1458ca874c4ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693677151, "uuid": "a7114e25-738c-49df-8dc2-bc1ccd057481", "value": "T171539FA5C5ACAE58CB1441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693677151, "uuid": "479a9054-fb78-4b2d-87a9-8082e268a70c", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693677151, "uuid": "852667d7-35c8-437d-b477-a6adc90537c6", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693677151, "uuid": "006f14fa-14d2-459b-b024-d31f97319af8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693677151, "uuid": "b8121718-1637-4a81-83ef-d7194d192857", "value": "be62c3d566390d9e1f04ad3eee77f986", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "297e962d-49b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693674004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693674004, "uuid": "ce41ac39-b573-4c07-a1f4-d1ed1cd5aa17", "comment": "Malware payload (Mirai)", "value": "d874c93754a6e52dc7a5738cd6924269", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693674004, "uuid": "c8e8cf89-e04c-4815-8c77-193a8665eff3", "comment": "Malware payload (Mirai)", "value": "57203bcf8b16e00d3737f554ecf7b8cd4e3d3d25c0a00090e0146b55ccdeb629", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693674004, "uuid": "c17301cb-4005-4ff8-aacd-a3ba965704cc", "comment": "Malware payload (Mirai)", "value": "21272e25e057f51b105e69debf1c5f60cdaf0db0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693674004, "uuid": "66ebe755-76e9-4521-b679-616afe787fe2", "comment": "Malware payload (Mirai)", "value": "3b8bcdbd92f0bd3a73613aa39bb05ace7ca6b6e9692d1d387ac25cd95359b2c83c693de31e9704581b8e7d426c9d2a27", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693674004, "uuid": "0f8bba5e-7da9-403e-90d5-912253c09bb1", "value": "T1A2C2E0FA3E77799BDE39003A3459CE338674A012D7AEB6539240524931171BCBB329ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693674004, "uuid": "ffcc1102-752b-4637-83a2-85f7933b6827", "value": "384:MX1DMwk8JPyG3GDZaEXVZVBy6HInRiWLRYh4Sw4cGJYeRzOFGBzd8QRu6x9ehNyk:qMwoDZLFbBy6HQHRYfeAxdd8Z6xl0Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693674004, "uuid": "557dec9e-33cf-43f9-8523-5ad9c15cdbf3", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693674004, "uuid": "ef6441db-acae-40e5-894a-437a40169801", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693674004, "uuid": "8350d341-f1e8-485b-a96e-c0f25e91b431", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6382645-4949-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693629197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693629197, "uuid": "2ed91fd7-b272-45a2-a6f3-03a3e4e2a390", "comment": "Malware payload (Mirai)", "value": "48af45cab64cb1bdcf1af41c55aeee12", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693629197, "uuid": "ab2915a6-97b1-4ec0-9bcb-f5dc4cc4b125", "comment": "Malware payload (Mirai)", "value": "58950822a39eee3c450677b2f8afd0743e178390b9d1c257ce174412dfe9ba3e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693629197, "uuid": "7b28607d-0462-4a18-82fc-6e21bcf9f972", "comment": "Malware payload (Mirai)", "value": "2696b5a2b8abbe44c2f970128b2266ef79fc9297", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693629197, "uuid": "2fcf8b50-13d0-41cb-9745-fc26583c8dc6", "comment": "Malware payload (Mirai)", "value": "8800bfafd702fa06bfd4d976b1547bfd4db41d60cb9fc3aa590fedc1b1254d5e676c58b7448ce9e7738ada0241277e9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693629197, "uuid": "2e99dd29-0f06-4ed3-9fa8-e5e649621088", "value": "T1B7E34C42EA818E13C4D5177ABAEF42493332A75493DB73069D186FB43FC6A6F0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693629197, "uuid": "b66f909b-86af-4fc8-b74e-9101c71b5d60", "value": "3072:xhT1tYibUXYkWuejoq0uCPJC4Lw7Wd9ixk19zfg0735pkHToDLOfM/9iYdxh:xhT1tYibUXYk2joqXCPou5hfg073nkMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693629197, "uuid": "4a8f8ec7-0139-49eb-aa5c-9a938e9b2da5", "value": 146684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693629197, "uuid": "e7b36996-13b9-48cd-8d27-cc2efeb193bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693629197, "uuid": "ed00a6f5-d781-43b1-82fd-20773122e79d", "value": "48af45cab64cb1bdcf1af41c55aeee12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2821f5-49d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693688561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693688561, "uuid": "e2748682-9e24-4b7f-885c-c84b95f7dc30", "comment": "Malware payload (Smoke Loader)", "value": "c4c6e715804909ce2648603961319606", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693688561, "uuid": "871655cd-d743-43b7-b744-ac3def861d89", "comment": "Malware payload (Smoke Loader)", "value": "59c3ef0b04f7f8f424ec18d68e886610f886467d9c814e2a3c10378588139967", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693688561, "uuid": "83e5307a-a701-45a8-9e4e-dfcfc9c0392a", "comment": "Malware payload (Smoke Loader)", "value": "8ebac453471dd25a71fd64b7094079f57b24b5db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693688561, "uuid": "611eb49e-7e11-491a-ae15-6a2a34cebcae", "comment": "Malware payload (Smoke Loader)", "value": "ee4caa451865638b424c97fffa585f16147c4747ae9f3f22c883f9d80a355d25bced26dcc6c2614120001a7a5e334f94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693688561, "uuid": "9ffb5171-6010-4ee7-be88-c10d035de45d", "value": "T10A547B43A1D0BC39E016077D9F1EE6FC372EB8614E25AB522F545E2B1D712B2C69B309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693688561, "uuid": "2212d271-7568-47c3-93a9-3ba826a4c6be", "value": "515f729e8e6f1501a5196a14cf216d36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693688561, "uuid": "f8caeef1-3073-43c8-a51d-add12822ff9f", "value": "6144:hG+UeVz1pbvBetCD5d1dYD6tHdIl/J4dsy:1UeVzvbv8w5d12D6L4y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693688561, "uuid": "fb99c26f-a3e8-4f7e-879f-645a95ec7fd2", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693688561, "uuid": "46f0db7f-4ce6-48db-9c3b-25d2889c9892", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693688561, "uuid": "5f8a5d2e-2c31-458e-9144-218628416409", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a7df6c-497f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693652330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652330, "uuid": "26e8ce29-bc4f-402a-9d50-727f8510187d", "comment": "Malware payload (Mirai)", "value": "56b82f2ba0604f0c4030c2989fa4b8f4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652330, "uuid": "f951a7b2-ce69-40d6-9666-abb7f028e2f6", "comment": "Malware payload (Mirai)", "value": "59fe8d6118560d14ed440fcb3fd92dae6ae0a6bfc6202e21ad886af2e6c37a0d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652330, "uuid": "b23f2439-a7a6-40ec-ac92-e243dc3c0a62", "comment": "Malware payload (Mirai)", "value": "70abc3593a6e2b4e3bf3dd66e1a4de0f5c6da426", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652330, "uuid": "d73e01df-5ac4-462e-93e7-d57ea56e4c68", "comment": "Malware payload (Mirai)", "value": "f1ec091cb6c62c649572b04457a8ab4fb5ea6cf51b43a512ef227bdc02ab147c02a69c4ca1e0a8265e65abc484bdf05a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693652330, "uuid": "8f6d7511-7aa9-4f4d-9a53-c340b5c659fb", "value": "T13DD32A56E7408B13C4D61775B6EF42453323ABA4A3DB73069928AFF43F8279B0E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693652330, "uuid": "23742529-6baa-4fab-b5ad-656498eba5a0", "value": "3072:lS6VGvE5uazAFEsHYw3NK8YwxGnmp+SQkM/9CH:lS6VHuazAFEs4iNNgnmp+SDM/9CH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693652330, "uuid": "8db5bbb8-6d72-4e7f-a1d9-418f1195fdc0", "value": 140758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693652330, "uuid": "c07ab858-a877-4937-b59b-a71119e501e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693652330, "uuid": "7d6fd38d-d019-4268-aba0-0b55c91e4417", "value": "m7.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3112b410-49ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693677453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677453, "uuid": "f01cca7e-d3bd-4003-9308-2563031b35ee", "comment": "Malware payload (Mirai)", "value": "398ab2b6cb8822d7500887a9bbcce805", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677453, "uuid": "bad338df-373a-4deb-8e3e-f1be406de0be", "comment": "Malware payload (Mirai)", "value": "5c2b894375a1aaf77c5e6bb53e8579e999564b4f47b016e1c9a1232d59094f4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677453, "uuid": "1856cfb5-1425-434a-ac03-c68b4d9d41a5", "comment": "Malware payload (Mirai)", "value": "01950a63b04383550258dff73eb9901f9443b1a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677453, "uuid": "3c5fb622-ba49-46d6-bc33-0554e4f94da4", "comment": "Malware payload (Mirai)", "value": "3676741c2c3a49301a345ebbbd8ac7c4587ec5b70bcc37249b75a7a5bf2639950da243c2d4d5d74d286106fdb7ebbe51", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693677453, "uuid": "0e14be8a-4f52-4ebe-933a-b6af2761a74c", "value": "T13CD2E00DCD1E7D45DA6C3EFD50CEA6F539486484935AD68E17628408FA17F87FC070A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693677453, "uuid": "d363d560-58da-454a-97ef-bc1cf38ba1d6", "value": "768:M1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNBJbpWGPOA:MbDs06t4BEub4sU/MbUBzPv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693677453, "uuid": "c72c4307-df23-41a1-a16b-b86f628bfc0c", "value": 30540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693677453, "uuid": "cec05b87-441d-40b7-b536-0793775cf3f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693677453, "uuid": "64bf6c45-15f0-4c55-837b-69b2e1fa2146", "value": "398ab2b6cb8822d7500887a9bbcce805", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef7a7ff-4997-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693662605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693662605, "uuid": "9e2d6821-ee19-4b49-86e6-98b1055920c8", "comment": "Malware payload (Mirai)", "value": "1ef99913d36cd2b4978887738ca5be4b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693662605, "uuid": "57e677ce-2db7-4415-9b6b-b4f000c468ac", "comment": "Malware payload (Mirai)", "value": "5c91b8a615eac65aaab90c77f4b83873555f3ffaddccfb30156b76122d0b254e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693662605, "uuid": "163eca67-a99b-4a01-badb-767434d12de5", "comment": "Malware payload (Mirai)", "value": "8e2a3161fd7ab81f164dd796ebf16a007d7bc5c3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693662605, "uuid": "442e47e5-d2b9-4f3f-9447-55b85642ff56", "comment": "Malware payload (Mirai)", "value": "91bd7980846c5aa60b3e1fe8dd71c77ff6f2130ef166223c8bcb6071c78b5594e913b8b93dec4fe04fec9f300ce514d3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693662605, "uuid": "c56d7391-3c3c-4c06-9e00-596c86b097c6", "value": "T1E1D33B46FA818F17C0D517BABADF424533229B64D3DF730689289FB43F86A5E0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693662605, "uuid": "04dc7112-96e3-4785-96f3-d62684fc1794", "value": "3072:wdKarlphWnimDBrIF10byn86gxe4DEgpcVoVC1sHM/9SxjQ:KKarfhWDQ1cyn86gxqgW2C1CM/9KjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693662605, "uuid": "e68fb695-a392-4a16-b724-0b7f182a3c5c", "value": 132993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693662605, "uuid": "e1887c3f-ed72-4108-b7b3-bd2b96e5d34b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693662605, "uuid": "ee504fed-a924-4a47-acbd-9c46e39e8969", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6573a74-49cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693685863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693685863, "uuid": "4f1adfbf-730a-4522-892f-019f8c6e2a1d", "comment": "Malware payload", "value": "42af29f875571eaad889bde62eb545f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693685863, "uuid": "fef4666f-da14-44a3-8e25-1734df65371e", "comment": "Malware payload", "value": "5dbcd23c3c7942c63c029350bae2667143159e730621f8e50c5f186c9141245f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693685863, "uuid": "87f85d7b-d425-492a-b871-be9cee70f0c7", "comment": "Malware payload", "value": "c26c86a4c0de33a6ffacc3dd6c21845f2a5de47f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693685863, "uuid": "aecf0328-f0be-400c-9ac1-ace4ae207fed", "comment": "Malware payload", "value": "81b7735aa0af3c7da65f2dfc27cdaa360476829ec526fe0f7e60a8d92b3ff55d296ef887dff06560d143a3cbe003cecb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693685863, "uuid": "3b20aa98-2cf9-490d-b6a5-631802629102", "value": "T1F1B3195AE7808F03C4922B75B7DF424233239B5497AB63065928BFF43F867AE4E23515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693685863, "uuid": "d4388558-0612-4004-a4bf-9b56de2539ee", "value": "1536:9Yn1NVr2aiT6X0CMoXqlB9igXyX7RFY+h/MzyuMKmPZQfPWzw/9VeM6e5l:SqaRX0C4xXyX7RFp/MzypPXM/9Vem7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693685863, "uuid": "8cde3619-11e3-4f3c-8f4f-eed45bba414a", "value": 114304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693685863, "uuid": "896bcb3a-521b-4145-8aa5-4f2f786bfd7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693685863, "uuid": "e773a2af-3ab9-4b88-b236-c9523141d58d", "value": "42af29f875571eaad889bde62eb545f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "862fc22a-499c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693664711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693664711, "uuid": "1fc10c89-a526-48af-a739-e8f4615e0028", "comment": "Malware payload (RedLineStealer)", "value": "4f38b6f505908888568dab730c5ecc13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693664711, "uuid": "fde0aca0-c3e1-4bc6-b989-baa4eb8f01a6", "comment": "Malware payload (RedLineStealer)", "value": "5de16e8621b05a3c47959c10985b2dab91553d4220073ec169ff90ef76bdc303", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693664711, "uuid": "9917f4c6-de6d-4f83-9ee9-876ab1a98ce3", "comment": "Malware payload (RedLineStealer)", "value": "bd461ed3f3357a603a4cdccec0672c9512907d3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693664711, "uuid": "58706af9-20a5-4125-b0d8-2084766acdf1", "comment": "Malware payload (RedLineStealer)", "value": "5e78ed23aef7566730cef117d494c2b7d8845a44bb7c79f507d546257b9b3ce674184faba0290649bb5633d8a9c5672e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693664711, "uuid": "a17567d2-2ce9-4e8a-a965-f876e343c9a8", "value": "T11F85DF01B6A5CF9AE38C237186E7C66C5751ED63B252770F1B2CB15CB9B23768A003D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693664711, "uuid": "27aeafcb-2930-4b70-aae7-5b18496f665e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693664711, "uuid": "f10343e7-ba48-4a91-b715-50f4a4a4a9cf", "value": "24576:Nm6uKbi9c1npqsgArlxPEIlH4r6zVXwKa4o6DPOIOyLeXdoWcp+e7FccvbeBKznC:gHUoAB+MlwNwPOInStoB5cJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693664711, "uuid": "34dea208-8746-47e9-97c5-1595be36ae1a", "value": 1802240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693664711, "uuid": "ecaaa140-3bef-40ef-8fbf-21d8ac2b11de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693664711, "uuid": "398c90e9-325d-4e57-a4e2-e2e3823e2932", "value": "5de16e8621b05a3c47959c10985b2dab91553d4220073.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f43b638-495d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693637480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637480, "uuid": "bd146750-e723-461a-b6e3-55d498e8f42e", "comment": "Malware payload (Mirai)", "value": "6cb8360ce33c28934941e3117bbce3bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637480, "uuid": "a1c80223-6c03-4520-8126-2264751abec0", "comment": "Malware payload (Mirai)", "value": "60645e5b903b874bd8e540c5fc8a89cca8a06d5ad93c63739125265c26516986", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637480, "uuid": "ea2a86e1-fbaa-4c89-a3d8-7d83e93e10c2", "comment": "Malware payload (Mirai)", "value": "3a59c147a35dc0f6fde16a3db3232c58b09d952a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637480, "uuid": "a592334d-5af5-4ef1-9a65-d78dc217afef", "comment": "Malware payload (Mirai)", "value": "fbbd2c10586429b5c11de192a67dee0a62548e54a0bc8a49effa52debd8fc043d8570aa399ccbc948773e7fdc15ee88f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693637480, "uuid": "ab0aa955-60e6-4618-9b83-e3519938b1b8", "value": "T17FF2E0232955DE61CFF0317AE6E17201BFA91E7CD16874B216506F14BBCED8F64A028B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693637480, "uuid": "31156042-b413-48e8-a585-3e681082e635", "value": "768:9b+GsIbn0XpiTAPB4bT9bOs26GIa+UqaXCs09q3UELQs:9b+GsLidbT4s26dVUqa7dLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693637480, "uuid": "29620016-1cf1-46b7-b6d7-e7e3079d84ff", "value": 34488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693637480, "uuid": "cf533a9a-8d96-4ad9-91ea-2ec6ff98d73f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693637480, "uuid": "9633cfae-0add-4f70-b4aa-b951f92d3a29", "value": "6cb8360ce33c28934941e3117bbce3bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a014d5b-4966-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1693641309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693641309, "uuid": "138b5f34-579b-4e43-91a9-66b71d991afb", "comment": "Malware payload (AsyncRAT)", "value": "bf53ed4544ae919496ff12f7969ba3dc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693641309, "uuid": "15501b9f-f438-4fdf-9575-18e458a73b50", "comment": "Malware payload (AsyncRAT)", "value": "641926faa61b285dc56392e849301861e5f786a3e45a7373dd334f34aa65d40d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693641309, "uuid": "790556c5-66c6-4e99-a826-d6e5c42dbc82", "comment": "Malware payload (AsyncRAT)", "value": "cd2a5ac9357bc733dbce4bc2f8ee488199154b57", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693641309, "uuid": "a5481027-8912-4acf-b322-4f9736997f03", "comment": "Malware payload (AsyncRAT)", "value": "fd93b706380c86a6f83102dec21bdb0cc792598f333fb599a062ed0be4d1c1c08fc10dacbb742a62a3aac83704bd9f68", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693641309, "uuid": "a093336a-7147-4004-bc1a-57b2b8acf125", "value": "T117233C007BE9C12BF2BE4F7469F26146857BF2672603D64A1CC442DB5613FC68A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693641309, "uuid": "4a778732-0b0a-4cda-8802-e8e78566d1a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693641309, "uuid": "54ebbbfc-8169-424e-8148-09dccb1648a7", "value": "768:auu91TwQsOnFWUF01/mo2qDpwUJ+CQswGhWPI8fhMz+0b+FOAjv5JQgMc4jmXDBc:auu91TwSo2JQhf8fAxb+FTjv5JQhdiXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693641309, "uuid": "8524d16b-b1f0-423c-933e-e9306a1be6ed", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693641309, "uuid": "36d6fadc-639a-4684-89c2-cf293e04e47b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693641309, "uuid": "126cfcca-dc5b-473b-a413-6a5592ee1778", "value": "bf53ed4544ae919496ff12f7969ba3dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aee16158-497f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693652323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652323, "uuid": "ecae42a4-8d8b-409e-90a8-66b8160aef18", "comment": "Malware payload (Mirai)", "value": "2e826f3ec155bb0dadc9ca59c92e3b1b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652323, "uuid": "0b93c521-0be6-45cb-9697-0434506eee31", "comment": "Malware payload (Mirai)", "value": "66f90e88f8f1b2b3ff5bc7c3329ecd36982c4dbae7455aafcd261162b3398ec1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652323, "uuid": "db1b0951-9c1a-4cbf-addd-33559926f39e", "comment": "Malware payload (Mirai)", "value": "6f1fa3b918dab8a06dbbac10ee575efdf57a0030", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652323, "uuid": "d769cacd-3349-4689-ad4b-a89a703ee92d", "comment": "Malware payload (Mirai)", "value": "f1a40481c205f0aa58013e807a158abb6858a0b09241bfe5b7ddce6c5a5a66610d239c56276774bf813cc4f303fd3658", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693652323, "uuid": "2d2a0866-9e1c-4789-b7ff-0ad387b29e97", "value": "T1BC434A50F8819623C6D1127BF66E468D3B2613E8E2DBB3079E225F2037C686B0D77E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693652323, "uuid": "3546c51f-cebb-4e8d-8e0b-48471261c8f9", "value": "1536:pjzQgyzv4qsU9K7U+0FQL2g4TtiCsyXvqnK:pjoE/0qLh4p9ZqnK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693652323, "uuid": "cda8d663-a96e-49eb-9b76-80e8ec8968c1", "value": 59640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693652323, "uuid": "5cba73e9-a8b9-4cc4-b806-88d07bb7be6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693652323, "uuid": "b37c9961-ad1f-460c-b800-6658f7e98826", "value": "m.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bc007a6-49ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693677444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677444, "uuid": "768d3026-5d89-49af-a35a-994b33e6486b", "comment": "Malware payload (Mirai)", "value": "6e922b79d13ee63fa73fe56ad6d6b56a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677444, "uuid": "19199935-b0ee-41a4-8823-55efc8ccda50", "comment": "Malware payload (Mirai)", "value": "684c66dc7502cc914df7e8325d7120af7bd97b6f5f0987b9d77230de14d79dc1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677444, "uuid": "45e42a69-b3c7-4397-9a25-2012908c5dcb", "comment": "Malware payload (Mirai)", "value": "3d7992528560af23cf72314b2c8e47590970fdc0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677444, "uuid": "15a3d231-9f8f-4c9a-b0b9-423a52708861", "comment": "Malware payload (Mirai)", "value": "c89e6734470070a387d28f7955d51c81fa90f8d7b5c7c4029888020070eade59024b1a84538c47aa1b6b478d8ab45801", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693677444, "uuid": "d84f35fb-6c58-4512-9f1a-59ced4fe3f16", "value": "T177E2F1E393A1E052DDBC1BF2F52DC18A52BE4A5CD17630E22E056A143E9B0535F3D883", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693677444, "uuid": "1d8f2c8b-51a9-46b2-bc5c-7055104e327e", "value": "768:voiWiO031vpAPbrVWZK3XVGxm9XA5iY3UQwpI4:vorm1vpALgUJAl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693677444, "uuid": "2452f717-3a7d-42f7-8298-1d819e6b2c0b", "value": 33164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693677444, "uuid": "cae97fbf-6279-4683-9c82-d4114ac8c86a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693677444, "uuid": "4ce930f8-6dfa-4f2c-a019-22d22adce94e", "value": "6e922b79d13ee63fa73fe56ad6d6b56a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e689d8f-4948-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1693628647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693628647, "uuid": "6b1a1762-997c-4bec-b9ce-5a3d0c9565c7", "comment": "Malware payload (AveMariaRAT)", "value": "c4e53624a2e54d34ea5ba4d8e9ecd2d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693628647, "uuid": "5c8e80bf-5f53-484e-a162-8c23995f314a", "comment": "Malware payload (AveMariaRAT)", "value": "6ab12f059377cbc6d2d3ea4114162da25e04b0c00857fa0cb03b51fdcb6b8031", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693628647, "uuid": "58d6b2a2-3196-4b5f-b831-34e1aabe5d2b", "comment": "Malware payload (AveMariaRAT)", "value": "f1d25a67242f3190cd6f06b221b9256745fac934", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693628647, "uuid": "77744d56-4111-415c-b7b1-e036e27089bf", "comment": "Malware payload (AveMariaRAT)", "value": "cd865c6274b512281f8020705d414b75d5d6222c354d4529291180ab42512ab67f68662593ca7c02e2d901ba0cfc577a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693628647, "uuid": "003a04a9-5869-4092-9f46-80a6242cae94", "value": "T18E454B017E40CA11F0191633C3FF468857B4E960AAA6E31B7EBA3B6D55123937D1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693628647, "uuid": "a9101f5d-a89a-4a34-aacb-2a8c8fb384b5", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693628647, "uuid": "fa656951-d45c-496b-af21-cbb27613db45", "value": "24576:T2G/nvxW3WjfHyncFJbd5r03lNiB0Zj/OKHzyMNeV7:TbA3GIcLbd5r+lJ6Gl0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693628647, "uuid": "d84f953d-bd8d-457e-8048-0be1ea1d53a7", "value": 1185420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693628647, "uuid": "cbaaf428-a900-4ffe-ac25-a297f60854ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693628647, "uuid": "6c08422f-48c6-4d42-b588-6f076177907a", "value": "c4e53624a2e54d34ea5ba4d8e9ecd2d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bbb0a67-4941-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693625662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693625662, "uuid": "620838da-67b4-48ff-b8ec-df3a28b25336", "comment": "Malware payload (Mirai)", "value": "081e853f3d32f690edd4664a46a29198", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693625662, "uuid": "f56826a3-6f78-41bd-a6f4-8a18762609ed", "comment": "Malware payload (Mirai)", "value": "6b74fb47d69d8908d65bc2f4a6a43899200a109095bf0e53238e75f322caa10b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693625662, "uuid": "8ebd04b9-c67c-4b89-853e-eadaa90ed124", "comment": "Malware payload (Mirai)", "value": "56098b5feb92dbb5996e857d22eb52290e715881", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693625662, "uuid": "39cf679e-2db6-4a18-afa8-e36d96d9be82", "comment": "Malware payload (Mirai)", "value": "c6a803d916de494c8f4d3a81c6b939e811fb4aabea385f630ef65b6829abda3a6ce857bc0b571fc85451999612cd0511", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693625662, "uuid": "1ca3ebb8-ccc7-4236-9ba9-d919f9aa1785", "value": "T17F63189678C19A12C6E423BBF96E01CD332563A8D2DF321B9D212F5477CA82F0D77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693625662, "uuid": "9d4807b2-4d29-4917-bbb9-9f2771d34806", "value": "1536:E69UvD15uu1q7+pIVF5fiJZyqpRTw7tmcahWMUql4g5f9/e35mE35z:E6+ZlRgtmvhTUgy3f3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693625662, "uuid": "9c02e498-dca9-48b7-9140-04636044abac", "value": 72196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693625662, "uuid": "5d7109cd-563b-47f3-bfc6-f445c7b1864e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693625662, "uuid": "86b09cce-bf59-4b30-aac9-93fc5157fb4c", "value": "081e853f3d32f690edd4664a46a29198", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c68112-4976-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693648206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693648206, "uuid": "deea1bad-d917-4be5-a7ea-1bf0b3ca34db", "comment": "Malware payload (Mirai)", "value": "16ff8cea17ab23dee2dd88e71862c853", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693648206, "uuid": "2c632c54-3312-49a0-9c73-e1824b65ce17", "comment": "Malware payload (Mirai)", "value": "6c79512a4af0df4815f4672f3386b703222351fb26e4f01364e3ddc5cc67aacd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693648206, "uuid": "5f5e318d-af8f-4b29-a6bf-14181119a8e7", "comment": "Malware payload (Mirai)", "value": "0e7e82238fc134b3379123465e480ce9befb8ffd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693648206, "uuid": "30a62e2c-8b54-4151-ba05-b0acbd3016f0", "comment": "Malware payload (Mirai)", "value": "45828ae3412e309fc1eb7ff447ef84fc036de719fd3b8b079e9201f3b75fefad169425dbf872c43d628fc9b819064187", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693648206, "uuid": "b1dcc25a-317f-4544-814f-e549d76a4b81", "value": "T12E431855B8918A17C6E422BBFB2E418C332563F8D1EF3203DD212F55778A81F0EA7695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693648206, "uuid": "e3ee7f64-44ee-4f41-b05c-9a4915041fe3", "value": "1536:HMqarwPiGUYnKUkw2gPhxft5R3LcqJeP:HMqarkBbfP3byqJu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693648206, "uuid": "9d084d4a-af40-4ba8-ae80-a33efc26d153", "value": 55568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693648206, "uuid": "a5ad5c29-31a8-466c-9d96-3e1cc7dbe19d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693648206, "uuid": "f3b64242-554c-4781-8d98-246de10abd49", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a080bb0-49b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693677146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677146, "uuid": "f2ca5639-dbae-410c-9291-41e84f034544", "comment": "Malware payload (Mirai)", "value": "f1555e647ad910d53cf7b6644c7e313f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677146, "uuid": "8481004f-8faf-4cc6-9ca8-6b5b234601f4", "comment": "Malware payload (Mirai)", "value": "6d8a7dc8aad580534a9702821c598815bd9b351576a631e8900de5fcd6b8fb69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677146, "uuid": "19c0018a-fc89-4839-8abd-33e842ba2aec", "comment": "Malware payload (Mirai)", "value": "01f697875b7a818ab39e3db710954527b89f6e3d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677146, "uuid": "9b0534ec-dc40-4776-85fe-caf3cd3dbeb2", "comment": "Malware payload (Mirai)", "value": "8367aa5e9e3870b3765d34b65f581319c5ffea9f3cf8dd6e34cde7d93b6eecb3bcf8e02c81b077f902ca1b9a2896845d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693677146, "uuid": "fa014780-ebae-414c-8d2c-3fad9d3d670c", "value": "T173536DC6B4119E7DF5CBE7BE44220D0EB821626150931B27BB6FFC83BD721A48956E07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693677146, "uuid": "40794a8a-0633-4cf4-8cc1-2c0dd8672ccd", "value": "1536:kPqRg0FZTbSX5xZLepSGossFpxhOx2X/ZOqc/yA83:p5ofF8I9cKx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693677146, "uuid": "b7e8f4f1-7ada-4f7f-9d89-ed8fb981981d", "value": 66508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693677146, "uuid": "2b79b656-b9c4-43ec-82bd-a0eaf146d350", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693677146, "uuid": "86316298-3347-4910-965e-dfab224d3073", "value": "f1555e647ad910d53cf7b6644c7e313f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "916cc066-4954-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693633806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693633806, "uuid": "aca8685d-70aa-47ef-8d53-228814be983c", "comment": "Malware payload (Mirai)", "value": "f70613e398a38243066b39685fc3339b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693633806, "uuid": "bc8a3f53-b20c-41f2-aa31-43c359d6168d", "comment": "Malware payload (Mirai)", "value": "6f060e2a4266624079ee20b2c44fa8b60b619cef15b8077fae2b2a51367c1ba7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693633806, "uuid": "02d4aa45-4ec9-4fd3-9eb2-f29ce6168358", "comment": "Malware payload (Mirai)", "value": "b91133cb7177a92407a3b5fc1a06f8167faf3974", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693633806, "uuid": "6edaf0a0-009b-4d3c-8c2d-1b633e38711d", "comment": "Malware payload (Mirai)", "value": "39101744a72186cb15d7dc16c34dedd8b5de45fbc2250cdc26f746e65cba60471e9e5bd42f0b8a0039341822004108d6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693633806, "uuid": "30652057-6c3e-4b53-92fa-8f1902cb573c", "value": "T1BA335B91B9815A13C6D0227BFB5E028C372657A8E1EF73079D22AF113787D2B0E7B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693633806, "uuid": "b0508a1d-b15e-4491-8bea-4e9ece908a6e", "value": "768:9x7ZMtxu91fuFGqoDzMlMasc7kFKkMPW2/2N+Tv7rCuVJthvWI:bZ4CRJzM+PjKPJ+cv7DJhvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693633806, "uuid": "f4727c5d-3caf-4577-8149-ae2194985505", "value": 51168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693633806, "uuid": "f37d73a8-1e2b-44c8-842d-76b8ef4cdf89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693633806, "uuid": "9606ae69-eef0-46cb-bfb6-82c25fb668f5", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c26a5268-4984-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693654504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654504, "uuid": "3a6a0bf3-23cd-4794-8338-d3899d916d15", "comment": "Malware payload (Mirai)", "value": "6d019b4cdfbd6aca7ce84db2babc6a67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654504, "uuid": "d2487fe5-36e6-4d55-8987-4494f72ebeb3", "comment": "Malware payload (Mirai)", "value": "702422c1b2fcdff27775292bd2104dc4e7e665dc918d5b0e03fca923098dc11f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654504, "uuid": "3f6d6b88-f09e-4342-a303-7e245892e0dd", "comment": "Malware payload (Mirai)", "value": "6fca9b6c64b82902de255ee3f29b028d1f078799", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654504, "uuid": "203a3af6-7a29-4846-8d90-4f06ce304389", "comment": "Malware payload (Mirai)", "value": "9754c330aeac4acda4651b0906accc98e6197f1d8445c20b35b0dc46bfe71db95ba55e23b06d74ab424cde7b2b88a68f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693654504, "uuid": "090045f3-ab18-4dd4-8a55-217f12e47955", "value": "T1F682B03052EB34B0CAB20835DBBDCEC39B154BB9E2FD329216486A6CED4640645B66D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693654504, "uuid": "87bf1fa9-be7e-406e-87cb-9b0dbe393631", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUUTUUzXphymdGUop5h5lM:2dV0P6+kom0tVAoNvm+tyips3UoznlM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693654504, "uuid": "69737e27-8307-4f7d-a654-cefc10b0ad8b", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693654504, "uuid": "8057268f-c415-4e90-9aeb-12c92bf5f236", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693654504, "uuid": "38607d34-903c-4d51-b604-1ba9b95bb93e", "value": "6d019b4cdfbd6aca7ce84db2babc6a67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5bea511-4984-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693654509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654509, "uuid": "68e17ae3-e66b-484c-8224-a95af65288bb", "comment": "Malware payload (Mirai)", "value": "68c2eca403c4dc7c5193f81b6e5c9b0f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654509, "uuid": "455d60b6-9beb-4022-bfc3-152e1cabcdc3", "comment": "Malware payload (Mirai)", "value": "7214f686a88a0cf19ac555846cd20d4583872f55d9e582f773e095a729838a0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654509, "uuid": "af1c5177-786f-4b28-bbae-7d176b96e725", "comment": "Malware payload (Mirai)", "value": "5aebaeee164bf08daf77b69901776dffbeaf0dbe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654509, "uuid": "e3348494-bd27-4960-8507-5a16eea7e2cc", "comment": "Malware payload (Mirai)", "value": "73d3981a54687cf72a888c594343e3a1b53c47a78256e91ea39a957f151278151d55682e41b780185f3a322d4f68102d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693654509, "uuid": "841d1b04-8ee6-43ad-8219-4bf19601308f", "value": "T144330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721A45E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693654509, "uuid": "6fcb8357-e65d-460e-8d62-9fd717b051de", "value": "768:gduPBFnHooqR8qOCKq2pH4Fje+TK806MMUVjzMfQXOtHud2oGf:r/hqaJ9cjeqK806MHdMfQXoHuCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693654509, "uuid": "08c7f524-9671-43ae-b8bf-1a65d708c8a3", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693654509, "uuid": "f8851ea5-7e26-4a29-a462-d12f9ae16099", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693654509, "uuid": "d1490e01-4668-4fe4-a341-087e508cb45b", "value": "68c2eca403c4dc7c5193f81b6e5c9b0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "406397ca-4928-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693614772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693614772, "uuid": "81cf3838-7fb0-426f-b85a-b2d26fd8a1f7", "comment": "Malware payload (Mirai)", "value": "504dd783c58dbdeab6351d87c4fa7c99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693614772, "uuid": "a43b604e-d76a-4c65-9ee4-e1de679236c4", "comment": "Malware payload (Mirai)", "value": "732e83b88e48cc7ffc94dea07f15ac579dba1af174348b671249a517c83b87d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693614772, "uuid": "8da44a7b-a993-4fdf-ba3e-c507bd91d2a7", "comment": "Malware payload (Mirai)", "value": "f06d364944470fc52e6b2bd8ee49cc28f9c67c5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693614772, "uuid": "df708bda-413b-4245-b2de-5de4abe25e3e", "comment": "Malware payload (Mirai)", "value": "f82f41f94fc482e506b8f21cd6f9d842bc7b9e5b1d2c0644b8b9224e6ecf4850f91043de4ebe58244a9d0cdcbe980f20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693614772, "uuid": "f2cb7f6c-cb8c-46eb-a3d1-ada5d2bde0e6", "value": "T1E7D2E1E510EA6431C27064B1D57AC9C275DB82B8C2EE317191EC76283E8E64327BA397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693614772, "uuid": "512a8b84-fb3d-4c82-9c3e-5ffd648d7a3c", "value": "768:wwqXpW9D/GILghmrC9g47499kFojy84s3Uozp:wwq5e/hV0Noj5tzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693614772, "uuid": "5569be96-62a7-4c66-a5a6-7e38592566f0", "value": 29896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693614772, "uuid": "92b4cc8a-b9df-414f-88a0-78c0da6bb12e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693614772, "uuid": "8a3c5b73-99da-4208-806a-4a15584bc591", "value": "SecuriteInfo.com.Linux.Siggen.9999.4736.10748", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8690f60f-49e8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693697353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693697353, "uuid": "528ea8c9-c07f-4bf2-92c7-1ebadc31fb3c", "comment": "Malware payload (Mirai)", "value": "0f96cceb61030c2052fd5ce6646abb2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693697353, "uuid": "8b2de62e-b00a-446a-a2c5-5f7d1430a8f4", "comment": "Malware payload (Mirai)", "value": "7577e3ca438cf8a15ecef1cca85a8f3446ca761600e9ed20919cb8ee8cffdd5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693697353, "uuid": "1a2c6cf0-f75e-4b5a-83f1-9d2efc287458", "comment": "Malware payload (Mirai)", "value": "ce542c8fae0a297514cf65f50b98568eda75710d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693697353, "uuid": "c0b0dbe4-2eec-4359-aed3-c5ad09ebd4e3", "comment": "Malware payload (Mirai)", "value": "ca2a121f75ed246ce585949e899d88d54963287ab290293483c169f4d576d0a17b23578ac7305b3621c870bed04e75dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693697353, "uuid": "5cc49c3c-67a1-44fd-9b0c-c35a5930139b", "value": "T1D7F2E071F9216130F2D05974321E4F813AA45CFCD17FB811B0AA6A9CBD61A561A3EF93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693697353, "uuid": "8714e9bd-d2a1-48a0-b48d-e7e71e64e273", "value": "768:nu9YDJSsqL8dTvlz+kZaJftXp/KJxrKu+lmLSZ2UqX9q3UELC0:nu9CgsqL8dTlqk41tXp/K/5+sLBDmLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693697353, "uuid": "70bc629e-4e68-4cb0-89b3-a5ba68953e97", "value": 34492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693697353, "uuid": "32173b9d-2aef-4ec2-948f-e982b4880f7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693697353, "uuid": "c7fa83b6-4749-48cd-8025-e7ff46725811", "value": "0f96cceb61030c2052fd5ce6646abb2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b5ab135-493b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693623004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693623004, "uuid": "05419c73-a1c9-40f6-8fe0-4e01a3fbb3c9", "comment": "Malware payload", "value": "68dd92a4e6aa18ae093325a45bd748d4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693623004, "uuid": "fee303d8-33c0-448b-8193-66799557f083", "comment": "Malware payload", "value": "7913757ab3edc19bf5f2ef9fc4d92c5794c387a9f3c4ae43fb1641b032a59884", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693623004, "uuid": "4510b6e6-2af9-41f3-a31d-be8622005ee0", "comment": "Malware payload", "value": "875fef1e80b63df8c4727759aa011b14a64e8eb1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693623004, "uuid": "3b568b31-738e-4414-ad2d-55b25708daae", "comment": "Malware payload", "value": "28720cada17ea0313d358356b3e85b0c590b0a6b3145c0c72f58a874ed70c176dd630a708ec3fbcc23b5ea22be48442f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693623004, "uuid": "163b8bc8-b66c-4387-a966-fc1a2c24f5a5", "value": "T18D66E083F7AA98B2D9B5467A4B71C3F850234C3A0357A9D7AA94323D6F372DC4691DC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693623004, "uuid": "e8e39c6e-cdd7-4ac5-9fad-2fcf24333bb8", "value": "24576:/pZ5C1YYYZ1g87baXAviira4ALNTQccOTfdu8XBlPLeMrM3jAR:/p2UgQeTp0c7BoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693623004, "uuid": "2a699c01-cf55-4192-9473-6109b7e38cbd", "value": 6507495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693623004, "uuid": "5c021417-1d95-4dcb-ab13-b54ab2c58dc7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693623004, "uuid": "45b36d23-e7d0-49f7-b530-cacfbe13fe1a", "value": "68dd92a4e6aa18ae093325a45bd748d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaee0a00-4976-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Adware.DigitalPulse)", "timestamp": 1693648559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693648559, "uuid": "23ddbf92-6c7e-4f23-8dae-8d80f2a493ca", "comment": "Malware payload (Adware.DigitalPulse)", "value": "90591e9f284040700b9cca160df5cb64", "object_relation": "md5", "Tag": [ { "name": "Adware.DigitalPulse", "colour": "#0E5916", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693648559, "uuid": "759c66ca-69af-4ebc-8ed0-7a81691c5177", "comment": "Malware payload (Adware.DigitalPulse)", "value": "7afafcbfe0b9ec3f6f32a0657aef1318bef5db8e698da4d81db74d0233792af7", "object_relation": "sha256", "Tag": [ { "name": "Adware.DigitalPulse", "colour": "#0E5916", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693648559, "uuid": "f6c7e080-e7b4-41d5-bc17-577ce80842df", "comment": "Malware payload (Adware.DigitalPulse)", "value": "779ca44c760089b597ae1abf2000bd89a0a53b17", "object_relation": "sha1", "Tag": [ { "name": "Adware.DigitalPulse", "colour": "#0E5916", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693648559, "uuid": "8fb03e08-fb8d-4c39-9c6d-10e1f9f582bf", "comment": "Malware payload (Adware.DigitalPulse)", "value": "74d92b29d054c850a6c846e2531216906b05a3320b9feee3a82231c63940a62dce8f91b85e89566627bc60bde593415a", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.DigitalPulse", "colour": "#0E5916", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693648559, "uuid": "2f78fe7b-4820-4ab4-8e8c-d43bf8ffa7fc", "value": "T1E1E5F13FF268A13ED5AA1B3245738320997B7A51A81A8C0F47FC384CCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693648559, "uuid": "687bc92e-2d9a-4343-8142-ca51f19e7f97", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693648559, "uuid": "dd0f4bd6-7bba-4571-8cdd-00b056afd0db", "value": "98304:ykLmoYWh8JAV/VH97F3tlQ+gt29s4C1eH9D:dDQJAZVdVQ+gt5o9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693648559, "uuid": "822a0b06-21f3-4c38-a714-ea94e3c01493", "value": 3261669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693648559, "uuid": "b68ff30e-c327-414f-b56c-6e239614b5d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693648559, "uuid": "b4043e06-eb9e-4d55-8b92-8aca3ea7e7e0", "value": "MassTube Plus 1700502 Portable.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d28632-49ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693677462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677462, "uuid": "5c8b9291-db41-425d-8154-8b56c3ed4ea5", "comment": "Malware payload (Mirai)", "value": "823d864f9536d90fbc5267bae110cabe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677462, "uuid": "5dae3e21-1018-4615-b1a1-424079a0bc0f", "comment": "Malware payload (Mirai)", "value": "7d50eb86720d65b223a4c61b17fb302ade62331c1dd648a02bb916074a2c5324", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677462, "uuid": "e4da1f8a-7874-4e8e-9520-b1152396b1cd", "comment": "Malware payload (Mirai)", "value": "428e6e6872f58d8928b5651e61a3ca7b54a7533b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677462, "uuid": "27bf90ae-93ca-4f72-b3bf-f294a7117fcf", "comment": "Malware payload (Mirai)", "value": "0f47af040a6fb326122b70ea3429073e3c823a5910898b68561fde5a68ed1f4bbba1ee3d88f67495a9c258bb773d8158", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693677462, "uuid": "cc553454-6512-42b1-a2f5-532a6063d597", "value": "T1E9B2D0E4CA909747C1B07871D27C4F916A3F59F0DAF724261610D7BDAA81CA632FC587", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693677462, "uuid": "19e9f089-31e5-4120-9ee6-cd18330fba77", "value": "768:y9KQFH0rs3zWoDDRsjt7LB9U+BJ33UQen7W:IK7rs3Kktsjt7I8Ne7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693677462, "uuid": "b0d606e8-16af-4a29-96dd-e46bd1849c17", "value": 24672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693677462, "uuid": "63b5389b-fdaa-4303-8dcb-20ebad8bb4ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693677462, "uuid": "0530ab81-210d-4ef7-8afc-99484e3b7d63", "value": "823d864f9536d90fbc5267bae110cabe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c8d92dd-495d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693637475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637475, "uuid": "f36e724b-abb7-4b55-93ce-7652819d18bd", "comment": "Malware payload (Mirai)", "value": "4b875f890c900f9bb8971b9e110a87c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637475, "uuid": "02dd036d-d0e1-45b2-a871-4953e162918b", "comment": "Malware payload (Mirai)", "value": "7e8249f6c9c9e6ce69f42dceed795b0057d68b89fd2b029b2f90e18c2aa37c8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637475, "uuid": "727481e8-bd67-4d04-b0b1-116b782792bd", "comment": "Malware payload (Mirai)", "value": "de24d23fa524d01473e18047ea24a10cf4028779", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637475, "uuid": "f2c19273-d45f-42e5-a694-ab9c07a6ecca", "comment": "Malware payload (Mirai)", "value": "a746192e4d3b1f398b748171702bc1ea404e7b6cd05785eba281fa8d3b6386b0c0cb002cae3a2c5d9a88b6623404b001", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693637475, "uuid": "fd8cb278-a2f7-49c1-918e-d53a69bcc2dd", "value": "T1A3535CD9B4119E7CF9CBEABE88224E0DF860221154930B27BAB7FD937D32195DC52D06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693637475, "uuid": "72a6270e-484b-4467-93b5-70c8b348e310", "value": "1536:j0klfwJ/mebn9ykMBR7l88g1pkPwtF5LR5kSF/zlgs178M:j29168xpZXlR5Vgyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693637475, "uuid": "9e3be50d-27c2-4dda-8807-2e1de30e31f4", "value": 65940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693637475, "uuid": "52375d19-a153-4174-a271-e1f17326c8fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693637475, "uuid": "91679767-32d9-434c-8136-7eb8a10f8cc7", "value": "4b875f890c900f9bb8971b9e110a87c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff29033-496a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693643279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693643279, "uuid": "8e94e7eb-1ccd-42d2-9fde-4857623400b2", "comment": "Malware payload (Mirai)", "value": "850b6967f86266143f1c17dd420cc1cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693643279, "uuid": "84d21f2d-b4aa-4096-bc99-b8418160aed9", "comment": "Malware payload (Mirai)", "value": "7eeffacf80434e2df3665bfe954a50b233f212a8db3e8dee86161f16c949e581", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693643279, "uuid": "887bf353-ce2f-44fc-bd56-3c5ce2fda191", "comment": "Malware payload (Mirai)", "value": "6c3daf46a89b78cf075d88b3b55d6c690351ae70", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693643279, "uuid": "ee115886-a900-495f-acab-cd7b5cfa9326", "comment": "Malware payload (Mirai)", "value": "b5ce95d76e060639f75ee23437b9130acdb070d7860b294a4e28d13277269a91a0ebea2bf1ea5c8b2294da600276bbf8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693643279, "uuid": "11a55e63-8e27-454f-8561-17e2f2f96003", "value": "T1C9536C02BB1C0953D2671FF03A3F27E1D36AA65021E9E6453A0EEE09C172E3255D7ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693643279, "uuid": "bb9095e0-1f73-48c2-87cc-39c2f40b61d9", "value": "768:O5iw8d8IycrwdjpjabdBr9Z3UQksF4kb0xLYnFa3tAlwPzq8+XPzjogiCIO:g8d86rwdjpjABZEaFnb05Yo3qwrza7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693643279, "uuid": "3562e476-e23f-4f90-9309-fb872dba3f61", "value": 63096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693643279, "uuid": "ebd73a97-9349-46bd-9f9a-78aa09b2a38f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693643279, "uuid": "ab9ffd14-1c2d-41b4-b4b0-cb84e12cad46", "value": "850b6967f86266143f1c17dd420cc1cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa6d6374-4974-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693647591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693647591, "uuid": "d701bd87-ecc9-4421-bfa6-d3e42500278b", "comment": "Malware payload", "value": "437894cd1b4c256e666411400db15a8c", "object_relation": "md5", "Tag": [ { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "pwhotelnew-blogspot-com", "colour": "#E68D7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693647591, "uuid": "788f0ca7-d2e2-4291-947f-3d0180668405", "comment": "Malware payload", "value": "7ef9bc0c51abc9a3b82f1a89c2bc5d1f6ba5bba63a7251fff041852019c3a2d9", "object_relation": "sha256", "Tag": [ { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "pwhotelnew-blogspot-com", "colour": "#E68D7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693647591, "uuid": "f7c90e1c-0d4a-4374-a1d7-e197be3ac2e9", "comment": "Malware payload", "value": "dc1da101e7814e74935f9c217d3bc1decf5a7da7", "object_relation": "sha1", "Tag": [ { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "pwhotelnew-blogspot-com", "colour": "#E68D7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693647591, "uuid": "058844c0-6f57-411e-bcff-e395c2509aae", "comment": "Malware payload", "value": "97091732db3dfadf644c491a522c42d791d4ed679183975b56e821fb5b9d68be79fe3b03917ff4b9520735ba230e47b4", "object_relation": "sha3-384", "Tag": [ { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "pwhotelnew-blogspot-com", "colour": "#E68D7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693647591, "uuid": "23b50a28-cca0-4ac6-a0de-4af71eef9228", "value": "T12653F671F7D7E389874B49AE96FD3C3B874468C001D09057983B8CD5A5AAF3289876BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693647591, "uuid": "4d3f1235-2128-4e5b-a76b-8ef21215cd65", "value": "768:6zfVsEuFTvFxctbf1ppppppppppppppplj:mdsTFTsF9ppppppppppppppplj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693647591, "uuid": "1a3836f3-a210-4070-9b4d-0683c028d20f", "value": 65710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693647591, "uuid": "6e0d1dcf-aa17-4dad-809f-8cba2173c724", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693647591, "uuid": "b689ad8f-c960-40d9-81a7-fe8f6d182c75", "value": "lnvoice_1882936796.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e984496-49cb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693684804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693684804, "uuid": "3959f8e6-7220-473c-a1ec-e3789f65c906", "comment": "Malware payload (Mirai)", "value": "f7d2a9ee2f46651e7e5cb2f2f39c11ba", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693684804, "uuid": "b5adc464-0664-45a1-8675-18ba206bd2c1", "comment": "Malware payload (Mirai)", "value": "8144e16552dc15a26563b88fd40f8a94c1882e8e7fd6594948adc2c07a39dc4c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693684804, "uuid": "56ef02e7-fbdd-4c82-8633-fa5ddf8dc29c", "comment": "Malware payload (Mirai)", "value": "a8800f8731ca603f7cf6b0e0fddf0e8470eb0917", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693684804, "uuid": "aeb0f6bb-603e-4a31-b088-457574c57770", "comment": "Malware payload (Mirai)", "value": "17f6d92669b88552ed4d61d388a53c3cd8cab9ee8cfe65d607d740965fc916e4a50a8727f488f4b8965e62cfeca4a093", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693684804, "uuid": "13a12e12-4c22-4089-94ae-98a6c63b5d53", "value": "T15AC32A46EA408B13C5D61777FAAF414A3322DB54D3DB330689285BF43F87A5E0E57A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693684804, "uuid": "dd5d770c-5071-4e8a-b75f-d44372734e98", "value": "3072:IZMu4C+u2dLhLRE90bYK5h9T96NOG+5/YtM/9gM/:eMu4C+u+RfbYK5hb6z+5/AM/9gM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693684804, "uuid": "26635bee-d133-4ef2-aba1-ea425370c383", "value": 128047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693684804, "uuid": "09326e68-7948-49ce-94d6-87da8d7f18d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693684804, "uuid": "a3f806db-eead-464d-8f83-91a2050ccfcc", "value": "Josho.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade08641-494f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693631706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693631706, "uuid": "fe5370c3-a59b-4a8b-99db-81056db6023e", "comment": "Malware payload (Amadey)", "value": "6dc87042689e8ee4fcf2ad4978251c44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693631706, "uuid": "3fe91b34-2dbc-4f25-a5d9-a2460f022ed5", "comment": "Malware payload (Amadey)", "value": "836253d5026a357aa7d50bb553c16481812b8462541c1ac16730c72af29508a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693631706, "uuid": "cbb84595-2b99-48fd-a2ac-6adf30d7e88d", "comment": "Malware payload (Amadey)", "value": "4bcd792c505c3bc867ecc7ab4bea97a390370dd7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693631706, "uuid": "b903ccac-f45b-4b68-af3f-c88eeb08f883", "comment": "Malware payload (Amadey)", "value": "fa0179f1e75568bca591f384fd66e80d44a45af6a4f1dc53c69b54ceac2c269a2237ed7bdd2d27d2e0edbf693aea09dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693631706, "uuid": "1cfb532f-ccea-40f6-a1d8-e26e1546417b", "value": "T10E256C3AEEF92D43D5259F700F84C8741FC2F237188BD21A9AE94931BED25B5B538942", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693631706, "uuid": "f8d57cea-d54b-4e2f-ab25-9dc5570c0101", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693631706, "uuid": "d83ae36e-b1d2-497a-8a5b-a17c07178307", "value": "24576:r6Q9aqCsrhw925qvq81iVh7gyR3cx0FVKwxp1:mL0a25FH7gyR9/Kwxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693631706, "uuid": "ee91285c-c7f8-4a76-a824-9993baeaf28f", "value": 1052160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693631706, "uuid": "95b5dc25-5f7b-4d24-88b7-aa34713ed4dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693631706, "uuid": "939fb01c-97fd-41ba-abfe-67c392c4bd09", "value": "6dc87042689e8ee4fcf2ad4978251c44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16783b6b-495d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693637465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637465, "uuid": "a4a6f382-29f1-44d1-83d8-76231bd57551", "comment": "Malware payload (Mirai)", "value": "00fa7f05728ea450523099586a1f9d14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637465, "uuid": "dbaf596c-00a2-47c8-9d48-1386f568f9fe", "comment": "Malware payload (Mirai)", "value": "84fad25cf3b67b1b7f1707b4e17fa4ac87b86b86905ce5e50e1e824d74e7bfdd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637465, "uuid": "29ae4050-af66-4420-9a31-090762ff66f5", "comment": "Malware payload (Mirai)", "value": "9a5c9b76ca4aea04a97d7d0cd2f5761e13d74af6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637465, "uuid": "d4891e64-e26c-48e6-9943-48eda4758cdd", "comment": "Malware payload (Mirai)", "value": "78f4c9a079e012bafff1868d28c51aba1aae7899fbbf9bf6b24054f559b825dd832f69f3e7f53c65e77068f554459a97", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693637465, "uuid": "14e28ca9-e776-4e1d-993d-f87c75f6a7a9", "value": "T10FC2F171D60ECDB3FFBAFEB48E81DCE13F86129E1892D8C1A0596B2506B243D5510AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693637465, "uuid": "138d272f-301f-4eb4-8dfb-5db60e0248a3", "value": "768:zuxqNa7PqLefxslATOTIAA6Q7dHGKKdPBKp0+Ow78R64uVcqgw094:dNLaxsl8X6+dDePQwc8s4u+qgw094", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693637465, "uuid": "8a301f59-f619-4e5b-8fde-e64bbc9e6e95", "value": 28280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693637465, "uuid": "a6881cec-5863-4938-9de4-18b505e9e8aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693637465, "uuid": "14fd0289-0ddf-4df9-83d4-3444d78ca5b1", "value": "00fa7f05728ea450523099586a1f9d14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e37893cc-499e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693665726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693665726, "uuid": "6078e03c-9aec-404f-aa92-cd901653819c", "comment": "Malware payload (Mirai)", "value": "6b8f3c8259fec1ffa4ffb24a132482d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693665726, "uuid": "87a042fe-383c-4290-8de5-7572db064991", "comment": "Malware payload (Mirai)", "value": "86cfcc6ad1121d89cf3881ee7df845d3b472e2f863de938e6b153b36b4555743", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693665726, "uuid": "5b015075-abf3-4245-b385-350ccf5c8cdc", "comment": "Malware payload (Mirai)", "value": "15cb56409268296c41bd6f266a06d24cf15ea535", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693665726, "uuid": "9022ad75-6496-495a-9eae-4abce9814f02", "comment": "Malware payload (Mirai)", "value": "06822d6cf305c0793fac6be71b4057b035a8b69d87cd409a2eab24c06ea0318fdaaacb8599adc21c6ac009d3133df626", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693665726, "uuid": "929f3e9e-dfc8-4970-b02f-07e036a1bd25", "value": "T19B430695B8829A16C6E422BBFB5E418C332523F8D1EF3203DD222F55778A81F0E77645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693665726, "uuid": "404b84f7-0833-4408-aef9-38117aedf61a", "value": "768:wuIJA/eudq6LCw86ysqnefmHyftfLoj2TgPhBPEnt5zsxpbNyBEFJ/2UaeGYh:6JtuysqefmSfdzTgPhxut5zLB4JujH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693665726, "uuid": "44aeb5fd-4120-4e12-b548-06a4d1d45728", "value": 55276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693665726, "uuid": "beb86814-4680-4517-9c10-7cc973a6597a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693665726, "uuid": "0c050391-b1ee-4691-bdb4-6ea8d7970554", "value": "6b8f3c8259fec1ffa4ffb24a132482d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b756d5-49a1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693666807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693666807, "uuid": "02ab8891-596b-4bfa-9386-feb445a54081", "comment": "Malware payload (Mirai)", "value": "e03e579ec2c173b74c53b9f768573494", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693666807, "uuid": "183be663-0a3f-407c-8038-74ba00d5f5bf", "comment": "Malware payload (Mirai)", "value": "87a8e71ec90266b67edb7e4cce70948f630b003b6bfa65291682827524f42a33", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693666807, "uuid": "004fe18f-7b95-40af-98fd-23f0db4dadc4", "comment": "Malware payload (Mirai)", "value": "4758de6662068b95e0238937cba80f66ddacda69", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693666807, "uuid": "7e1fa1d5-c57f-48a4-8388-b6554c6f5668", "comment": "Malware payload (Mirai)", "value": "08a2bbb2a0187d538ebc88e8a27b35bd31e0a4adb5749d9176b5eaeec6e0e144ade642186d2db4d88ecfb43153eedfe8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693666807, "uuid": "8231509c-efe5-4285-b655-00ab4fd1eaf6", "value": "T10D632A85FC919A13C6C111BBFB2F428D37270358E2EA7203AE25AF61378B95B0E37555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693666807, "uuid": "7e64bad2-3ab7-4e17-9584-2750a183ff7a", "value": "1536:Z0/pMUHZV7vOdq8AY6X7BlxqtCjbqWWTc6ZY2c+v2zuT:Z0/pvnvsuXdKtCKWj+26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693666807, "uuid": "d32391d7-ff43-4cba-97ef-7577f608a3e1", "value": 68864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693666807, "uuid": "355ada80-7f8e-464f-80db-d6aab3b29132", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693666807, "uuid": "c435f539-dc51-48e9-893c-218b2ad084ed", "value": "skid.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac3ab5c-49b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693674006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693674006, "uuid": "87c6d8e4-76ef-4276-b436-e146f133e741", "comment": "Malware payload (Mirai)", "value": "ec950dcf5945f463b85426f4beaeffa9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693674006, "uuid": "accb77f1-145c-48c2-a41e-65814db95c5e", "comment": "Malware payload (Mirai)", "value": "8b97bedc07fbe52ea5cfa99c4d612549411606b0a275011f47f53ed65ac392c8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693674006, "uuid": "a042dc1c-720f-43b9-a51c-a41d744485c9", "comment": "Malware payload (Mirai)", "value": "7ef32371e9af3852fcecee86a1fed419e2d61118", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693674006, "uuid": "5e20db7f-7d60-4949-842b-494dda1f5b77", "comment": "Malware payload (Mirai)", "value": "caa9cbfbadf75b37a2e9b7f926207ff0900aa9dea35c73253bc7bddaed9e8bf22268eb9901219ba5fe8dbf060a3462ae", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693674006, "uuid": "6d47ff77-5116-4c2d-9984-b25e6f9b7f77", "value": "T1CB33F2A267AD26F291F08777FC27E85592DC17A85DA730D63CF0A619B3C18024FF2646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693674006, "uuid": "c7bb1943-2c61-421c-9161-2fb853a0de30", "value": "1536:49O/ZMAXIxNUk0g8xfPqF1aBexo4opKZb6:49O/ZNKyMI3qFUFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693674006, "uuid": "5a4c0925-b4a8-47f0-9a54-ee74c1dd384d", "value": 52656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693674006, "uuid": "8095759b-771d-445b-bbc2-d1d6710764c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693674006, "uuid": "e5cd4b12-1269-4a32-9224-6b774b65a8ce", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f1e5d70-49e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693695005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693695005, "uuid": "39fb379b-6532-480a-aca2-a360daf38b18", "comment": "Malware payload (Mirai)", "value": "21c81221520162d8a62f54d5abe8e8e2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693695005, "uuid": "a3cf28e9-9e65-456c-ac16-8d92508e0d3c", "comment": "Malware payload (Mirai)", "value": "8d83638b4e25761bb19801ecf5d1927adb911a9c9cbbae04943cedb22305d253", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693695005, "uuid": "ec65d9b5-9f88-45f0-bbdd-29ad6abd4721", "comment": "Malware payload (Mirai)", "value": "196fd6b624b9e7b385871c67cc8a31456278d5c2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693695005, "uuid": "b353aebf-e200-4472-926a-459a9bee2f17", "comment": "Malware payload (Mirai)", "value": "1b8297957b0421e9182657b4d638ca62d3c3155a45545bdcda0d038b95b2d13ef4e79a28ed8e030132355e0b02d39daf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693695005, "uuid": "37efd527-f9bf-438b-8a75-b9fa31a42bea", "value": "T1A033F2E4E362AB13D2A155AB080A0DDE0E0A1BE861BE3415933D9A5C11DEC145BFDACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693695005, "uuid": "af4db887-3694-4865-8c01-aa3e4f762a1f", "value": "768:fPyuZr6HxkmEt3VY92uqUZlKOzzOTMoUH27J+nBbs9q3UELVVhRLRP5/Jqpect:Jq43VTU6OGg6+nd1LVVhRNRgpect", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693695005, "uuid": "d35123c0-b8a3-493d-b5f9-b66a42f71f41", "value": 53672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693695005, "uuid": "7021c168-d681-4b98-9385-8223aaa6c54d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693695005, "uuid": "7233d55a-1bcc-45ee-bf1d-4decd3119b83", "value": "akido.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93b7395-496a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693643294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693643294, "uuid": "a4456477-91f1-4ea8-9214-24f6c485d43a", "comment": "Malware payload (Mirai)", "value": "117e07ce9aa754ccf206f5933ba6ae2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693643294, "uuid": "774ce3ac-0670-498c-8b01-6f7b2f6f6b66", "comment": "Malware payload (Mirai)", "value": "8e7e295ebe5aee6f50a6efaa40189b38804cdcdaf04f965ff11714edea048f13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693643294, "uuid": "54ed9183-1b85-4eb0-8c1d-44220d62d30d", "comment": "Malware payload (Mirai)", "value": "2ededeceafb86d9008f986e0d15b58fd931a92fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693643294, "uuid": "50e43617-6c59-4681-9a40-a39191032141", "comment": "Malware payload (Mirai)", "value": "f4d622609bfb387465468e9aee95b3cc651efd3ac4871176232f479ea6b8be935ba73e429301d6b188e9bcfc31b637cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693643294, "uuid": "4b8b20d1-1043-4216-b383-e341d95a8c1b", "value": "T180634AD3F809DFB6F809D73B449305067230A3A54A821A77B353206BDD7A1A92977F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693643294, "uuid": "f4977733-3fb6-4cee-8586-ccca6942d776", "value": "1536:m7pDCdtR2nOXotu158ywBXpZXX6ymwHSwIryNGmcosyFetG:mMdtRX4tu1EBXjXT7l4mcosyFetG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693643294, "uuid": "978290c7-1407-4553-86c9-7d07b64b54dc", "value": 72568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693643294, "uuid": "dfdae114-4f7e-4003-b140-550274d848c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693643294, "uuid": "dd1c7a03-a90a-41c6-9c56-a605ca7ed1c1", "value": "117e07ce9aa754ccf206f5933ba6ae2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b99c4db-49b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693674007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693674007, "uuid": "fb444001-f743-4b8c-8ae8-64180a17e916", "comment": "Malware payload (Mirai)", "value": "0849b71aa1e8c627b89a3175d98311ed", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693674007, "uuid": "c2ee7a0f-d011-4e21-8c0e-6517ab2de7d1", "comment": "Malware payload (Mirai)", "value": "950c796b8be55deb86405a1fb63c8e490218d551be18dce5c3fbe7083e97060d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693674007, "uuid": "957bc70c-b043-492d-be54-0424d74930a8", "comment": "Malware payload (Mirai)", "value": "94ad2274eff4d1a971bd47b6af113d21f0173621", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693674007, "uuid": "3581202e-766e-4281-be07-ba24edb30dfd", "comment": "Malware payload (Mirai)", "value": "1d949bbc18590e3d0e63b9719eb7f8b26728c2bbd9b15c16e6c250a7e27d9da1c834796b45bb3202b402ae25b9f93519", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693674007, "uuid": "4bdc278e-6331-4a7c-9dc7-63e0fe2c0bd6", "value": "T14BC2D030A3AE1CB2C6500532F7B856CABB534FBDFAFD2890125057BA394194539EE9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693674007, "uuid": "098b45eb-bb0e-4816-8a50-09fcb1b3d9be", "value": "384:Ejt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNExPwV3hymdGUop5hh:ERsoTAZ3alkXLvFh8nNExP0s3Uozj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693674007, "uuid": "d86a7a77-6b52-459a-8e79-50d15b550971", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693674007, "uuid": "fd8b5610-5edb-43fa-8b11-32ffb0455f5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693674007, "uuid": "d24e1fa4-d1a5-4140-b6cb-fd7c30450bb8", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13690c78-4984-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693654210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654210, "uuid": "5963290e-4cfd-4666-8a7f-f8ea5e41dc5e", "comment": "Malware payload (Mirai)", "value": "a83a0e75d31f32d9fdcaf5368e28a323", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654210, "uuid": "cc9735ed-a61c-4997-b23b-06d8a18a19dd", "comment": "Malware payload (Mirai)", "value": "97a67b3ead46e96fdbbfa889f2b948742dd6786647359fcfc03121025092787c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654210, "uuid": "67c342cc-8bd4-4841-8ac6-66a01fe4ba6e", "comment": "Malware payload (Mirai)", "value": "22cf598c2065456fa7d3e58ccb6b797b70a7de83", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654210, "uuid": "75e75631-09c7-4f29-b0f5-1e32364a1f53", "comment": "Malware payload (Mirai)", "value": "39eb23de266f819e4d9e77f392337e85a31d00245e8bec2d7d122497667281dd908a052020eb9c0fc74a2f33aeba0e8f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693654210, "uuid": "878fd3ca-2ea1-402b-86ec-a62f55df889b", "value": "T13FA2D034E298BEA5EBEE4D649A93D1D337784EC77362C863A78F9F142405042B604E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693654210, "uuid": "9e50533d-8c6c-475a-8bc1-f0eb105334c5", "value": "384:L/JywWc84Tp2YshxqlDZbE73vzuSkEWoa6EM4uVcqgw05VxJ+:LRxsSVsMDZw7/BkE7t4uVcqgw09Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693654210, "uuid": "75938588-b893-4b77-ad9a-0018dd6a73b7", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693654210, "uuid": "2310ffe0-06c8-43f4-907c-f7d1cdeeaf52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693654210, "uuid": "e45e59cf-307a-4348-a7b0-871eb5c95f30", "value": "a83a0e75d31f32d9fdcaf5368e28a323", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a322809b-496a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693643284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693643284, "uuid": "80691b50-d82b-43a4-b981-2473b3f840f1", "comment": "Malware payload (Mirai)", "value": "2babdbb502e71e1d964f90664b0a095f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693643284, "uuid": "743e9e3d-0d20-4b42-b21e-b7934a6ebd7b", "comment": "Malware payload (Mirai)", "value": "99a5ede91486797d402b63da0094ccdf39aec274d577e6e6da038dbb9964606d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693643284, "uuid": "6dcde5e0-2559-400d-bd44-f0d8b15e5727", "comment": "Malware payload (Mirai)", "value": "969cbedbbd5a44783563e211d421e5e17d591c64", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693643284, "uuid": "9a3c4024-ab50-4566-a0ee-228a0a25b9e9", "comment": "Malware payload (Mirai)", "value": "1b9ed85baa0992718ea87a977d2952a4a811bd6dede60cf96f08a9f0ce3211e8b83aae69ee7da897603138077459be67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693643284, "uuid": "fdcbc775-b552-4012-a1d1-2c1cd439aec9", "value": "T127733A96F8809B12D6D1157AFF1E528E3313077CE3DE32129E24AB2477879A70E7B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693643284, "uuid": "de493879-7ee1-4f5d-8f37-ec1bb553d13b", "value": "1536:6InBLgdjV+aPOfQTMaYiL0t3lavG9dk5W2OHYn:fgdJ+aG0x0t3lavG8/oU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693643284, "uuid": "2d2010e6-b8aa-4c9a-8fc9-3ffd5cc3712b", "value": 75728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693643284, "uuid": "3d178525-e8b7-4cf4-b0cf-18537d3877c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693643284, "uuid": "fd98d648-3787-4ee2-9090-7e686feb7bd9", "value": "2babdbb502e71e1d964f90664b0a095f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fef42ee-49e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693695006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693695006, "uuid": "da90a6e5-d842-480c-908a-1616834e1faa", "comment": "Malware payload (Mirai)", "value": "22db07a52505cf9b98ca0d4baf63bed1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693695006, "uuid": "ecbd6d1f-9eb3-4cf6-a0e9-2ca484e730ac", "comment": "Malware payload (Mirai)", "value": "9ae151b570f9c49d21e96b81faec97802e57e1d3df883d9e197878f803654df1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693695006, "uuid": "8847fe8a-3d7f-4d6d-9d11-5349ece95489", "comment": "Malware payload (Mirai)", "value": "21c4d6a275c2141b01f3482ce51124288be68155", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693695006, "uuid": "6b4e2f44-6e8a-47f4-a0cf-179706771d2d", "comment": "Malware payload (Mirai)", "value": "87e23890e2edff64a5ae5b4486867a786f152512bebd3edb5f08f1511d01d4bf8ef2fefa9639796278f6f09e6ead0b88", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693695006, "uuid": "0c7967ef-1ce5-4e91-9c49-292fccc1d09d", "value": "T1B6D2E1691B448871DA90863A9C7C834623175665E2FD33621E50071DE3D72C8EEBFDFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693695006, "uuid": "d69ab9d9-4963-4059-b330-d1039be53285", "value": "768:FtFPMu43+Knj412MjX2YNoTdv0Wt4B1lkradLxs3Uoz3:FD0uwqxkTN0l+radLcz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693695006, "uuid": "83ce97a7-b74a-482e-9916-e02d529248e5", "value": 29968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693695006, "uuid": "662c767c-25ed-4894-a6a8-a1c03e94a685", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693695006, "uuid": "bd194bb5-9020-4572-9917-f9d925da5ced", "value": "akido.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c558b4a-497e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Havoc)", "timestamp": 1693651729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693651729, "uuid": "f902bccc-1a84-4125-82bf-22975a9a6220", "comment": "Malware payload (Havoc)", "value": "9829d77811e05bf6afe885bfdf1e1dd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693651729, "uuid": "858bfd5d-0567-4204-b2c6-836d6f538cfc", "comment": "Malware payload (Havoc)", "value": "9b6047883014e32c66300962e067762ee768a7a3f981ca51b1ce60ae7452421b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693651729, "uuid": "d57fa89f-69ea-426b-af8d-29a78f79a6a8", "comment": "Malware payload (Havoc)", "value": "0c3f410cdf87891c20e186188d3d953a72c54e4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693651729, "uuid": "c4c1db83-c018-4b5b-b4fb-a91983248246", "comment": "Malware payload (Havoc)", "value": "cd41cb7dac56ca5622ac47665766173c29f206b205041ffbe91c10a8df36cd8a46b527a5c69acc52385f871f11352aed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693651729, "uuid": "88e9f680-56f6-4d63-8ad2-d7e8589b534c", "value": "T15F946C07F68968FBC92A9135CB9F43367735F298136697072E24E6341E579E0BF0A306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693651729, "uuid": "526690d5-0962-4793-a4aa-285fca0d55e6", "value": "fce162c4451541c08ca2c0cebe4cc0e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693651729, "uuid": "ec5ba58b-5287-4e6e-ae7b-9296c1f45870", "value": "12288:WXA5fgIZYmQ+eqMTt+vbsUpK0g0xTOgBb:95oX+6sYgBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693651729, "uuid": "88c7d039-37d9-41de-9fef-7c61262c5170", "value": 434882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693651729, "uuid": "eb119600-0986-4031-b65c-268ab7b21b42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693651729, "uuid": "ed339394-c739-48e5-a244-4ae668db9526", "value": "default.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e1efa49-4997-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693662603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693662603, "uuid": "f72bffc3-bc56-4623-815b-865ca224c52c", "comment": "Malware payload (Mirai)", "value": "3b005680746d39acc809c319c4698296", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693662603, "uuid": "8bafafc7-168f-4f0d-b9be-16742d02c8c0", "comment": "Malware payload (Mirai)", "value": "9b683ebe3a969c7ef96600053af49b69cf3894958302f51e564e2d072dc17605", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693662603, "uuid": "b877a3e8-5624-48e5-b451-1738e612be92", "comment": "Malware payload (Mirai)", "value": "e7a421d32c78a7245117a6803c13a28c3e0eeff9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693662603, "uuid": "8cac3e91-c8fa-452a-bb45-d81b17947050", "comment": "Malware payload (Mirai)", "value": "e3ae9a2309bf269cd49b386753e847c8246de5664fc82b8c3c4410e3c60f42abe9881543dac8ae3aa66fbe591bcfd0ae", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693662603, "uuid": "6ca2aec2-8fac-4bca-8cc9-7f6626cc92eb", "value": "T1B8334AC0A947E9F8E845057420BBEB734BB2E57A010DEEC6E79CA532FC51A0596873DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693662603, "uuid": "56c7cc76-07d7-4d48-85f4-92ce604f1133", "value": "1536:gBdoORN/e8Tg23IGWRRz8BucNl+aIgj3BOCh/+:gBOqN/e8MJGWRR5cNUaI63EC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693662603, "uuid": "d4733190-260f-472a-b802-bdebc06bcb55", "value": 53980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693662603, "uuid": "32e3c53d-b55a-47f7-9eb4-c5ea18353943", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693662603, "uuid": "c5d58f24-49b1-43a0-9ae6-54ecc731873e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cdc9be8-49be-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693679110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693679110, "uuid": "9eb09663-707d-4e18-88a7-2e870f870c16", "comment": "Malware payload (DCRat)", "value": "0e616d15079b6edd29dca10efc82c6c4", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693679110, "uuid": "8d956299-b647-40af-94f7-372a09da8e40", "comment": "Malware payload (DCRat)", "value": "a1258516408f470a7219002951bb5f24bcf18016e9d3f8338e40e407a0934b3b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693679110, "uuid": "d1f18866-0427-4f5e-8c22-7bf7c7e3d02a", "comment": "Malware payload (DCRat)", "value": "b798b0b232c176c48484be3c30527f120da7fe9f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693679110, "uuid": "1991b0c2-6eac-49a6-98c3-8eb7f7fea0a9", "comment": "Malware payload (DCRat)", "value": "7ad3fad94b547f30a6e3c0c08059fc1ee9a326be1192fcd2057794b96495bf7b81c9c99ac5e805953f8146740da2b3d9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693679110, "uuid": "2626801d-3be8-4ce7-854f-76c7bf853c6f", "value": "T12EA58D017E548D11EC182233E2AB57DC47B5AC116AA5E31B79A932AE15F23D33C1DE8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693679110, "uuid": "46a4445d-23d6-4df1-8454-66d10207761a", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693679110, "uuid": "c5284f86-2c91-4ce0-a053-7e8ddf4531ef", "value": "24576:O2G/nvxW3We9q3PvCyn34VYjOFWAAuOfEEATtFHlSF4gqo6jRT8d38gWbpQ7LqqX:ObA3C3bIYesREHXlSLQdHdbamqbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693679110, "uuid": "ab4abd60-5954-44b9-a062-0af69c039f66", "value": 2223104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693679110, "uuid": "bcf8c83d-c40d-4f4f-aabd-83d592992775", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693679110, "uuid": "09728f7d-69be-4fd7-b458-9125da757f7d", "value": "0e616d15079b6edd29dca10efc82c6c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0dfccd5-499e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693665722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693665722, "uuid": "cd38eebb-9c99-4234-a06e-ad17a276d1d2", "comment": "Malware payload (Mirai)", "value": "dfad118222de06f196a3150268100db0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693665722, "uuid": "c8f68534-b350-4280-857d-7ca0bee66861", "comment": "Malware payload (Mirai)", "value": "a1cb5dd5c6fae773d5799347ad821f2ca571b8cea32b84bcdafa11f1981f29e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693665722, "uuid": "32e559fd-8bfb-42cf-99c1-6ae382feaf64", "comment": "Malware payload (Mirai)", "value": "859ad0224ffe3d9e91f36fe3e5a10de45bf792bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693665722, "uuid": "2e9438f3-b702-45df-bcff-712cb62b58de", "comment": "Malware payload (Mirai)", "value": "57f14aa3022b2ea17f4331fe223ce3ba707db4904414a4b3df4cb9365fba54e10ad0d8aa5fa901a55ea899d6ba474a3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693665722, "uuid": "5e230a90-31b7-4988-a01b-c2d4623e8e76", "value": "T14DC32A46FA818F03C4D5177ABAEF42453323A764E3DB730699189FB43F8665E0E63906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693665722, "uuid": "a5cd0036-047b-42d7-8187-200b50df22e3", "value": "3072:N4UJivKeNTwb6DkX9LmbbaCrm1eey6pdwCl3hM/9XtQ:yUJivVNTwOQRmXaCrm1ed6oClxM/9XtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693665722, "uuid": "f137d279-df12-44a9-8097-e1db77ed5d34", "value": 129012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693665722, "uuid": "3016cf9a-a36a-486a-bb3b-f6f843c8ece6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693665722, "uuid": "82cca495-3fcb-4f95-9a75-44a6ea9cd1b9", "value": "dfad118222de06f196a3150268100db0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "190bc55b-495d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693637469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637469, "uuid": "1bf8b142-fa1b-455d-b609-517a11e61e0e", "comment": "Malware payload (Mirai)", "value": "b89ecf6e57262d32f5757c073f25facb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637469, "uuid": "b5949f8b-0cff-4c99-9228-9f369a50a9e8", "comment": "Malware payload (Mirai)", "value": "a395b35fe09bb83ae8d0641b23dc14a31a7e5d3ba0261e0752da679fbcd0281b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637469, "uuid": "11281326-5ddd-4c9d-9821-5251f413155a", "comment": "Malware payload (Mirai)", "value": "1ff62486d8905f97cecfb28e8abc25b4117d1e60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637469, "uuid": "020e2981-dd5d-4531-9614-bb6f43f1fcef", "comment": "Malware payload (Mirai)", "value": "7884b6cccbb56869dc8733ca8fd1d4f7db92d93b6ff3f5c1a118784d5aae996c66d01577dfbf0d630b5445792b18a273", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693637469, "uuid": "4e3bfd9b-9419-4777-964a-0a7bf07977ea", "value": "T14EC2D121274F6435D2F14078C9A0C29565AA579CD2EEF3373C880F2CB95691E65F8ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693637469, "uuid": "fd98190f-5cb8-46de-8fc5-2d24ccb84b3b", "value": "384:qdD751FK5G+8qsM9poBAYYKN3gB6OzKRHMAyEZjvX4qw2HAqoLhhymdGUop5h5Nj:qh75KMu5z6sOj4q9Gs3Uoznd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693637469, "uuid": "4ee059a5-8468-45b2-9b78-4460552a919e", "value": 26296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693637469, "uuid": "925a45ee-7214-498d-b1a8-7c5eb96a7e51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693637469, "uuid": "febc835e-b3b0-442e-bb54-05b7d5a6de35", "value": "b89ecf6e57262d32f5757c073f25facb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fc204ae-4954-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693633803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693633803, "uuid": "8cf69e00-42e3-4d40-b428-f51b1f40383e", "comment": "Malware payload", "value": "6a3ac4f3f3bc1b131b11a4ef7659ae91", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693633803, "uuid": "37c2b29c-5eee-473f-b41f-bd6ca965f960", "comment": "Malware payload", "value": "a42d74aea16c6a983ba80b4a5d557a15f9945c83fe147450528c9f4680a42e58", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693633803, "uuid": "797cc695-e52a-48f5-a6a9-589a2032510d", "comment": "Malware payload", "value": "d72cc34818de8122689be09b757d54e22cc6aabf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693633803, "uuid": "f6082371-72ca-474d-900f-986306c27805", "comment": "Malware payload", "value": "9d0aaee6a78078dfe631373ef00d44856399167720d01008b7ff7dc452bc32f072b4c45abc90beee3054f3fca98b4850", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693633803, "uuid": "3d8ec932-8e10-48e5-8a06-46b9f304c4a0", "value": "T1CB136DC1ED83D9F8FC1206753173F7339B32F12A111DCA53C3999922ACD2A41A65B2AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693633803, "uuid": "fe83c072-8aa3-4e66-9012-05f7f6ee051d", "value": "768:Rw7bFy5MYY3kWVdpeD4tNneUm3USyhq3Jx11L71PuTpXA3p80cVgSNIO:Rw7bFyyYY3VVdBtfm33IqZd1PuRA3jXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693633803, "uuid": "ee21821c-5136-4bc9-b55b-30f7f2a4337c", "value": 42000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693633803, "uuid": "2628c979-a618-4863-90cd-04e60dc51c6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693633803, "uuid": "470d5002-4b0a-466d-bd87-adc0fc1ef9af", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b56b853-4972-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1693646707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693646707, "uuid": "09deeed6-7790-4d48-bf20-a59ad74275fb", "comment": "Malware payload (RemcosRAT)", "value": "98ccb619eb1a02f1a2e95cd0518cf5eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693646707, "uuid": "1a3c7acb-122e-406b-98eb-5fbda828b62d", "comment": "Malware payload (RemcosRAT)", "value": "a53d11281e99e8c8a4d0ff272ffd32a43e20e5717e484587788060c71795d9da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693646707, "uuid": "554bc141-2c68-42a4-9a11-46d7d7fe1f1a", "comment": "Malware payload (RemcosRAT)", "value": "5b361fb7c2219a8400ba08728472e7f9f4d9d415", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693646707, "uuid": "5e6d9c98-154d-4d24-94a4-a845bc3e8cb4", "comment": "Malware payload (RemcosRAT)", "value": "64004ebc4e9978d720eddbc852bd91d765ea44c67009e17c776ddd64d5883cce04afd454772111c415ffa55f19a7502a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693646707, "uuid": "6feaa5c1-b05b-45c7-910a-cb5403cf6375", "value": "T14EC4239A43CC0FB3DAA968F684F3199107D5C43A8907E75F949148739F27BCA8E129C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693646707, "uuid": "02078c77-469a-4353-90db-65dee32803b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693646707, "uuid": "eefb382c-c80c-42c1-b9a3-77bac1de46b4", "value": "12288:oGuhPRUEYFZ/G0T513A15yvB5unvEBqITV7xzloOd8WJK8ap7K0Y9fcv:xuhPeHFp33/vKveqITJxelp8ap7o9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693646707, "uuid": "7a0da8de-7b7d-4a48-ac87-4f2fc612b3f8", "value": 566784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693646707, "uuid": "50878e58-6b37-49bc-a097-17a7dd107ca7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693646707, "uuid": "d37f4191-87f6-4bc9-b38d-8e3609c041af", "value": "YUM DK-25 DEL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acde58d4-49c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693680237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693680237, "uuid": "a43e196a-773c-49dc-8f4c-d0dba02e51b6", "comment": "Malware payload (Mirai)", "value": "9181ff868f21320ddac61d78a2054b12", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693680237, "uuid": "8b187347-e724-432a-a21c-f2efdbabac62", "comment": "Malware payload (Mirai)", "value": "a68f2f3d799e638267d7959d461872b1d37f0fcfbcfd89dfad63cc32a597e1b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693680237, "uuid": "15ca79b8-d33e-45c2-886b-436726602f65", "comment": "Malware payload (Mirai)", "value": "06f0669c130b6bc2a266d52b80a8d1858253fc42", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693680237, "uuid": "0ae9ac9a-254e-407c-bbf9-8830b99ffb8f", "comment": "Malware payload (Mirai)", "value": "ed8a39033e7cf5aa31eec78e5846e825f7a2a75895f97438f121c9e530b87c1060d2c1bc0aadbfbbfa385eb9f950117f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693680237, "uuid": "1dc9d8fc-5907-4f95-bc83-83a73dbd0cc6", "value": "T1D7735D24A97D2E26C0D4A17B61FB8321F2F6230E25B0965D7C760F8FFF2464468562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693680237, "uuid": "1e65d0f6-40db-422c-b8ab-670a34e4a018", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8u:YwfdNu4cmZvFqI3w7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693680237, "uuid": "9f4535c8-05cf-424f-b414-fff7cbe88507", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693680237, "uuid": "bca1312c-0064-40cd-913f-dd3d55487326", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693680237, "uuid": "2cbf1992-b350-4fe7-9cfe-2845d813a551", "value": "9181ff868f21320ddac61d78a2054b12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f275432b-495c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693637404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637404, "uuid": "91ea56ab-f674-4665-8c8f-a4c1e937558a", "comment": "Malware payload (Mirai)", "value": "05b0cbf64b8f892473ba99f5681621a8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637404, "uuid": "47bf1672-6d44-4126-adf6-c018ff7029d1", "comment": "Malware payload (Mirai)", "value": "a6a488604f5dbf68c8c99bb88f505335666fb8b335ef57c461a64b26486af766", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637404, "uuid": "8b5a3fad-2f96-4cb6-aa68-ad1faa62f4b5", "comment": "Malware payload (Mirai)", "value": "e6932a08a82bff9a9fd8a0b67a5f1dfb32c2f71e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637404, "uuid": "9b4a73aa-fdd3-458c-9945-97bec111db6d", "comment": "Malware payload (Mirai)", "value": "ace38cf5ebd49ad3bca6d1870a7a04215289bcd93c79a40dddb0937e0878a6002057d28c08c7b150a6c5c1882bff22cb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693637404, "uuid": "9784951f-f172-4457-9d05-5534fa0ca4a9", "value": "T13933F122B2321FB2AC798877F5E541566AD8877C61CAE3738209C99C4563F4BF05E4D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693637404, "uuid": "000e820c-e9df-49a1-a7ea-e65180c3a8e0", "value": "1536:kOIlMtSFSIhqUXKpdhi41Hf/ZVXLv8WHa:kOmMoBlapbief/ZZLFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693637404, "uuid": "93b7d2ab-3b74-4dae-ab50-2ea6087b1012", "value": 53636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693637404, "uuid": "eafadc41-1767-48c5-b21d-e2664a8d52a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693637404, "uuid": "e7c718fd-182a-4385-ad13-f87597beb92e", "value": "z3hir.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a582f6fb-4931-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693618807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693618807, "uuid": "010593ff-2568-465d-88f4-69dbe287117f", "comment": "Malware payload (Amadey)", "value": "3f583abde299b2fcb96659040a6472d8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693618807, "uuid": "4388f37c-6e86-4560-9c2e-b5814d048c85", "comment": "Malware payload (Amadey)", "value": "acc4303fe203d0589c8e654aa174fd45f5250f5abff702e163c80dc4dac47889", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693618807, "uuid": "029da6dd-7c1d-4e7c-b366-832d528faefc", "comment": "Malware payload (Amadey)", "value": "7e10848229ff40592dba8c2c9c768a65a71c50fe", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693618807, "uuid": "f4f50118-288e-4a02-ae92-00f0d707b222", "comment": "Malware payload (Amadey)", "value": "d43bcad790fe06f91091d05aa23764641e2eda077de7273b8b1981005d75f7d0e2f32cfbc79ba4a2c74a58fe92b95ced", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693618807, "uuid": "7b5ad457-4491-43c5-9e4c-ef2fa53217ab", "value": "T186151212B2E54062DDB4177028FA07931E39FD956EB882671B895C2E48776DCE07B33B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693618807, "uuid": "56f6426e-4326-4b4d-85fe-6410017c2ee0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693618807, "uuid": "a7b7dba6-5e75-4fbf-945e-763866830c5b", "value": "24576:ZyDy36oGwbnC1b0kyxe3Mzf5U034kKa0Yleu:MOjGw7q0Te8DN4N6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693618807, "uuid": "b930e39f-5812-41c6-9f74-f2c0b483e6b0", "value": 953344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693618807, "uuid": "31386070-ce76-4f04-8eb2-31ee9369fa47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693618807, "uuid": "3d9b6e0c-21ef-4988-9be7-c7d7946122cb", "value": "3f583abde299b2fcb96659040a6472d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54556eaa-4965-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693641005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693641005, "uuid": "de53a375-fea6-4618-bd1e-7aeef69c470b", "comment": "Malware payload (Mirai)", "value": "ed95874d4814663e302988522581bd50", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693641005, "uuid": "c2df8074-60aa-4e19-9496-b691c9d9314d", "comment": "Malware payload (Mirai)", "value": "ae81b4c867a055279eb5e57d2ae2ebdeb373a03255a1c951b3689f3674378748", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693641005, "uuid": "be162441-497b-4860-b397-3519d23f4e90", "comment": "Malware payload (Mirai)", "value": "e584ca892c12d6a7c523fa6d255f03be9b51d76c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693641005, "uuid": "62a585b5-9f12-4a28-b0b3-b71e817098da", "comment": "Malware payload (Mirai)", "value": "3cbaabf1a671837a8fbb50ef8f2fda4ff9ff020aa0fb80f8b67153d09791775af70dd4665dc1794a04cd7861b2529bf6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693641005, "uuid": "21b23372-aba1-4f92-a264-d7d6ec1126ce", "value": "T1CA335A4AEB83D4B1FA5205702427AF12C332E625641FEADBD3D47C71DC62A15AB173AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693641005, "uuid": "55a2f9f6-8c71-41b4-8b0d-dbd579c5b67b", "value": "768:0gOJaFpDS2T/qDy3ZLpIchpt9nbQD32WI6laVO8DWZ1HTVMUuxm1u0eiIK:0rFJwLpFhVI32r6QVJ61HqUukHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693641005, "uuid": "4117c2d7-6f3c-42c3-a0c9-3011878b8fb5", "value": 54412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693641005, "uuid": "6ff846cb-2c5e-47e4-838e-17174001fcc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693641005, "uuid": "9d32e7e7-2eaf-4436-aaa4-0465f6e3df8e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e6e7b4-4949-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693629191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693629191, "uuid": "5dc4e3f0-178d-4998-a4bc-f1182a36c497", "comment": "Malware payload (Mirai)", "value": "67420e9fae93fd4827ca5c146ca37059", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693629191, "uuid": "1a094a53-7fcb-41da-8930-e2fb11ad10ba", "comment": "Malware payload (Mirai)", "value": "af4faadc16d0637684787f73d476ed221601a62d0bda69f3844f88a7d32ccd8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693629191, "uuid": "ed283ea5-4e3c-499a-a55c-60dac793056e", "comment": "Malware payload (Mirai)", "value": "9cd00e5de083c9753da9a1e5d1d75e60e33dd794", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693629191, "uuid": "67af1a9d-7ddd-442d-abeb-2e3294fa4b62", "comment": "Malware payload (Mirai)", "value": "1a34ffa55cf438c000ea0c5071a834a57b3a87e9be3baa301ab02acf21a3128688d799dbb8d4875ba879f97d73bae3f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693629191, "uuid": "5bb38af3-fec8-4b04-b88c-ed671e256606", "value": "T197635BC5E4019E3CF99BE6BE80170B08B924635456A30F2BD6AAFCD77CB305C9E56E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693629191, "uuid": "ea1ca3cf-092f-4a0f-80c3-47d7f2a30200", "value": "1536:KrsL/1rt4F6YseOPVMVoEa65xcfxK2+5gwQ89OK:LL/H0WH4RHY+5Hb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693629191, "uuid": "04d25e09-f562-4f84-8f0c-7cae016e22ec", "value": 69596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693629191, "uuid": "c2fd8993-8ad2-4315-803d-d123f5d9ea5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693629191, "uuid": "45b6d752-5984-414b-bb0e-0dd94845a5c9", "value": "67420e9fae93fd4827ca5c146ca37059", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "defe7220-497f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693652404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652404, "uuid": "4fcf8387-601a-4b77-923c-896211094a63", "comment": "Malware payload (Mirai)", "value": "9db33c62f277093b8c376b98b8f6280c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652404, "uuid": "c32c62b3-addb-4a76-8006-403ef9c2e586", "comment": "Malware payload (Mirai)", "value": "b0a226e951b03e8f221ab099c3c1c19687a9175f87faac50c14e433d5d1d258d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652404, "uuid": "6c8fc857-8080-47e5-9d2c-eb44b234e1d8", "comment": "Malware payload (Mirai)", "value": "c6796badb9b8b8da1b06343f4975221c8fbf8135", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652404, "uuid": "5f9d0f61-d844-4031-95f4-cf6de6244c85", "comment": "Malware payload (Mirai)", "value": "513f635e60725d7232a0acb3aa74ec9558fd0d66c5771d6135c5b488b3e45f0f580942bb3d403b074959f0d1295e4cde", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693652404, "uuid": "bc4f27b2-702a-41c0-ba7d-71576ef1c657", "value": "T1A023027098128DB096202DBDF789E3C3B0A5D977A387601357428B683FD89631F5A95F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693652404, "uuid": "81f0e02d-aeff-4f55-84e3-bd41908b54ac", "value": "768:a/TYCoIxdE65HMD2+FzbCTnQECfCBFuTl3W9q3UELbUXfi6nVMQHI4vcGpv5M:aECFFMDEQ8FuJ7LRQZ5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693652404, "uuid": "d4f18ebd-f801-4255-82cf-d12b3a2f306e", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693652404, "uuid": "d7c6f7e5-ca14-4828-bd87-2a435200ceec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693652404, "uuid": "97288ad6-4d1b-4523-8255-d27645c6781f", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae75ed6-493b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693623004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693623004, "uuid": "5f69574e-dc26-40cd-824b-76753c4634af", "comment": "Malware payload (Mirai)", "value": "95ba440960854e09b31a02879272d28f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693623004, "uuid": "cbde4199-ea46-43cd-87b0-73e86e4668bc", "comment": "Malware payload (Mirai)", "value": "b1962e993acde56bb78155db4a4427837c903e8edd8acb67c11ead5433308af5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693623004, "uuid": "55d770c3-b3c2-45d0-a20e-c0d5c04bec32", "comment": "Malware payload (Mirai)", "value": "ac7a5e78f0cd7b38a53012a152bad3124dcb8107", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693623004, "uuid": "b78e2348-5780-4ced-bba8-98ddabffbc72", "comment": "Malware payload (Mirai)", "value": "a0c45f535f094df64686f9258db817d834c92ae42a0780dccf832eb0e4e83aa6435cdc49aba1332be06266396486d1f8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693623004, "uuid": "9b9d5c53-9949-4a54-98da-42499b1f3e97", "value": "T114632851BC819A13C6D1127BFA6E028D3B2613E8E3DF73179D225F2037C696B0D27A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693623004, "uuid": "120f2d97-7e90-4569-a955-225935f40de6", "value": "1536:PNflxbmiiFiLHzhd/59xCz0BlhSGwifwX2vbW6:PNd/5vo0BlhSRQ3bj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693623004, "uuid": "eb1f4254-08a4-44d6-b9d0-8b9bf1f2ebbb", "value": 66916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693623004, "uuid": "f7b631e5-fa3f-4746-94e0-3618ab9e452f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693623004, "uuid": "6279806f-eef8-4d30-b3a4-ab319f555458", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd3f97b-497f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693652325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652325, "uuid": "2603fa5f-bf59-4ad9-bf38-29ae4af3e217", "comment": "Malware payload (Mirai)", "value": "a291d6d7d2147871632661e763eb9d58", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652325, "uuid": "06c89b34-7d4a-4584-a677-181d59c41280", "comment": "Malware payload (Mirai)", "value": "b2f7a109aa0ebd4e5d414d4813864eb990b82c7f4d28897ae613ade21ea87e71", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652325, "uuid": "1d53a812-2fef-4b63-91b7-704bc513d67e", "comment": "Malware payload (Mirai)", "value": "56201469c2450ddc7942f852340ae2e09aa17dd4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652325, "uuid": "f35f00b6-865a-40e5-bfba-8476ebe8e0db", "comment": "Malware payload (Mirai)", "value": "4a28f6fbb5fee0be60870f6fb3a345ce3bab0d58538e917c3f80acb7d1e8916b2db11989cea2db07a007c2079890176d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693652325, "uuid": "749aeff6-5ab2-4790-b54b-80e4cb9b86d9", "value": "T1C3630956F8814B22C5C6027AF92E118E332357FCE3DEB2229D206F2077C696B0E76D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693652325, "uuid": "3be05125-8e78-4ae1-a29e-c016b0cc5992", "value": "1536:dpnqh/sOR5YbAP+uppI46Eoq1aHg1zGI7ic8I2+lhCS5bYon/:a/9R5ME2MaG8I2+lhCSRBn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693652325, "uuid": "760cbe42-eb95-4ffd-a599-b5bee66de503", "value": 70964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693652325, "uuid": "3e962f63-3ca9-422a-a63e-fc5a7affa49a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693652325, "uuid": "e75e6399-ff9b-45e7-b951-b8829e9bd3da", "value": "m6.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8bb48ea-4974-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693647615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693647615, "uuid": "ae5c3302-0a31-4aff-9e5a-1e5382d6ef2e", "comment": "Malware payload", "value": "7f5cd31e60e89400164873e0ac60934b", "object_relation": "md5", "Tag": [ { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "pwhotelnew-blogspot-com", "colour": "#E68D7C", "exportable": true, "hide_tag": false }, { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693647615, "uuid": "9c4d4c3b-1aa8-461f-af9d-7d51b663311d", "comment": "Malware payload", "value": "b44edc3ab7be811d86ef88de2e768db2cb6dc76ed4ebfafcddc13cf8f21a8b78", "object_relation": "sha256", "Tag": [ { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "pwhotelnew-blogspot-com", "colour": "#E68D7C", "exportable": true, "hide_tag": false }, { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693647615, "uuid": "a24f0bab-0a23-4968-a57e-b72af909a092", "comment": "Malware payload", "value": "e12229ed541f57d9355f51cdf9bc29d448c00a8d", "object_relation": "sha1", "Tag": [ { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "pwhotelnew-blogspot-com", "colour": "#E68D7C", "exportable": true, "hide_tag": false }, { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693647615, "uuid": "45bcac56-8a60-4fe3-9228-f7d2ea016f32", "comment": "Malware payload", "value": "f547dc34a3d1f72ef9e1c641f4504ddbbd20e35cf3f8b2dbb90c48fdd688173f92d4a6a4aa814ef50e10c028d32d8197", "object_relation": "sha3-384", "Tag": [ { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "pwhotelnew-blogspot-com", "colour": "#E68D7C", "exportable": true, "hide_tag": false }, { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693647615, "uuid": "3efea17a-e27c-401a-a33c-3d26ae625df8", "value": "T1265600F6F6152AB2E28FC1750054BEAD83687CE3C9D2832CD73D65A00E2AFDD5D15886", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693647615, "uuid": "9e3c1790-081d-43cd-bbe1-d4a885c68c3a", "value": "384:00ungzmYiDY8Yu5S9xyYHOGmZL7d8Ew6jJT/3eMvRRCoFLLhB3cz9AxUUO5SiT8D:Wc+pU7YF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693647615, "uuid": "b3de2bec-2c43-4c68-8a0a-fea31786481f", "value": 6235339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693647615, "uuid": "26654f69-e9a8-4b5f-aced-14f283266f0b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693647615, "uuid": "7580fa64-9151-4d1c-b05e-3f9fa0cb7f3d", "value": "atom.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2980444d-49b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693674004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693674004, "uuid": "3d398745-fa18-4516-8faf-98ebeaa5708a", "comment": "Malware payload (Mirai)", "value": "95cb9b9949a2e27e8784214a1083247b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693674004, "uuid": "e7f74191-d643-4776-89e2-2086352339c9", "comment": "Malware payload (Mirai)", "value": "b5e8cc9e8a661d38267e4cd7d09faef8df92ce76d11a2d6917a34ddf7c21dc83", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693674004, "uuid": "68305406-2b39-4c63-a611-3efc84fee021", "comment": "Malware payload (Mirai)", "value": "5c557b61e0bbcd950920ac0258fd283505cd0842", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693674004, "uuid": "3cb27828-e92e-4fe9-9969-1a1d12a8e1aa", "comment": "Malware payload (Mirai)", "value": "f96b923bc3146ff36dbe3b78ab2c744db334c25fb6dc2fe67cd8af38c28dcc39eee647a1a99cbea21fe0b146d1245ffa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693674004, "uuid": "7171e84f-5b3c-49d5-b905-a4ba7e9e8d5f", "value": "T1D7C2E0F53E7B7E5BDF2A1038245A8D3292B4F122C75FB623D142460C21171ACBB754AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693674004, "uuid": "e99db91b-d562-4c46-a86a-54db6e5f40be", "value": "768:HMwKDZOFbBy6sSHRYfeAxdd8UcECTJphnzk9FNh:H2gTYfe6KpL9phzk9FD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693674004, "uuid": "fcaeaffa-26fb-4a5c-a047-af96e2376bfb", "value": 28272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693674004, "uuid": "5faec1c2-c7dd-4d21-a9d7-a11f7b3cc4d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693674004, "uuid": "5375a3dd-5b18-4ed9-87f5-957c1f43356c", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f385d561-495c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693637406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637406, "uuid": "d70cd36a-4bfb-49b7-ac8f-da445a455d6c", "comment": "Malware payload (Mirai)", "value": "652758d3d39e4513d9109e576f517036", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637406, "uuid": "e1f4e580-8749-4ad7-a2ca-7848d2f44730", "comment": "Malware payload (Mirai)", "value": "b663541fa2f469db6f94327ab3d8a32f22752e2291339fd14cf593cdb349cc54", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637406, "uuid": "69921677-88a6-4d4d-84c9-90206e136eda", "comment": "Malware payload (Mirai)", "value": "648b7f965d6b88a0f56aab9909c2a13336420273", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637406, "uuid": "8a7fffcd-7d4a-4a8e-be45-9f35969519ee", "comment": "Malware payload (Mirai)", "value": "f0a6973d3d0ef01664e7371c718dfb558675a4d78cd2cc7e0a2732812a619df10be5d24b40c722c48515cf18ad195a74", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693637406, "uuid": "4184ea47-7e3a-4f94-a75d-d913f0ae297b", "value": "T136D2E154A7A1E8B0DEB4533FFE7D8142225713BBF4D8F9A706548948B78C207E734686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693637406, "uuid": "f564202d-6761-4c55-ac8b-75cba397039f", "value": "768:TFoxdX+IoMKVUfzaP1urxIGyYUzpzAhDxZWs3UozQ:TF2+IoXVeNIlzpzABzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693637406, "uuid": "aadec766-987e-495a-b001-8f8ed2736393", "value": 29960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693637406, "uuid": "e3c821e1-bf64-46d2-9095-60513713befd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693637406, "uuid": "580c0ec8-7a5c-45f7-a203-d78128a555d3", "value": "z3hir.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf16e6b2-496c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693644217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693644217, "uuid": "77e17b88-748a-4cb2-b5b7-5bb0a31e0a91", "comment": "Malware payload", "value": "43ae6e53b55d464e1e8601c41e8ffcbe", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693644217, "uuid": "7f238cf0-e996-48b8-8517-42bb176f2dda", "comment": "Malware payload", "value": "b74bf1a2a0a29db4eb1ec9589d51ebab06bbd146f4478191e9396b6057a6c9c8", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693644217, "uuid": "b603cbe2-ce55-4d4a-8cc7-2f0ac70576ea", "comment": "Malware payload", "value": "0f8135a1255bee271ce6d5dc63c7809a74506994", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693644217, "uuid": "5be53345-888d-4e52-a344-75bdf980504d", "comment": "Malware payload", "value": "66fb1609554aa42bc034763e30ad409bd2cb27b4e9be6e2692042a1aa1319b52ff35200b0e3683b47191f73f74b29677", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693644217, "uuid": "b735f3b7-7df6-4d2d-8113-b509706a9b95", "value": "T13513F967CCAB0C1682314F1DA517A94AFB10C25FC2561543BE7C926C3F789A782E8B6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693644217, "uuid": "9c079e02-e5f3-427c-b3bd-9423e2d2f2a1", "value": "768:Q1DAWR1nXeihOCSlqLCxzAj6VppDPi7WR:Q1kWR1nhhFSQLhmVpoWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693644217, "uuid": "187d3ea9-2865-4f50-b732-61326453205a", "value": 43339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693644217, "uuid": "32388226-3167-4564-bc51-18926561a95e", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693644217, "uuid": "8edccbe4-c3c7-4d7c-9f34-b68d46a940e9", "value": "Creal.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f80d19-4974-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693647670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693647670, "uuid": "a4125094-43fe-4875-8285-e2ee8a2484f8", "comment": "Malware payload", "value": "a3c02d0e286799af5ef1f4f8d3e72add", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693647670, "uuid": "71c62715-e4e1-4f00-adf9-3a6b855cb31a", "comment": "Malware payload", "value": "b7fb8d4c959d866c429a2fd9e812fdd23e93496fe75d84df8f7824e04beb8a8e", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693647670, "uuid": "74ded1f7-8b11-4941-a9f3-37bb9e273013", "comment": "Malware payload", "value": "0953217b0d61d7658dbb4f9ef995efcdb09a6252", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693647670, "uuid": "6f0e9f73-d5a4-4218-a023-201af5cee807", "comment": "Malware payload", "value": "84cf3726798f5f1882aacfe7990e9b3d73b51affdf3d160665b629821fbc23fd9499e181872492285c01e6a30baf2f1c", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693647670, "uuid": "9e309037-8816-4b3c-a4ed-a804d4a0ea11", "value": "T1E8143B45AA408B13C4D727B9FB9F434533339B64D7E763069528AFB43F8679A4F22602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693647670, "uuid": "6d491997-606a-4e0e-8f2a-5811e578b212", "value": "6144:GoupIFcIhvHa9Sx5+3fv6Ao6GhHMwAM/RqRj/c:G9IhvHa9Sx5+3fCXL6w1/YjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693647670, "uuid": "47b7658b-3c8c-41eb-9a9d-a365fa51f426", "value": 199736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693647670, "uuid": "00420b2a-73e2-48fb-ab9b-b4026da74489", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693647670, "uuid": "00107ae3-d581-4db2-9f94-e7f1da456de6", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42adeced-497d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Havoc)", "timestamp": 1693651283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693651283, "uuid": "de1807ba-ae9b-431e-aee0-354e9b7cf437", "comment": "Malware payload (Havoc)", "value": "d492a5bd94df357a6a845c1615c9c757", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693651283, "uuid": "1c649e59-95c9-40a7-bb5f-2349492bf2cd", "comment": "Malware payload (Havoc)", "value": "b88a2d963a024a17dc36a3ecacc994188b7e8bd531ed82ea85c78a50901b1e8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693651283, "uuid": "3bc8ccad-00d5-4595-a031-a76d49066738", "comment": "Malware payload (Havoc)", "value": "088e87abe42b678f00b2e123eb1e30f14b0578a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693651283, "uuid": "af1b4f30-416f-4483-b681-3f2db2cc3d91", "comment": "Malware payload (Havoc)", "value": "e90b2ae31377b9c72698a7cf89bfdc9b585a49c9e4c81fe0430343eb84e3912a15fdebdbd2f4a6d2e5d3d9f8364cd878", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693651283, "uuid": "7682f02d-c5ff-4197-8be7-c43ad24d3452", "value": "T132946C03F68958FFC92A9135C79F43367735F2981366A7072E24E6342E579E0BE4A306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693651283, "uuid": "97e64378-4635-45b6-940a-751c69b8d67a", "value": "f16d056ef6a4c774d1e559849483d4c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693651283, "uuid": "daa7ff84-c258-4f02-97db-cb0c6d003f3a", "value": "6144:/6bAIdTHL4gOpD6spneqMTt+vbsUpckpiqELk8zSJ/EG54K3Tk6crt2BW:FId/4gOpD9eqMTt+vbsUpxv6P7ITOABW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693651283, "uuid": "aea4c9dc-5c78-4ded-8b95-3b79b89a16b1", "value": 437988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693651283, "uuid": "21cdf959-b7cf-4bbe-97ca-d5b4a7b3d0e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693651283, "uuid": "8ff51378-2bad-426c-8540-8460a5fe2c18", "value": "vm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "537e9967-4965-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693641003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693641003, "uuid": "31d22587-01fd-4ac1-a1b3-8fa6255b1a5a", "comment": "Malware payload (Mirai)", "value": "5f3099bce697289d67159f6fcf6a7e0d", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693641003, "uuid": "a9deb4b4-f1f9-4c94-91d9-5bf0c1815cc2", "comment": "Malware payload (Mirai)", "value": "b9eda552955cad506e63864da0e0425481c1e2847c2b1c436e64a45f0ccc9f2a", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693641003, "uuid": "a06756bf-0f2f-4e1f-aff4-86982937b81e", "comment": "Malware payload (Mirai)", "value": "55db3ef5e37971e46da130c6a6d27761eaa8a7d2", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693641003, "uuid": "8a45b933-2ef3-48e5-b3bc-90063dd99b37", "comment": "Malware payload (Mirai)", "value": "c98f27e7f374b7bffd4c4a7e934e86b7a01599966981b75ca883329fc2c6de016de5b7a9b876f46308abeae3a7557e88", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693641003, "uuid": "aabcde1e-706b-4273-8059-586ed5d6f239", "value": "T14BE32A56E7808B13C4D22B75B7DB824533239B64E3DB33099628BBF43F8279A4E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693641003, "uuid": "87987010-034d-409b-81f0-22301c11f914", "value": "3072:IsLB0aFWjAXuZycVlkuIhMPvPMM/9d7m3wMcN/mnn:nt0aFWjAeZVkuuMPvkM/9Jm3wMcZmnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693641003, "uuid": "3510fa40-14bc-45f7-af07-816ad7875de8", "value": 149300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693641003, "uuid": "3bd4afb3-b975-4dbc-823e-531d468f0c4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693641003, "uuid": "19031628-5239-4206-a1c4-a81d88426104", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1aa3a4f-497f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693652328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652328, "uuid": "16609136-866c-4e40-a080-c34796bc1a79", "comment": "Malware payload (Mirai)", "value": "229e6a2e92e2019e3d7767327e92bb59", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652328, "uuid": "06403d03-e7d1-4c8f-82ac-74f0ccc1a53e", "comment": "Malware payload (Mirai)", "value": "beee305ddd60c6f1715f9495b759e934464276ddc74ccec1250d150252a04d84", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652328, "uuid": "248d5cee-0c21-4aab-8f93-3f5a4e96b29a", "comment": "Malware payload (Mirai)", "value": "5011c44094c446e3aff9d5fa945c4a9d694de2ae", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652328, "uuid": "02e69243-9c1c-4356-83f5-f60f0a9c0f20", "comment": "Malware payload (Mirai)", "value": "9ae1721875d78991004c8c4dac323c76cd331bec98e2a722fc05a292cbe00d1daa11cc668d3bca0bdf75fea11eb39112", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693652328, "uuid": "46a5648e-e41d-4e90-b0a3-05064c5215b9", "value": "T112F2E851B8854727C1E41379B6AE5A8E377073EC92CBB62BD8224B207BC591F1D63F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693652328, "uuid": "c4db76e4-cb05-4886-927a-89a7e73168d1", "value": "768:VxwgXqSoG5M1ImBHGaBwO3iRtWV5za9ZSFHZ3RCTXpoc3tSwn:VRqZG5MRxGaeVKSU5B+Xjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693652328, "uuid": "24311c0a-6654-4865-a626-57257bc1c278", "value": 34864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693652328, "uuid": "c82e90ef-2f21-4320-9d1e-3d89d11a9204", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693652328, "uuid": "39ee11ce-53d4-4265-9688-23766965e5af", "value": "m5.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e588084-49ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693677448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677448, "uuid": "4bd35a47-8e57-4aaa-b04c-6e87885418f5", "comment": "Malware payload (Mirai)", "value": "eeab5a6d3ce417653d2c4d52d8a0172c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677448, "uuid": "48fdfa68-4666-4253-a664-2752725bda2f", "comment": "Malware payload (Mirai)", "value": "bf275dd9fe2459c74f8683379b56839876c5455c5a308c48582c53d0e3162363", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677448, "uuid": "b22407ff-af12-4f69-b658-ea1f31648dc4", "comment": "Malware payload (Mirai)", "value": "19efea730d3529e66bf13b85dff4b2e40450e87b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677448, "uuid": "0ee09db2-7719-4cf7-b3ff-e6d00d99eae1", "comment": "Malware payload (Mirai)", "value": "2f90f8451c15f51fd032a839528fee274855eba27fa7f738406e90bd436bc3e7b96cbc01f4f21bf74e5490cfa2284aa9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693677448, "uuid": "017bfe5c-d9a0-4bab-80ae-dc453e88e1c6", "value": "T1A4C2D040E105DE01D6DB39F51A489BEBFBD07B4B6AA6CEA0276053D2AE4C3678305DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693677448, "uuid": "ea049f9f-36de-4b9f-93f5-b355fe9f7097", "value": "768:GVdafO76jpmNJJKehmA7trpfIX9KeA7P9v4uVcqgw0t10tLyv:6am+AnKehPRa9aN4u+qgw0tYuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693677448, "uuid": "f86c6355-b973-45a8-8b43-e7dc11081e59", "value": 27544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693677448, "uuid": "6bd9c269-fd84-454d-b48e-e436efb5b57a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693677448, "uuid": "738cc709-aea8-484b-9ccd-4c01426a6eec", "value": "eeab5a6d3ce417653d2c4d52d8a0172c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f2d5cd-4976-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693648205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693648205, "uuid": "e0f37714-6f10-4ea7-a675-6f7a5fffccea", "comment": "Malware payload (Mirai)", "value": "c2306b3cd3a2dbeea33dd967f76f581f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693648205, "uuid": "2ebc3825-d5f2-46db-8fe1-218f822c9941", "comment": "Malware payload (Mirai)", "value": "bfb9673e38d8ba669a3e58de0a09de68c57f4a31c069ef14b1de4618c86a48fc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693648205, "uuid": "526de558-bbcf-4506-97d2-a9ca3ba5ee77", "comment": "Malware payload (Mirai)", "value": "c2f62e493f2eb00a67705b4814eba765154b0211", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693648205, "uuid": "961ede42-ea4d-4c4a-8a4c-f63d288e7882", "comment": "Malware payload (Mirai)", "value": "98eb922690b8a4c97ced016927d76edcaee0ce4d7e813980793263c499a7eaf929c24b99e8b0cf72d95fa70472f200ab", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693648205, "uuid": "5a9e0ef1-0f93-426b-94fd-dabe9da3339c", "value": "T1BD2329C4A983D9F5EC1911712077FB338A76E43A1069EAC7E399A923BC52E01D6473DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693648205, "uuid": "283bf741-3d44-42ea-a0ae-596f8a753d1d", "value": "1536:ER+IZAP9Ifc8LLYI2uV1Sqb2hh75MZ5x/Bk:ER/mP9IfzL32uVd2h95uz/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693648205, "uuid": "3b5eb358-dce2-4a28-a96e-6e3aba819683", "value": 50012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693648205, "uuid": "17bf5a8b-6605-4e76-8ff8-0346361561a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693648205, "uuid": "0a7fb510-1cc3-4c2e-9ba2-f0e6d1fd2656", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8419a2ba-49e8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693697349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693697349, "uuid": "7562febc-88e3-42bb-ad98-12d0abb5abc8", "comment": "Malware payload (Mirai)", "value": "6a0157a93818afe6a71d7311e419e114", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693697349, "uuid": "57125339-d665-49ad-bf5c-30a9eab22caf", "comment": "Malware payload (Mirai)", "value": "c0fbe556e81cd604808868a3c8b87cd9150c4b46d4cff021e61b44dd0c5d27c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693697349, "uuid": "6f75929a-200a-4056-9ed9-5d8c28e041d8", "comment": "Malware payload (Mirai)", "value": "611ae2fbcc0c676c59497ac6d99550e02f49537c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693697349, "uuid": "32ce87cb-28d3-4d20-a033-e052cb517f86", "comment": "Malware payload (Mirai)", "value": "e492329b0cccf562632ab7d58050835d9a539c2765eed20f4d5e3237c389f5702cc04abe52f31d05bebe5840c7a756c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693697349, "uuid": "77a8e5bf-7eb9-4c0d-b031-6d65a56e62a3", "value": "T1BA333BCA66022E2DE5D65CFD80734F0AD9542711A4A3172BB3ABFDC339332A4FE55909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693697349, "uuid": "e6eae5ea-5699-49f9-ae42-b8ebd4765065", "value": "1536:r8++P91trZyUr99C7ZQSD7cuMKg1pXSKNZ:re99KEuMTpCKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693697349, "uuid": "b1bd67c0-c0e9-4572-a8bf-9bc97ecbbbb0", "value": 53620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693697349, "uuid": "c5ae20d0-65d2-4d31-b04a-9151a6d1cc51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693697349, "uuid": "17a34b53-f07a-4645-a348-aa7f1e044b6b", "value": "6a0157a93818afe6a71d7311e419e114", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ee7bf9-497a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693650127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693650127, "uuid": "487d2e63-f9b4-4547-a37f-0ea7dba2741c", "comment": "Malware payload (Mirai)", "value": "79e9aad48a5f8c8aaca8e2d0e2514dcd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693650127, "uuid": "21442a44-a444-4bf5-801f-f6d338a64a17", "comment": "Malware payload (Mirai)", "value": "c2cbfa01e189c3ce7022869d8e33010987ce3b7b292b81ac67ffebcdbad73fbc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693650127, "uuid": "4be8b1e6-2dea-4fd1-b3cc-28ee4d838b89", "comment": "Malware payload (Mirai)", "value": "e5a96be1fcd47f78cd664847ccfb74d942b53baa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693650127, "uuid": "66f048d0-1fd7-4c41-81c9-12a946f5ebe8", "comment": "Malware payload (Mirai)", "value": "83c02a0e6a909e3016de8b6671bb34c4686689a6ac20126b2869b37e523fc6287a35f1a8d37433d6b7775c5069f07f67", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693650127, "uuid": "1359d85e-c25e-4d25-ac1b-973f58e85cf8", "value": "T1D6334AC4F643DAF9EC4705701177FB339A32F5E51229E743C3A99A32AC52602A906EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693650127, "uuid": "c38fc677-e833-4990-bf91-0b3d73fe2fbd", "value": "1536:GWa2d5sf1Gg+ya+nlQyF2zjHDffwVsp3MSfCYm:Gt2d5sf1GCammo2PjnMW3dCYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693650127, "uuid": "ab0c98cb-2cd6-4153-83fa-4c14f6c05815", "value": 50256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693650127, "uuid": "7cee767c-53b8-46a7-b880-53e8c4ab3352", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693650127, "uuid": "d9ea4c21-dc51-4ed9-ab24-d354d6b1e6b0", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e64a02-49c4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693681992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693681992, "uuid": "cad8c1c5-3469-44de-a0d1-37e3945d14ac", "comment": "Malware payload", "value": "d2204d06ef5e671818eff7e5f33bcaf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693681992, "uuid": "7b9fbb0c-5414-4d18-8c24-bfa90334fb08", "comment": "Malware payload", "value": "c37494daa1a9c3b20e3f19414e25907b598b45be7ae5486d144b28a98ade3aa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693681992, "uuid": "5457fedf-2930-4990-b5d0-a49df3841d92", "comment": "Malware payload", "value": "80eef1747c513e890d74a66efbc4422d1e254ca4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693681992, "uuid": "b7de4168-8c7e-44e4-a0a2-95be035aca34", "comment": "Malware payload", "value": "c018562ede78656936c8fe19a938b42508149a0dbb54ea0c25598c765edc1fa025effc3b5e4dab095429ed2ff51420e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693681992, "uuid": "c3bbccb8-1020-4f43-974a-2ff8ae0d5557", "value": "T1128633D9A2C10AF5E477C53EC2C28905CEB1752707B8CA8B07B4A2B51F1BAD48D7B752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693681992, "uuid": "aa7df86d-8f09-45f3-a539-ff3e5cbdca70", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693681992, "uuid": "8f1be7d1-5079-4ec2-b70d-f92e89ff0c0b", "value": "98304:1ezHqdVfB2R6yuT/9vUIdD9C+z3zO917vOTh+ezsNhCSpXq45S2zh/hQqDmlwvmX:1+QsMbT/9bvLz3S1bA32CSEeOqCZYPdu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693681992, "uuid": "16eedbad-121f-4150-8221-cf587f065362", "value": 8178186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693681992, "uuid": "1c28e0cf-5744-4637-ab3f-ac48e493c804", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693681992, "uuid": "a411f30a-8373-4165-823f-15024618fe61", "value": "efsui.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d0b215-497f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693652332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652332, "uuid": "bd7626c5-0796-4215-a7a1-a2846e6f36f0", "comment": "Malware payload (Mirai)", "value": "6ee0ecd7e185b87615e18b72de5ea781", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652332, "uuid": "81ff9b33-407a-4c97-8fd4-0eabb99d64b1", "comment": "Malware payload (Mirai)", "value": "c4fd2d4110a03bb3ef2cc101bebbccfdfac6cb2687a4a041193733966664f586", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652332, "uuid": "b4e62a4d-ec9e-4265-856f-d8daf04295de", "comment": "Malware payload (Mirai)", "value": "c4ea496dad0c8b36946ea699daca0fddb6e94142", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652332, "uuid": "30544f62-751e-426c-9d74-cd02c34e3241", "comment": "Malware payload (Mirai)", "value": "917fe7336d8312a68fb209b004561e46c7cf4b65032a688f7bfe0981d00c588b4ac8d001adf68cee1d09cdf45e0eba2e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693652332, "uuid": "bceac822-38ba-4d3e-8203-f2c19a005a45", "value": "T1DD73C61AFF620FF7DC6BCD3745A8170239CC554A12A47B3A7934D828B65B24B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693652332, "uuid": "f94f2a7d-d3c6-4e26-b9e4-275f618aab2c", "value": "768:K3sJmkqElhWHgJvd8p6E95Des4ReDB2wJ2iwgugBI2ZpMIXi5Ij7+eOcIoJhwnCS:KcJmk51+5B4RcBvC8W2ZpMe7+pcI3nC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693652332, "uuid": "f19b920b-1274-45b0-9b26-2fa143e08f7f", "value": 73796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693652332, "uuid": "30acebca-e7c6-4ca0-a345-e1c1a0079dee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693652332, "uuid": "cad39997-c9a5-48c9-a365-3261f92d17c1", "value": "sl.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c347c7-49d1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693687609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693687609, "uuid": "3053e9fb-786a-476a-bff8-67749ffa1a8c", "comment": "Malware payload (RedLineStealer)", "value": "05098633e1315f95fafe0a91c06729eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693687609, "uuid": "360ff93e-1278-4e2e-ad6e-b6d07388257f", "comment": "Malware payload (RedLineStealer)", "value": "c84178cc9e21c9f0068e1bad56350eff5bb0a48b4ab918b564413b3e792c3725", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693687609, "uuid": "89b31a4b-f1e4-4c6a-bcc0-e6eb57b67f02", "comment": "Malware payload (RedLineStealer)", "value": "631b8c09e9006162057cfb189968de423e077168", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693687609, "uuid": "171bdd11-67bb-430c-90be-ba34f8eed3cd", "comment": "Malware payload (RedLineStealer)", "value": "c774699d757dd665a9961a25c88b52779793cac9a1cfdc6897b5625dd0752becf90cfcbce31062b63843a3959b0a0e16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693687609, "uuid": "67f39832-808c-4ee2-85e3-01c7b63417c8", "value": "T152152306A3E89232CDF91F700CF202C71E36FCD489B597662769A94A0EB31E056B5777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693687609, "uuid": "53df62e8-7408-4226-98aa-8037c27caebc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693687609, "uuid": "62b2e1db-9747-4af5-9555-5e5e62dbcea8", "value": "24576:gylkKH/K3pllMW3bvNWm9A8zpBtDTLV6:n2KH/K55DNWm99zbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693687609, "uuid": "f3569bfd-f9d7-4718-97fa-8cb9ed9baa73", "value": 959488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693687609, "uuid": "d949b7b9-6fb9-4ad5-9d42-734393f1cf4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693687609, "uuid": "1b632a95-34a4-4dd2-95a0-bc1e0917d448", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fed111e-4997-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693662606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693662606, "uuid": "4299ab0a-e511-4843-b215-e14dfdb864df", "comment": "Malware payload (Mirai)", "value": "9a2a853a8c914f245f8d4606026ab800", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693662606, "uuid": "ff26926f-eeb7-4c3a-9291-621130f7d935", "comment": "Malware payload (Mirai)", "value": "c946f2bcc08bf26ea63d452209c7e9c84c686c01c6f4bb24e4bcc2bcd31518b6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693662606, "uuid": "56b064a2-69ed-46f9-b669-203739ea3d4c", "comment": "Malware payload (Mirai)", "value": "5d575d9ba759c4dbc9540c45b291d416eb1b68d6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693662606, "uuid": "94d7a52e-ab5a-4e2e-9782-d6220f169e50", "comment": "Malware payload (Mirai)", "value": "3216c0daad8ac70fd1a18bcd68afd500adfdc33ea34d28294c20b039762f6bcf328f05f7a0680feb4e4527e21a863141", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693662606, "uuid": "1b96108a-6b83-42a8-a8ed-96c36d1613e9", "value": "T10B431891BC929A1AC6E422BAFB5E418C335523ECD1DF7243CC252F51B78A81F0EB7641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693662606, "uuid": "5d334875-a85a-4735-ab6b-948beb890df3", "value": "1536:lGhu/fpcWFUKcjdYgPhxRt5FF4KXJv1wf:lGhu9uFP5bLxXJdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693662606, "uuid": "1623f60c-1cf0-477c-823b-b243020886f2", "value": 59272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693662606, "uuid": "d8b9b566-6d2e-4a96-b209-d8bd9ac30409", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693662606, "uuid": "ba284d40-9bee-4f69-8731-ec7886615b79", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "553396c3-4965-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693641006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693641006, "uuid": "6a70b850-0841-4044-a0d7-64956870592f", "comment": "Malware payload (Mirai)", "value": "66351f4b118a3367a4477d852d75ff06", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693641006, "uuid": "0a5578ab-4f0f-400b-9f33-afaae5b54ece", "comment": "Malware payload (Mirai)", "value": "c99226b07fcb156c2eabb931bb975ce948b1334f5c86877cb33a896fa5e8387d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693641006, "uuid": "175e635c-644b-4568-9409-3a9a8565d4e6", "comment": "Malware payload (Mirai)", "value": "0fe1717f3aae7d952013fb989e2367de26b449a3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693641006, "uuid": "30daee96-8e44-455a-bdec-70b5c0589d3e", "comment": "Malware payload (Mirai)", "value": "89e8a7e76b3a04bc7762dde387d7f9558c09312e00bd6cf78fe3c4f23f6707ed82ebc65f58bfdf5e7ee03549d41a4e2b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693641006, "uuid": "91ced5b5-700b-4e19-9385-75149db10a15", "value": "T1056318D6FC41DA12C6C11277FB9E82CD77270368E2EA32079B255B61378796B0E3B509", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693641006, "uuid": "daac4656-b808-444a-a3ba-a3901264d7cf", "value": "1536:PIyCy8PnOuKLzvvX+v1cV/GG69VXkOfuXvxj:fSG3/vvdG9VEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693641006, "uuid": "137f6546-2243-447c-b212-5fffbb327851", "value": 66940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693641006, "uuid": "a1a93760-7917-4329-a0b1-2723aec08685", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693641006, "uuid": "8fe9476a-e188-4e74-81c0-2c093e4be8d3", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae6a0a8b-4956-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693634713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693634713, "uuid": "52bf16a3-6912-47a4-83be-18d39ff0daeb", "comment": "Malware payload (Mirai)", "value": "f5c71ce0169ea29202f325066bed64b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693634713, "uuid": "d25c4dc7-3eda-43a0-a990-7ad0cc4338b2", "comment": "Malware payload (Mirai)", "value": "ca6308645f59257fdb2d32744c14f135c7948b2b1d1655e57e32626fb24e4ba1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693634713, "uuid": "7761e4ed-6139-4765-9468-bb565b629925", "comment": "Malware payload (Mirai)", "value": "3980db3e5b0f18aeadf7a38dd3e04d38fe8aea63", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693634713, "uuid": "5a3a9890-c86e-4e1a-bbee-b1b533e33c04", "comment": "Malware payload (Mirai)", "value": "18cad26164ab5b385ec5895f7d846bd79814a106b6ce2d973bdb6ab3130e2581e5f511b06db2739fdf6caf72b71ba7bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693634713, "uuid": "6863dafa-21ca-4837-923d-62d9ef1d4bdb", "value": "T109234B91B881AA13C5D0227BFB5E028D372563A8E1EF73179D266F113797D2B0E7B601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693634713, "uuid": "67db4397-90e4-4196-b458-a639691f6312", "value": "768:vwPLB/oQRPlUbulETFCmUSedL13vv6N1kFqdMIbq2jenv5/CG1oASIP:OB/ZlE51USI1HB9In6v5qGFS+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693634713, "uuid": "46caace5-2022-478d-8e56-0c19f4f8f6b6", "value": 48072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693634713, "uuid": "131473dc-6bce-48e1-8c8a-9f316b9c51bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693634713, "uuid": "deb12545-ea00-42a1-8d9b-d45496bd4e9c", "value": "f5c71ce0169ea29202f325066bed64b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec8bb5b-4974-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693647599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693647599, "uuid": "efc220b1-9073-409c-9f20-cbbaa246bdaa", "comment": "Malware payload (AgentTesla)", "value": "71a9a595e9dddf2c2b5243b46193359d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "pwhotelnew-blogspot-com", "colour": "#E68D7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693647599, "uuid": "399d29d8-0123-42f5-adcc-7d67431f45f0", "comment": "Malware payload (AgentTesla)", "value": "cb18fa28e7c8d704055cf16f7a8edd542d984821ce110c14110b41a78da45e8a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "pwhotelnew-blogspot-com", "colour": "#E68D7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693647599, "uuid": "7396722c-2123-409f-ade7-62bc6188c5c2", "comment": "Malware payload (AgentTesla)", "value": "38a0b70dea4ca5df128410016a12757db033f264", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "pwhotelnew-blogspot-com", "colour": "#E68D7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693647599, "uuid": "4f7e7485-b79f-414b-a40d-4e29b250664b", "comment": "Malware payload (AgentTesla)", "value": "9b39717ee8cbb74d3a37e441a4bf0bcaf04f4c30b3477e78c01f7776b4e363aa0e546ca9cb54108d3d04f3583b5bcd9a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "pwhotelnew-blogspot-com", "colour": "#E68D7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693647599, "uuid": "e06f0818-b1f1-480b-b88f-d75677ff3a40", "value": "T16534F48052A78F9B074F9402BD5CCA3D3DA246AAD0D3B247FA5BF4C92051746C5ECF4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693647599, "uuid": "e2384a62-5e5e-44b3-89dc-114e830296cf", "value": "24:XzATed2751RCPpqmyjuK1WIGpZkEsYcS20Q0NWfu53W0VR:X0B7vRCRyuKAhpZZdcS2MEQtVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693647599, "uuid": "0fe2a860-7ca4-4d7a-aadd-3ee4ea875875", "value": 251815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693647599, "uuid": "4c53dcbd-0095-4582-9ce6-34bf0153e4f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693647599, "uuid": "285a40a4-5d13-4b12-b461-412012defd13", "value": "lnvoice 1882936796.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbfe41bb-49a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CobaltStrike)", "timestamp": 1693670411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693670411, "uuid": "04cfa188-9323-499b-9414-518fdb0b8b75", "comment": "Malware payload (CobaltStrike)", "value": "018abb137564fa78ec9089a4ff22268b", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693670411, "uuid": "9c9e99d5-407e-46eb-ba8e-b9639e46327f", "comment": "Malware payload (CobaltStrike)", "value": "ccf758b328692428403abce7c1d6126eb546e6a42649fa8efff3c625a262534b", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693670411, "uuid": "441c942f-5ff1-48c5-ae20-92ee2873d240", "comment": "Malware payload (CobaltStrike)", "value": "5907a305de3edbe8f97bc1e1659476450385ca91", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693670411, "uuid": "279e94a4-7cc6-4bc1-b78b-17c005ef6178", "comment": "Malware payload (CobaltStrike)", "value": "00339e2522977c7bc0c72e38c691ba1c4d6d2c9354c3e00d9ffbd6114926b5ac9099b1e3e7f881e23cc2980b1d7c0dc5", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693670411, "uuid": "9332e231-31e7-451e-ac1f-7e0683337ae2", "value": "T1F7549D692C2557D8E6F32978E0120C5648ECF09CFFB53E3108ADA7197974FF8A15B628", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693670411, "uuid": "cd891db3-7400-4423-8ae1-f1b270fb5748", "value": "17b461a082950fc6332228572138b80c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693670411, "uuid": "fa95e962-11c5-4afa-a1bd-bc6bd77e006f", "value": "6144:CCap8sv6ZD1yTtGHoCCBL360q/61dypnSChLKs+:hhQDGJ/61QnVLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693670411, "uuid": "a33e768e-715b-414b-94c5-4cc422b40c57", "value": 288256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693670411, "uuid": "6a173717-b422-45da-9db3-f767df3a060d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693670411, "uuid": "76a40d03-8a5f-4354-b8db-59be3ed84865", "value": "018abb137564fa78ec9089a4ff22268b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac0ceab2-4956-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693634709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693634709, "uuid": "ac300e0e-ea73-4aeb-9b9f-77e129ac81d7", "comment": "Malware payload (Mirai)", "value": "82a142e55bbdbfa3d25c75dafa7220ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693634709, "uuid": "a7fe0941-8845-482e-a5cb-81b55f01f4aa", "comment": "Malware payload (Mirai)", "value": "cdae2f7bdf0b74d6d5258194724c2fd901f3c5ec7a8a280e06ec8628269c3f4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693634709, "uuid": "66d5f573-b96d-4d88-90d0-5f5093bf6cbd", "comment": "Malware payload (Mirai)", "value": "0517f002dc98451d78f67548677696f84af3109f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693634709, "uuid": "9f80061e-05f8-4ec2-88d2-808d28b1a1a5", "comment": "Malware payload (Mirai)", "value": "6607426a74fc1e605e24a2f4c01ed0e4746132ce234cd573a4261442b2769dcfdfa8608c22e1ccaa19c80b2d6405c9f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693634709, "uuid": "6b4864a7-4dfa-43f0-9f7e-c9ad1be302af", "value": "T1DB53B6566E218FFCFBA9823547B38A21675C339527E1C685E29CD6001F6074E642FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693634709, "uuid": "a8d167a3-be8e-4d6c-b119-f6429e2b43a1", "value": "768:P7l13W9jDjRVvgbxfzWPWf8oGCHMDLR+LSzvcZoMcwZEykA00e0h3FIIZ:73yjDvgdfzWPKHMDLR++cmA80e+FI6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693634709, "uuid": "59621df7-d786-411b-b0d3-e92a3862c6a7", "value": 60748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693634709, "uuid": "5981a4d8-5f60-4812-adb6-40e097d08d5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693634709, "uuid": "fdf34130-f5d2-441e-809f-b5f3b88a912d", "value": "82a142e55bbdbfa3d25c75dafa7220ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "182bc0e0-4984-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693654218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654218, "uuid": "fbaa1f31-ed6d-433d-b1f6-b73665c506f9", "comment": "Malware payload (Mirai)", "value": "bbe3616c1eda40654eeab1afab8b3b07", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654218, "uuid": "9c29aeb2-5ecf-4a04-95e8-8be77ff0d862", "comment": "Malware payload (Mirai)", "value": "d05701471aa2a90e65a0775886fba78774fd4d76f3b4d3a6ca784bfb27999910", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654218, "uuid": "b8d2772d-ca82-4d98-8071-aa4d6b33780e", "comment": "Malware payload (Mirai)", "value": "ae854be28aed72fb0dc6b924800425b10d5b4561", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693654218, "uuid": "19568be4-e97b-4381-a96f-54d38f11090f", "comment": "Malware payload (Mirai)", "value": "385fc26b8db2a324d38ce13d5a4eefce7af049d83ca28b6eee996e6bb37df81c7bcb658893c6e8599543cbe2c7a78559", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693654218, "uuid": "dddcb654-da9b-4bcd-93d5-d68ec8873aea", "value": "T1CBB2C0AD50D83049CEDCBCBE165E66A20D8DA1E0B5EF9F2D8360CD94237DA5FB1490B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693654218, "uuid": "ef9fa633-1768-4792-a885-e7d5ecdd622d", "value": "768:w6rQlS07dEv0UXqUhvQE+CXk8265lmq6x9rTZqEWvi:vQlS07FUXqIYSXk8265Unx9rFqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693654218, "uuid": "2058b738-9e3e-4084-a99b-4988eab67412", "value": 24920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693654218, "uuid": "64c4931e-ed02-4e8b-8ee9-66c085a56922", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693654218, "uuid": "afa0aa53-6b3a-4638-928a-606913d2bb5f", "value": "bbe3616c1eda40654eeab1afab8b3b07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "923c28cd-497a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693650128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693650128, "uuid": "fc164817-ed47-471a-b103-a06360331bf6", "comment": "Malware payload", "value": "6ec9b07d143afbc8a315d7adec599445", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693650128, "uuid": "edef5d3a-3c05-46ed-bc95-ec46d1d61e02", "comment": "Malware payload", "value": "d46bfb6bef3bdaac361cacbbc9afde10432f96bfc9ac1dac314bfc86d9b08ebd", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693650128, "uuid": "7a4bb8f0-2061-474a-8fc3-8a130bf7d1e6", "comment": "Malware payload", "value": "a7b10cbe4c36ce256d9537bcf681187fc2d105e0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693650128, "uuid": "358c6056-85ea-4baf-a298-6f7488554115", "comment": "Malware payload", "value": "4d14610dfd8cb2dc955b8649bb906e698f6cb92305d92e90b5ff3d3667d05c14383678827af57c4f26cc6d0abd80221c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693650128, "uuid": "5050fcba-26e8-4ece-ba4f-1381e8dd3538", "value": "T125972392E3ACFC19E1F796368B7146E23A560C504B63D7962D40B238DCB75C0CE49F9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693650128, "uuid": "c05bf86a-f7a8-4a2c-8412-d9df884e529d", "value": "786432:6AJUKz8ph9FWAZrFa/rRi74VsDENMFT/S2CbSAJ8lOXtdEkWNhAUI587rOw5jQXI:GI6hHWAvJ1DENOT/SvxCy2Mt58Xr5j0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693650128, "uuid": "00a71499-b369-4ccf-bfe5-9481c26e05d7", "value": 41816206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693650128, "uuid": "03ae0132-52c0-4086-b533-71e49bb66986", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693650128, "uuid": "8b52b3f8-0d44-4474-92ec-53f440e880d1", "value": "imToken.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a7dafe-4941-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693625676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693625676, "uuid": "f684b7d8-667b-4b81-8113-fc05f8277606", "comment": "Malware payload (Mirai)", "value": "15a1922abe65f612f3d3e0c7b4128c66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693625676, "uuid": "67d95891-a000-47eb-b775-21a9b2f3b39d", "comment": "Malware payload (Mirai)", "value": "d6ec3fa18b0b1175145d98a050038e37c6f3321b10e39b4c9746efb404974200", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693625676, "uuid": "2b016132-d84c-4d89-bef7-e27822f1f14f", "comment": "Malware payload (Mirai)", "value": "775c26c41718e90638cc90047d0e0879c0d0113b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693625676, "uuid": "902eadc3-7161-4b44-9f25-f009943b8cb5", "comment": "Malware payload (Mirai)", "value": "f474413fe7cf1ef753ea4e4a381ba4ca4aa088405e9cfaccab839a4ba13faa5266c69776a91084d635bac20f56eb963a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693625676, "uuid": "121f7284-a39a-465d-8dd0-bf39b71c1595", "value": "T11F6308927CC19A22C6E4237BFA6E41CD332563E8D2DF32479D212F5476CA82F0D67652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693625676, "uuid": "3c3e3a16-3357-4c53-b2d0-3131cfa7f85e", "value": "1536:haDrYTcXslqRq2hPectG7YHblaOO3bvFa/u5ahWPGX690p5vsFj53Huz:haNHh7ODAukh4f0p+jJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693625676, "uuid": "bad70932-03b3-49b0-a4df-004b92bc931c", "value": 72324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693625676, "uuid": "e6011ff0-6517-472d-b100-92fbb86dcfba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693625676, "uuid": "4d30a0ae-a823-48f8-bd8d-33ddf7f1b90c", "value": "15a1922abe65f612f3d3e0c7b4128c66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89dfaebf-49e8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693697358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693697358, "uuid": "45c3d505-3a11-481d-a6cb-d4b50b5228e4", "comment": "Malware payload (Mirai)", "value": "12b22e6ca4c0d4e11ee9a4b7c273701a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693697358, "uuid": "74cbe1a9-0109-4a4f-ab25-3872d3f60c3d", "comment": "Malware payload (Mirai)", "value": "d9bf222200b93c83c2de5e69f6140664380bc417d5876caa80fc314050bfee8c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693697358, "uuid": "86d0f6cc-ef54-497b-ba3d-605b7218de7e", "comment": "Malware payload (Mirai)", "value": "bb65ebbf1c6d1baee03c7e5360aca2f0ee755a11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693697358, "uuid": "8e50d6e2-44ab-4587-aaad-d273c17ccc99", "comment": "Malware payload (Mirai)", "value": "f4b33b78069b8c90128ca1f3eaf7a183472dae17ff2b3895b5bc8b01ffe700b8141c2fa87059fc59c8bd9e136438f941", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693697358, "uuid": "cac9d4f2-713a-4170-ae56-e9c8269cd0ed", "value": "T13BD2E052ED6319D2FBBFD9A13E64D9C0BFA79AED1FB89CD620E91B512008A564D00CC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693697358, "uuid": "68d6a897-c0bf-45ba-b005-c8ec1e1fc2ea", "value": "768:WRtVr1QC5J4H2TO1/kcDNotffW31hdhbThb91/24uVcqgw09I:W11QweWfWwf+315TV/24u+qgw09I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693697358, "uuid": "080b4fbc-a292-4677-a80f-fd635ac7e152", "value": 28328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693697358, "uuid": "7f041d24-8df4-4d06-825a-e2097bf79b45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693697358, "uuid": "59695e08-5eb2-4565-9962-8492d3487102", "value": "12b22e6ca4c0d4e11ee9a4b7c273701a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171c7219-4976-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693648203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693648203, "uuid": "70d8fd6a-03fd-4954-820d-775ae328c679", "comment": "Malware payload (Mirai)", "value": "3f62a1bdf5b296afe67d73f0aca07653", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693648203, "uuid": "b5400112-5ac1-4edd-ac84-e2db23abccfe", "comment": "Malware payload (Mirai)", "value": "da7589edd160f55463b61e26a2cd9db91ecbcb60c240d77a3636dad576289ff4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693648203, "uuid": "bc0afc3f-5d7b-4e01-b4bb-389da1c2f407", "comment": "Malware payload (Mirai)", "value": "d8661dcb5fad5b697bc8ef7ec174f80eec00ec8e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693648203, "uuid": "a57891f4-46e9-4a67-a1b3-99ec849fd610", "comment": "Malware payload (Mirai)", "value": "5db2f971ec3772871f107d115479800ef03d29bfa21e5b82d4f3f820d11337baa9f9eaccde7d1a31314ca2a45764bd68", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693648203, "uuid": "b199fb81-05b8-45e1-8ce9-9894fc861db7", "value": "T161C32B46FA818F03C0D51776BAAF424933239764E3EB730699189FB43F8669F4E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693648203, "uuid": "c5d47ee8-530b-4986-9adc-e814c483f682", "value": "3072:HOxGZhNycMr/e8ZTeC05Vve9lAeG+63Cy77RM/9y8pQ:uxGZPycOWHJ5Vve9lHGrCyfRM/9JQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693648203, "uuid": "a35590cb-7853-485a-bfee-51b8f2f360ae", "value": 129257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693648203, "uuid": "0181aa18-f3c2-47c7-8e99-72febfb0fe6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693648203, "uuid": "678106fb-2f80-4115-933b-86686d1b0dc2", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83cb41f9-49b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693677162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677162, "uuid": "8a76c6aa-f16b-4170-a958-496e40e321d6", "comment": "Malware payload (Mirai)", "value": "baaacebf474ba9ab277d79b4f9dcee96", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677162, "uuid": "ac4fa276-481e-4034-8946-13d5ba329f0e", "comment": "Malware payload (Mirai)", "value": "de86de2cb9515045d7e241efb7732e2aa2ed027f4fa355aa9438350aa23d4970", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677162, "uuid": "d033ffc6-ca28-46ed-86dc-12f75f511b8b", "comment": "Malware payload (Mirai)", "value": "1b68ee62c54e9b368e9e660ef8bfe9d6180e5fc7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677162, "uuid": "b7ab9f45-9587-4e21-9f88-c27e882c233d", "comment": "Malware payload (Mirai)", "value": "6fb5a07163f3f0c3444ecf7a68598dbaed2a099efb091c7cb74471dcb8904860b0293d3c78bcaa2d5c96651d3927ad98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693677162, "uuid": "026f8ad5-addf-4831-8c6c-423d09fe195c", "value": "T159D2E14876D3A3FB8DCAD5BE720F002730AE75A662A2A363F306D4474766141F685D4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693677162, "uuid": "e860eb89-4d91-4fe7-9926-3266c39d1838", "value": "768:blxKd294CxEnsU96IHE4RlY99H4GQnzk9i:+d29tnUFHEw0uNzk9i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693677162, "uuid": "6d923fdd-57aa-4754-b865-2b2e35c39624", "value": 29680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693677162, "uuid": "e0201055-db09-4c48-93a3-35ab21dbf581", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693677162, "uuid": "4ab6ddca-95e8-49cb-9d36-677f0b2d7cfc", "value": "baaacebf474ba9ab277d79b4f9dcee96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad7e8e6-4949-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693629204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693629204, "uuid": "260a489d-1926-4aab-922c-24496e0bd798", "comment": "Malware payload (Mirai)", "value": "db4f71448557ad00119a7c09fc56dafa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693629204, "uuid": "7f048b78-9417-4995-a67a-2699b076bb9f", "comment": "Malware payload (Mirai)", "value": "e02f5cef56c4bdd81798254325b453deb0ff1c81830696464fa503a683cf960d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693629204, "uuid": "80319af3-5258-4d90-bfbf-5090b882ea09", "comment": "Malware payload (Mirai)", "value": "72e4c9b2193988c8c9c11878bb6f1cca274eb71a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693629204, "uuid": "25c9db7c-0bed-45b1-8d1c-770bff55c3ba", "comment": "Malware payload (Mirai)", "value": "d5006de9f76652454c7beceb015921c9c5cf996baad71a9906455a3c9e6d35014667e52527369b822842dbd45042300a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693629204, "uuid": "66178482-78d9-4c8e-ad9d-d8b498fa40d8", "value": "T11193E90E3E258F7CFBA9C63947B78E259648378A3AE1C184D15CE6015EA034E741FF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693629204, "uuid": "0344d208-d766-4b33-a0b9-8f2108b927c8", "value": "1536:RL9Mec4pfn06GR87v1u0mn4hyplW/tUh8N8bFKG8awpkx:7Me/f0C7YTn48pytUh8N8bkG1Zx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693629204, "uuid": "c114add4-0fed-46e3-bfb0-d6a5f826d21b", "value": 89784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693629204, "uuid": "a4efc8c6-b41d-4afa-9a0b-2fe22258ac80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693629204, "uuid": "d1eaf7fd-4896-4a4b-a09d-37e1ba6e5848", "value": "db4f71448557ad00119a7c09fc56dafa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1ee989-49c4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693681904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693681904, "uuid": "e6ec0ee1-8799-4842-a176-16d5d98b7983", "comment": "Malware payload", "value": "65f31914db3f9014aa7fb4190f10ddc4", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693681904, "uuid": "1f5bcc64-16b8-4f8c-8eee-5a9dc6988a2a", "comment": "Malware payload", "value": "e3f6c77fb793b397f639d83841da0dd0221ac3b10e3b8a77e51388ffd9d5049a", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693681904, "uuid": "629a0b0e-4cda-4028-8b72-8bfd5ca76df3", "comment": "Malware payload", "value": "28919c49e49640736a6592b1bbd19b2c70bb3f16", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693681904, "uuid": "f3714247-fb5a-40bd-a243-6f6c06373370", "comment": "Malware payload", "value": "0c6ef59e0f1f2452d760ac1040288ca4807b46a85ca0ab11bfc1c473b0227bed7fdf7ba8da88369a497cf3f4471e4798", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693681904, "uuid": "ec7cff87-5163-46ca-9e94-34793674e2d8", "value": "T16D841292F6588CB1EB660671907F8E910D3ABE35CC15274E2FE9B25E18B3391248773D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693681904, "uuid": "910a305f-d545-4de0-b77e-de9dbda20f15", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693681904, "uuid": "f8eaf567-bcdf-4ba3-8612-3938a5b6a1a9", "value": "6144:g+ssXv5jUA2OpjesAOfoTb+v+90TveVBciZnbCUxP4C9tgf/AN1LtdReCBJJKKrZ:qOv5jKhsfoPA+yeVKUCUxP4C902bdRtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693681904, "uuid": "f25da19a-ae4a-4b8b-87ef-dccf70d7990f", "value": 379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693681904, "uuid": "21852f0e-8750-4f72-af17-38eb3d6cab63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693681904, "uuid": "fd9d1aa2-7d27-4737-a684-84f43533fd87", "value": "ghkhfflfll.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45d1d168-4942-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693625948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693625948, "uuid": "a5ac8d8b-710d-4942-8b7d-1b159acf6ca8", "comment": "Malware payload (Mirai)", "value": "9be5e93271ab71804197458e4994cba4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693625948, "uuid": "40fa1b0f-7d8d-4463-82db-94e67d3ad4f8", "comment": "Malware payload (Mirai)", "value": "e5c7b4731c58b39a2c4eda8c5ee9deb9eb164fbf665a95150fa4a849dde9fb53", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693625948, "uuid": "61e1cb29-31de-48e3-ac6d-30d4bb20c84a", "comment": "Malware payload (Mirai)", "value": "f1fdd4ef2c9d3b1b49969e01c3c3b6ae86acf7c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693625948, "uuid": "5f4915a2-4b5e-41ad-8e9c-1e05c4122859", "comment": "Malware payload (Mirai)", "value": "af52671a69f1d6b643d066f8ca457d512027565b56fd15450cec7bc09b37189a12b5313cdd528bff608abf21c520e754", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693625948, "uuid": "88028157-f754-487b-91a5-dbb13968c81d", "value": "T143533AC0A983DCF6DD1146B83177FF328636F436212AE9E7D7D9A923AC81E41910729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693625948, "uuid": "e8cc24c2-b5e8-4b55-9bdb-89146bd43c5f", "value": "1536:VMzVhePhrkmetvEuckIzN/hkfgiu5BsR8oUqpY8+7UoBiAdpTLEA:VMzVhePlkmetvBcxJhyu5BAQqpEJoAPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693625948, "uuid": "65ae6005-af65-4793-a085-66eb64245075", "value": 62224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693625948, "uuid": "1e78fd99-2b69-4b91-9718-f36799239913", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693625948, "uuid": "1081de6b-d2bb-4c59-a3d6-7a06e7d075f8", "value": "9be5e93271ab71804197458e4994cba4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "439450b9-49b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693675766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693675766, "uuid": "aaa2a9e6-00a5-4bb5-9fc7-406edc4a0dcf", "comment": "Malware payload", "value": "a3839f772c107f480924753ebcd88951", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeUpdates", "colour": "#0FE0FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693675766, "uuid": "2e876a7e-ecb1-48e1-bd0b-fe7066458bf6", "comment": "Malware payload", "value": "e6ca97018621d4cab0eca8eeda2a5df23b4b35ac544a6e39a19207b847874c59", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeUpdates", "colour": "#0FE0FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693675766, "uuid": "3131e0fb-e4e3-44b0-8573-0b2dceb8b7f0", "comment": "Malware payload", "value": "2841c50d107f25dcc162ba811c95d98c8107e6df", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeUpdates", "colour": "#0FE0FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693675766, "uuid": "3ecd05a3-1563-405e-a82d-185aa4c120b5", "comment": "Malware payload", "value": "40184565626a38af1d2604ad8da4a8c737c1c9a7f4888000e2a487b222602ecc8892379773f661111f09ac21383494e2", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeUpdates", "colour": "#0FE0FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693675766, "uuid": "f3ee3611-f459-42d0-a5d5-cbb48d47b930", "value": "T1B8A67C30EA44012BCE8313BBAD6646D3A93CD621131221DBF6DE175D1B674D8933AF6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693675766, "uuid": "19cf814b-ccb2-4e30-82d3-a5ee8fc722d4", "value": "21314122cd4542a6b9b297f52a87acbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693675766, "uuid": "8e9d5abb-4af0-48f2-a9e5-6f53932002a9", "value": "49152:VWtfl3xiDZjSPQaLOpU0dpBYYZFfsqWGXwuO6Bpp5eIMXYpnF4tk11zppI04zmHi:otfl0kYax0dMiNsqWGXwtyqIMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693675766, "uuid": "0cc17926-0f29-438b-b44e-8b8de8bd2852", "value": 9784472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693675766, "uuid": "c1c95cd3-9439-47ec-9f2a-acfbba6b6e22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693675766, "uuid": "d41aeb1c-8da8-47b5-b809-0b9617b18a37", "value": "\u0421hr\u043em\u0435S\u0435tu\u0440.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1291dba-497f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693652408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652408, "uuid": "d75f0165-444c-4c15-ab17-d475fbf14267", "comment": "Malware payload (Mirai)", "value": "dad279c3642d92e256db7a969e00d8da", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652408, "uuid": "83e99f38-e82c-4eea-810e-40baa6010e3d", "comment": "Malware payload (Mirai)", "value": "e9daf15be54c2d4258300cffdf55c628b06c23ecb0707429745ea58004167792", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652408, "uuid": "cb461416-3f89-42d4-82b4-11bbd8fed5f2", "comment": "Malware payload (Mirai)", "value": "79cbed8fe76437200055fa3abdd079877ccb78d3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652408, "uuid": "6cb81595-f8ed-4ed0-9bb1-b75c321f9e54", "comment": "Malware payload (Mirai)", "value": "1fcb9afd0fc72291a8586d5e4d0a6264aa11ec443b5d8da875edaca79d79bbabe1ca1dd2c9d65da32cec1c0812fb7cb3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693652408, "uuid": "0f248c28-fb53-4e64-a793-8cb55026d9fe", "value": "T18CA2E1A525B51A11E3F9BB3EC5A2C107731707ECC0B032B634101B23D69D60B3E69797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693652408, "uuid": "3661b5db-fa3c-4a86-bfe6-96a5c9f85810", "value": "384:vvtIoZxrSniaXs+qx+bwqPX5XpyUIEoGYJ53XYN1OhymdGUop5hA:vvQn4j+SNGAXU1Os3UozO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693652408, "uuid": "8515d2de-cde2-47d6-bcd0-e2b5aa559813", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693652408, "uuid": "de06ab84-4fbd-488d-8325-23608ce2c428", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693652408, "uuid": "58b2ee5e-cde0-4ed0-8d8c-2e336d541912", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9283252f-49d2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693687924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693687924, "uuid": "24117546-753c-4ab7-bfed-e47c5965a08d", "comment": "Malware payload", "value": "5ccc72c812f0481525f9843572a39ff0", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693687924, "uuid": "5b5e4405-9c7d-4359-8a6d-3402a3d63467", "comment": "Malware payload", "value": "ea03949e3413e44d6d05811945786d51f2709785c51bdd208cf98729735bf61e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693687924, "uuid": "12a65480-d2f8-4dc9-9b6b-38dbe13a3b11", "comment": "Malware payload", "value": "1dad753718c8eccbdbcf7e487d2cd3243d373036", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693687924, "uuid": "03049309-024d-4ac0-8ddd-2c6a6c2b552c", "comment": "Malware payload", "value": "ca2a098ccd50900117a4e83c27b7d1beef7a44f580ebd7fedf1b3dab4d6295b103ea1e24c4e48093656cdece09c5aadf", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693687924, "uuid": "079a9b51-b405-4088-a208-2855247a21af", "value": "T1D2951253F665A91BC8F2D3332179663250374D19DB03A78E784973BA24FBCE88B865C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693687924, "uuid": "d3e86203-f434-4499-b1c1-8cdd8bfb0168", "value": "49152:o+hx//c5m6rQJQ6y/93WkopaTsGkrWAu4C5Q49UU:pxXErNQQgTrHJ7CUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693687924, "uuid": "ddd3c63b-f4cf-4f99-acc7-a7447d333a2b", "value": 1987310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693687924, "uuid": "0e3b8766-4673-4a8b-b1a5-58933d3f4dd8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693687924, "uuid": "ad58d2f2-e347-4c20-8777-9cd44cf90b76", "value": "\u0639\u062f\u0627\u0644\u062a \u0647\u0645\u0631\u0627\u0647.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810cf50d-49b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693677157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677157, "uuid": "0b6db73a-a672-4583-8e2c-0b283dc5020d", "comment": "Malware payload (Mirai)", "value": "125ff9996789694b4a461763d8f4fe38", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677157, "uuid": "acaec907-c7ff-4f82-90b9-16facb67b700", "comment": "Malware payload (Mirai)", "value": "ec1d5c8a9115a26f5a94989343866eb716ea414e958fad4b2a3916737043b1d8", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677157, "uuid": "f8cf1a4e-04fc-4c31-bb82-7e0934f01ad3", "comment": "Malware payload (Mirai)", "value": "3c37d83641ca2e34d4cc62fe25ebd36575eca49e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693677157, "uuid": "7542b155-f95b-4689-92e1-4d30a4341446", "comment": "Malware payload (Mirai)", "value": "7bd39214acc6c6ed7eaef3fc7a4c49f0006bd64b3307aed93c2102e24905891d060444ccc505bc8eeadb4b1f1149ceaf", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693677157, "uuid": "b8ea358a-9e42-4026-be48-24127838ee7f", "value": "T1C5D2D0EFE597DEF8D51B453243291CE9B4B0FC0A70562B1785E411BFA4E2340BD26AD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693677157, "uuid": "982c66dd-301b-434a-8867-963caba1c684", "value": "768:8SwkRXvvUjt8HMzc9Wt3cTe1zEQFu9ZKLlJS634zrKGVz5LPY27PYC1cd:vvv44MzcUtMTTKeYlzoPKg1YC1cd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693677157, "uuid": "2accb789-fa21-430a-b36f-3ae57983be8a", "value": 30276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693677157, "uuid": "b547dc31-7701-456f-ab22-135289065f6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693677157, "uuid": "c46f46e5-1fd5-4167-a2d0-ae114076752f", "value": "125ff9996789694b4a461763d8f4fe38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd5d39e-496a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693643274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693643274, "uuid": "e96e3a2a-d974-45ab-b20b-0b7e1288dcef", "comment": "Malware payload (Mirai)", "value": "bb76ce79bf3c0b8190d50f981369eabb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693643274, "uuid": "acf6fc5d-4947-4f3c-be8e-c1102bc88b5b", "comment": "Malware payload (Mirai)", "value": "ec761c7df14ff09dfca2b41007fd98a6e3486a8cf8d6209c7e4ddd0824633a18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693643274, "uuid": "52fbe4af-b9d9-4f2e-8c98-54da8f64affb", "comment": "Malware payload (Mirai)", "value": "2511e6925fad472fadcde2e42a82e3f487a900ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693643274, "uuid": "8aa47668-9957-4c95-9584-9ac65718e350", "comment": "Malware payload (Mirai)", "value": "fe52673b5074f83d0407bfe4666b9ca5236ff83cca97a0ffe48c11b2b3f5726e64f3489d6d4d334c1ca16f03b69606f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693643274, "uuid": "175612c8-d8d8-4818-ba07-da43cc558435", "value": "T13B83D84EAF219FECF278C73107B70B21979873D623E29685E2ACD1145E7424E245FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693643274, "uuid": "b1f299f1-fe9b-4492-8cf4-a361d418c9d8", "value": "1536:fyaCCurNxCnIxDJ7O6eDfrPJ3jLwJqUFJ+6aYKedIO7EiVV:qaCHJ7O6eDfrPJ3jLwfFJ+6amIqNVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693643274, "uuid": "7c04c1b7-dd7e-4904-9ac8-d9cd36c6b56c", "value": 80864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693643274, "uuid": "14150f5d-123b-4248-8bad-ac342ad74126", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693643274, "uuid": "d56d38e4-edd1-4802-97fb-543a0cc7f6b4", "value": "bb76ce79bf3c0b8190d50f981369eabb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce77485b-49e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693697044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693697044, "uuid": "1b8c1264-3358-4b7e-a24f-08deb2030843", "comment": "Malware payload (Mirai)", "value": "2bf36349af4bce9d27a13aeb7b7bce5a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693697044, "uuid": "274f415a-0718-4291-b56c-a4f3553605ca", "comment": "Malware payload (Mirai)", "value": "f1ab6f4e603be170352c9b3a0f01a951825e33eda6d162fe2991e4232958cc99", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693697044, "uuid": "33dc3eb3-39c1-48de-a367-b9b87da631fd", "comment": "Malware payload (Mirai)", "value": "62301312308cf4a7c38cee3914c3b7dc669e6965", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693697044, "uuid": "5d29cf9d-35bc-44cf-befd-024d5e942dc4", "comment": "Malware payload (Mirai)", "value": "a38e1a596c89bf2083a92d731c90e103676ab3ceac71a9b374771438d6fd3717005bec86b529cfeac71d4e8ef3ac2973", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693697044, "uuid": "ecb53f2b-473c-4e3b-af8d-1109bf500997", "value": "T1DDC2D13441CD5E52CA32C63AA779D984BF550ABCA3B260A77E40A364E4C7857BF3205B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693697044, "uuid": "ca895c88-446f-4eff-abec-8ff5c0112a81", "value": "768:HRYtLOjiI0iTehHr6qiLGOXQJYu5RZ6Z4Gs3UozGk:Hat9wALKGlYu5RZDrzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693697044, "uuid": "6f1249df-41d2-435d-9a09-42e37ae19137", "value": 26328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693697044, "uuid": "dd673e66-6938-4abd-ac21-d96c9d3e4fbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693697044, "uuid": "b86243d2-bbce-4bbf-8f6c-fea53423f6db", "value": "2bf36349af4bce9d27a13aeb7b7bce5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b3f882-495d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693637490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637490, "uuid": "c92dc9a2-98cd-4c99-a9aa-58522d2f3086", "comment": "Malware payload (Mirai)", "value": "1411cfe0ec1ff7a6eb7e99e8c550e01e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637490, "uuid": "735e8ce1-5bd7-407c-8dc6-8b0797773d6a", "comment": "Malware payload (Mirai)", "value": "f2907b02252c31d175d6a59f6ca7477527b970a86b3e6f7b522d32fd32c1918f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637490, "uuid": "f381d244-bd16-496c-b6ba-79aa1a031f20", "comment": "Malware payload (Mirai)", "value": "5d22b432de05b032228f12f878afd4412e3cfc57", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637490, "uuid": "ab5e51de-30c7-4621-93fd-56ecf7a12aa9", "comment": "Malware payload (Mirai)", "value": "3ea348a29ccf52cbcfeffb73e196fd05394c4c54f3a1593d57d43bd7d904024046e47e8257d56cc999411a9d03c3b294", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693637490, "uuid": "145dd9c4-9979-4cd6-b82a-690b07ce4ca6", "value": "T1DC539DB5C4A8BD99CF699278B61488389723900564A33DFAE742C696D00BEECF10D7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693637490, "uuid": "33d0d867-15dc-4666-94a3-1186799c4943", "value": "1536:B/bivQhunGaiwt4gpuFosvXZxwaqUfs3rBktd1UYjC122:BjiBGhGp+XZxtf+d21UYjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693637490, "uuid": "7b730813-6238-468e-b2ba-a9d2bc76a5f1", "value": 64360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693637490, "uuid": "149f9027-015f-495b-85a2-954220398b72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693637490, "uuid": "35794eb4-752e-467c-98b0-eb7ea8e9f694", "value": "1411cfe0ec1ff7a6eb7e99e8c550e01e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be15a70-4948-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693628642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693628642, "uuid": "186a5946-b659-4a94-83d3-b2593e15c6e1", "comment": "Malware payload", "value": "ebd57653d474ebeb5c5df2c19df6912b", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693628642, "uuid": "7049276f-d53b-4ad3-81ad-8c1b390da6dc", "comment": "Malware payload", "value": "f4b17c300b847ffaee23c8391d8e9816f97e1cecf6ea453dafd3e57da73fd32a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693628642, "uuid": "ae5292c6-af0b-4b9f-8298-fc7c7f1cfbe1", "comment": "Malware payload", "value": "cfed222a1be8e01e921f2b912cd2aaf50599e602", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693628642, "uuid": "0000bf45-8c7a-4208-b526-9eb71fd4f473", "comment": "Malware payload", "value": "884940f0a93ae7032f9c28c92f436771740eb6f40101c51ce107034e40ee6242ecfe9ee578d374e3e1ba523906298e4b", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693628642, "uuid": "78487c6f-1323-4a06-b1b7-f8ac76958df6", "value": "T1E156333D0D91EDF6E5244C7535212A54E7B18A0AA6F4314FFB346D5BEF0B62B8832D22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693628642, "uuid": "78c6add6-f43c-4133-a8c7-1dd3eb5e8f5c", "value": "0130bd85ad1b4bdd4689797fdfbef9b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693628642, "uuid": "ad6d36c6-062a-4931-8569-0708e0d340eb", "value": "98304:3hzMQFcIKsJatIXw4KpLwrWA5dgedb7a2ZO3u0f9gedfjp6/dgWxVwnSM61n3:3hzrFcIKdQlCwrWNeF7JZO3ucgedfj0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693628642, "uuid": "5a0fe395-71ca-4f2b-8216-ca8acf02e8fd", "value": 6226268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693628642, "uuid": "f44a903b-78bb-4491-bc37-dde664f13c99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693628642, "uuid": "bccbc8cb-3f90-4698-9490-3e18c8fefd75", "value": "ebd57653d474ebeb5c5df2c19df6912b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba202a1-496a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693643298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693643298, "uuid": "e4f6e9e8-02db-40fa-bb3e-b389467a6f02", "comment": "Malware payload (Mirai)", "value": "be626e4c637032211467bb98a7b13a76", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693643298, "uuid": "0d358cda-6108-470b-9635-6e58910025bb", "comment": "Malware payload (Mirai)", "value": "f61e61ef8449c84ab27e62fa6096576561c9bd208f465e5b7aea0de6024aed0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693643298, "uuid": "eb73a7e6-1990-470e-8fe1-1f406145598b", "comment": "Malware payload (Mirai)", "value": "a05f028d9e87249a6b3318d99f4ba634cc622c38", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693643298, "uuid": "b633f300-8cbd-48cc-a311-c51c4c3c9dd2", "comment": "Malware payload (Mirai)", "value": "9cc4f3665ee12b21b0696b185236746f8318a791e0ce174a618866c5ab698e9195955c1b5d15a4008e187e663c101219", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693643298, "uuid": "ea587f83-faad-4c39-bdeb-6732f8c31d24", "value": "T1F3439E23C9215F18D299AAB0B075CE784B53AA5093A71F7B6065C23C9443DDCF52B3FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693643298, "uuid": "b89377b0-aa23-4820-9847-a99026c58518", "value": "768:4m/m8J+WWjegNiQruQSelZznKH8JIazola2x/fCfn010fx4bzOtvN/hYLOhII:tmCWjeOldlRKH8JTElF3CfB4yN/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693643298, "uuid": "17062440-1b4b-43ca-807e-abe41bc123cb", "value": 55232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693643298, "uuid": "63deced5-4b88-41a1-aed3-c6dbf55277ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693643298, "uuid": "1c966a47-44e8-4fca-bebf-98e710440b31", "value": "be626e4c637032211467bb98a7b13a76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d81a09-495d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693637484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637484, "uuid": "6b54c412-00ef-4ce8-bf9b-232cb1eb26a8", "comment": "Malware payload (Mirai)", "value": "7530a1a115917e45eb8f1ef3d2777e97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637484, "uuid": "d2b6d6ff-c86a-4da4-8cde-f5222bcc7734", "comment": "Malware payload (Mirai)", "value": "f73527ceda64649f8418ad553d88a2e6d05f164ff1974dce1bf2cc6d7c7d6b73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637484, "uuid": "f1b68744-eeab-4ec5-afe7-375ae963b2c6", "comment": "Malware payload (Mirai)", "value": "d69adaf98d871867f1e5650589918b37fc16af79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693637484, "uuid": "38eb17ad-cd5b-4c48-9d5e-ac0f5638221c", "comment": "Malware payload (Mirai)", "value": "79c0605fdd62b07f57b4a20fa9829a4c9dc68167f240cebd23cb84c7eaf97e0958e2ca27afe0da2473b0a0269fa9a038", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693637484, "uuid": "7a4eee06-0239-4b1a-bd41-8ee4ba9c8372", "value": "T1FAE2E18D65E83CAAEECE4C7D12DD0859ED8B64564309DFCA237204C0AF2E82DE59C47C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693637484, "uuid": "94f11ca8-65ad-4bf6-95c9-7e068aa99e83", "value": "384:A3fpCLrsjHIX69URc+hmnulY1qHprFKt6zNJpRwD9MH+DuviAuSa3FRWGVCz0NvN:4fpWcehzJFYKn7gMHR/xa3zWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693637484, "uuid": "2dc5f6cd-3a49-420b-88ed-4a1d37a5fbe3", "value": 31976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693637484, "uuid": "fc475c07-0b21-49ea-a62c-807638bb4348", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693637484, "uuid": "583691ef-083d-4fa7-907a-8e76107c34ac", "value": "7530a1a115917e45eb8f1ef3d2777e97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d7cb10-49a1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693666805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693666805, "uuid": "2ec8b0bf-7c37-4fd2-9f09-e581ca5940b2", "comment": "Malware payload (Mirai)", "value": "9fee2667826e56f78733bcf34e7a1fa0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693666805, "uuid": "57d6d65d-c829-43ad-a199-0e3b1f2ba112", "comment": "Malware payload (Mirai)", "value": "f993f67a2f2c9c535f4a369719f19ba398a2f6bc13cd39cbe10056695b724a4b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693666805, "uuid": "a1dd6ee4-b982-4f5e-9a7d-83f116f8e1ef", "comment": "Malware payload (Mirai)", "value": "a5cfa4f94704d99ee4c4402a23b5585133906b7f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693666805, "uuid": "164946fd-5563-4026-bf39-238588d6dfbf", "comment": "Malware payload (Mirai)", "value": "c2e7b2c6b466e5e911c6b278d5916a7bd32cc6ceb3a784c60471590b416e1317c4b2fb4673f1588b9fa7f0fd019aad23", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693666805, "uuid": "cf6bbf6a-2ac4-4419-aa50-5ad1241b20ab", "value": "T129436CC5EA8BD6F6E92306B9607B67338773D83D106AD783C368E432EC12411A21739D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693666805, "uuid": "e1837ab6-f54b-4aeb-8b1a-ee2a72ab40fa", "value": "1536:5++uB3aoHzXtqJRhoNIq1L+abF05+S+ud:sa4XtORqNIGKabS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693666805, "uuid": "665afbf5-a766-481b-aab2-e9321529c208", "value": 58516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693666805, "uuid": "83172dd3-b6b5-45d4-96a5-1a17df2824be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693666805, "uuid": "cf497ebf-5f9e-41c1-a49c-02a731cd0fab", "value": "skid.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a659a483-4956-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693634700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693634700, "uuid": "814fdfe0-721c-4737-819f-40dccd2ae8af", "comment": "Malware payload (Mirai)", "value": "456b15b739e99a214cce5cf351c07c7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693634700, "uuid": "8151eff0-7135-43d1-bae1-15f41be10421", "comment": "Malware payload (Mirai)", "value": "f9bfc275211105373bb8fc264c5aee2cd01d1c874b0ad98b9b281575881778a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693634700, "uuid": "e0adae2c-4981-46c8-81d9-a00429f4643c", "comment": "Malware payload (Mirai)", "value": "7310a7e95de8c43fd761d2a25cc5a756aa3ca8fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693634700, "uuid": "c3dda80e-602b-4d75-a9b6-45f92414d6fe", "comment": "Malware payload (Mirai)", "value": "d6923fd8ad6f1cd862b7a02ceae4356148c65203cb04caaeedb333b9a822a768ceb2feccd3cb61104d8545fd1f83ffae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693634700, "uuid": "04f797a9-c19a-492b-af60-20484e4779c7", "value": "T13AC33A56EB408B13C0D6277ABADB424533239B6493DB73065528BFF43F82B9A4E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693634700, "uuid": "251826b8-a8dc-4958-b5c5-ea955cab3bb7", "value": "3072:8dRtU9zai5NWEUo8Xkkoh4/PPz7caxVav7E:8dRAzai5NWEUFXmAPPz7caxV2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693634700, "uuid": "6dfb808c-1e39-4d09-93d2-a954a98e40f6", "value": 129042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693634700, "uuid": "4019455d-1d34-45ce-8413-ff5a8810cc31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693634700, "uuid": "48bfd87f-6f17-4350-8e7e-0b245618d6d8", "value": "456b15b739e99a214cce5cf351c07c7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a7042c-497f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693652335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652335, "uuid": "f5cf8fe0-99db-43c0-9890-019a87605465", "comment": "Malware payload (Mirai)", "value": "403f82a47ed81d92e7161ff7f9185185", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652335, "uuid": "99423eb7-e9f4-4c1c-9fd9-bc9e876945a6", "comment": "Malware payload (Mirai)", "value": "f9e5c09cafaeac61a7001deafac18c4fc6ff6f4e4c10f1d2e809faec6a5c3c6b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652335, "uuid": "4da510fa-ddf8-4b0f-bc8c-320ae0f0ba85", "comment": "Malware payload (Mirai)", "value": "f11fac9f05bbaa684c399805f841ccaa1534f140", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693652335, "uuid": "a322b212-b1bf-48ca-9b03-db569eb66662", "comment": "Malware payload (Mirai)", "value": "c806088fabbc48db836c064a2e36ce2c4d4e80cfcdacb53a96314d69ed71ecf1d7527bceedf3481dc23f4ba0c32f9adb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693652335, "uuid": "7e05e41a-7408-43b8-9bba-ac24bf5841f8", "value": "T18963B61A6E628FBDFB59833447B78E21AB5823D527D1D641E25CD6002F6034E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693652335, "uuid": "e239aa4e-f406-49f8-9d1c-6bdac5f2f78b", "value": "768:bPWek0n4CjdGQKKWgmg0EhFkFkeYA+QotFXyApGqFDjOZ2uyyQ5NeNTP4wneIZ:bj/hTmmjAotdym2Uu6eBPZneq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693652335, "uuid": "1d83ba92-1d71-4b35-a2c3-300fbdaf87db", "value": 72628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693652335, "uuid": "cb40f17b-584b-429a-82d2-dc431a708faf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693652335, "uuid": "23d04992-f053-44e0-b466-77861f224ff6", "value": "ps.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7bd1054-49b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693673410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693673410, "uuid": "948eed6a-b6fd-40b2-b875-24fe528e0b13", "comment": "Malware payload (DCRat)", "value": "03968dde73b9de527f04ed6f8e9fcfd4", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693673410, "uuid": "9e50d5a7-1aed-48c2-bbed-c9efeaf7c76f", "comment": "Malware payload (DCRat)", "value": "faec2b93cf10adcf3bbb20d8d2b6224dc8d2452fe8ae11f652ab39c3165aedb0", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693673410, "uuid": "9e43419f-7f7b-4702-afa2-5158578f5cbb", "comment": "Malware payload (DCRat)", "value": "ec0d785a9e1cd50f44b8b3e54569f8a46a0725b6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693673410, "uuid": "efca0af9-43b6-47a6-9c46-4800bc8a579e", "comment": "Malware payload (DCRat)", "value": "547688bbbcd16c1362acbd4af3e6494ff13995bf769331ce9ae7af42d31b1aba27079df17f72b900492595ddf209644f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693673410, "uuid": "862b5aa8-3737-49c8-b60e-9a059b1b3e2d", "value": "T1F34518017E44CA11E0192633C2AF85F447B4AC54EAA6E71B79B93F6F35363927D089CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693673410, "uuid": "8fc20a29-03b5-4d5b-8dfc-0dbd1a5cf1c4", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693673410, "uuid": "2b294743-3f80-43ab-b409-cb30f518ef34", "value": "24576:J2G/nvxW3WOdQYYc5eYZDZ8kTwALngtXmtWVmklfeFq6:JbA3VdRYc5eYZl5LnaXmU1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693673410, "uuid": "7d00713f-8d29-4394-9449-7265286c06ae", "value": 1243797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693673410, "uuid": "fd639e00-cbcc-425c-9793-348d96f43ee2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693673410, "uuid": "46ef2a30-ba89-4756-8874-f8085a53cd26", "value": "03968dde73b9de527f04ed6f8e9fcfd4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a34e717d-4956-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693634695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693634695, "uuid": "82acea61-29d2-4b17-9016-047f1dcfe1c4", "comment": "Malware payload (Mirai)", "value": "ddd085baf26cc6f6f1e48da49c60479d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693634695, "uuid": "efb5d1c8-5bdd-4d00-9946-23207c898baf", "comment": "Malware payload (Mirai)", "value": "faf5bea225cff07e4596cb482ace507d6e20a374152e4224bdd8265be2468bff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693634695, "uuid": "4a6419b8-b103-466e-ad48-b484f280149d", "comment": "Malware payload (Mirai)", "value": "281fd1da9ce130763e3c935ca3d9acc79313b815", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693634695, "uuid": "5d3b45d4-0b19-49fd-95e7-b8a283dcb286", "comment": "Malware payload (Mirai)", "value": "2c0a6ad1a09e73cb765eb22926fafb7af154727fa512ce5d8478d5de8c65a01f60bf95e8c0a8b8a7f816bebe0e38a3f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693634695, "uuid": "167b4d88-1530-46e9-94c0-4e42c3eccac6", "value": "T1DC53D605BF554FEBCC6FDE370AA9170134CD550A12A53B3A7974D82CB20B64B4AE3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693634695, "uuid": "29a76226-80a5-400f-b92b-0a4cb34e8bfb", "value": "768:DIOaX0AXnKssepXepeldeR9cerw+YYa2WAXiFcqx4jJEcW9+Ic:DIOI0FTkoYdK6YazPxWEcn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693634695, "uuid": "205d342d-fcdc-4516-927b-813a3f64dac9", "value": 63900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693634695, "uuid": "3172a49b-3e72-4cd5-a3ed-1638fdf316b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693634695, "uuid": "132861bc-e53a-4655-bad5-33c3bb176df3", "value": "ddd085baf26cc6f6f1e48da49c60479d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }