{ "Event": { "published": true, "date": "2026-02-06", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-02-06", "timestamp": 1770422582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "a6bf953e-6eff-4cb5-8581-b128322f3cc5", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da9274e-03b3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770420379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770420379, "uuid": "c5aab34e-b6b4-4515-a5ed-7d8d0da729c5", "comment": "Malware payload", "value": "920fbaca2fd29d2aa730ee76f5859dfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770420379, "uuid": "92654d82-b430-44e5-8206-47020b6b9506", "comment": "Malware payload", "value": "010d16ab9a593e94b7e4ab22cb34901f74372e36b58f8942577d37ddf42996d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770420379, "uuid": "58d58930-8351-415e-aa58-720056d2a192", "comment": "Malware payload", "value": "18caf4f1b93b0441d5546c1a6ae5e78c03f2005c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770420379, "uuid": "71fbd6f5-c0c4-4e43-86b1-b44f6beeae79", "comment": "Malware payload", "value": "9acf81d8f9f872cbf66d3da5269bc80e7347867810242e1ea6716ea91861bf5ab666aff0d6b6664521022963a85669a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770420379, "uuid": "bee89afa-18f0-421f-b344-ded7bd8ff386", "value": "T139A533A72284F3B8CDC8657D10067CC713E75A74D0ABE45A9041C72C5B3B8EAA37E95A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770420379, "uuid": "ec5211c8-a7a4-42d7-a45e-b5796642784e", "value": "388dc1cc36ef83cc05ae9d06320e5c56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770420379, "uuid": "adfb0cbf-e026-48e6-b07d-e16dbc09785b", "value": "49152:pOeSDmUEqCtxgJeEh+MeWZK9l7LT9QW58iL9u+KTtcru/QuBXbBx:pO1yUFC7dEchPl73R58g98pDYuBrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770420379, "uuid": "d7dd2077-3c55-44dc-a678-3ef264fb884a", "value": 2256384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770420379, "uuid": "15b2b2a3-838f-42af-922e-56b4ca32dd6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770420379, "uuid": "dfcf2b17-a6f3-408c-9e91-64d58787feb4", "value": "SecuriteInfo.com.Variant.Midie.175065.9195.12492", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65adfc3-0349-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770375108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375108, "uuid": "17e7b54c-7063-49b8-a454-f03b1b67a561", "comment": "Malware payload (Mirai)", "value": "9956c6cefd901eca357292a32729053c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375108, "uuid": "e808e99a-278b-4006-8b34-8874ba2bc38d", "comment": "Malware payload (Mirai)", "value": "03dc898fd9ba765f91513aa1048b9c6b2f3ff9dd571c55a0c58408fa933d6cf7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375108, "uuid": "25cfb136-a617-4f43-94bf-3bae9a8a9fea", "comment": "Malware payload (Mirai)", "value": "a0cc4a4d661ad3e957b7a27cbc20785ec4979dc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375108, "uuid": "da266ac6-021a-4b07-843a-c579b1b00a34", "comment": "Malware payload (Mirai)", "value": "5904523a958560e4d97fcafd9cd90e7b3db0c195afd51ed47682b795d3f95018e4705391a5f21220d539b40b55f96a24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375108, "uuid": "bce5a7ee-1a32-4a82-8ad2-159471829bf0", "value": "T159C35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375108, "uuid": "ed0d7116-4dcf-4807-9c01-8251ebfb2c90", "value": "3072:9Kw5uAyVilI9+ootMM56gtRLHS7wmricZM/9jgvpik:9Kw5uAyVilgBotMM56eRLykmriaM/9s3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770375108, "uuid": "bbeb4559-22b8-4567-b2f4-b88f144e52da", "value": 129948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770375108, "uuid": "77cccc1b-228e-4e95-8d24-e5002daa6927", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375108, "uuid": "011006b1-2f53-4caa-a158-4acb29fb80b8", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "045e8dc4-0315-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770352422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352422, "uuid": "9a0e78a8-13a1-4c79-afee-9fce07ee67b5", "comment": "Malware payload", "value": "b365674c69eb005a49843ed2640d0205", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352422, "uuid": "ed3ee38e-e456-4f41-9788-c1125a37ede5", "comment": "Malware payload", "value": "045f2238026f838203f937a4b8a60893320023bece2d5c1ebd0f25af67df00e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352422, "uuid": "d8a78d41-bd88-4fe1-8cef-dff9ae4a699f", "comment": "Malware payload", "value": "7e60b8a505a3f78a2e9e9015947382760d305525", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352422, "uuid": "de17a5de-cd77-43e8-9a68-13e4bd33988b", "comment": "Malware payload", "value": "6676475f90e607fd459a4083cb9d2ac76273e6bb420993da8dca7940e854c49452fa2bbda42049bc2c4717ad0a7eacda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770352422, "uuid": "89f77d97-7b03-4c8a-afcc-56b3a245fa79", "value": "T1E103289AF8029D7CF91BE77F84534908B5717752A0830B2A17A7FE937C721985D22E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770352422, "uuid": "f8985737-4c06-4b44-8a69-2c418c1dac89", "value": "768:FcsmpeZbI/SiKKUBLIJH65F2Iv+r6ueQ8Q8QUTO8zyvmDWl5mm:EaiKbc65F2Iv+rjeQ8Q8tO8zamD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770352422, "uuid": "96726908-11a3-4f68-bc0e-8e5f46413a7c", "value": 41068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770352422, "uuid": "5b9dd2e1-55d8-4c79-91e8-186e360d352c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770352422, "uuid": "4a322e51-ef32-4005-b7ee-54a3be78e992", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b250103c-0349-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770375048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375048, "uuid": "d64ad431-fc8e-415d-b734-61f2db543de2", "comment": "Malware payload (Mirai)", "value": "3c6253875d0f6d88f350230a76547745", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375048, "uuid": "771d16be-28ab-4f9d-861c-7b2f5bda3565", "comment": "Malware payload (Mirai)", "value": "06ffb716a0067e78b8b644dd80c76a28b7bf114e1ff0f4494291ec87892df89a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375048, "uuid": "812c7d28-e84d-43f1-8ff1-221a5dc002ab", "comment": "Malware payload (Mirai)", "value": "ed41fa3f2736ff6a9c77f471a60f43e470d6435e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375048, "uuid": "e03e16af-9c08-4b98-9381-6c4fe1320dde", "comment": "Malware payload (Mirai)", "value": "e897036954aac8efa334441a06c2e952909e5dd89725b40061b425ba398708cf5f09f0e2cb9ae30b0878e7de30cd130b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375048, "uuid": "3cf29582-480e-4141-a363-ac42e6eb67b4", "value": "T138431921B53A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11640A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375048, "uuid": "8bf119b5-3079-44c4-9e2d-d381a6f71ced", "value": "768:BqowmZPu9wtnfbltWgC6BSJsBcfDaTFIhQCiIiUfz6iZO+6BAwg:BqtmZPuutfbltZFBSJsBcfDaTFIJ5Mg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770375048, "uuid": "cea84d8f-4813-44bc-a218-1232ec10ab7c", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770375048, "uuid": "007acd24-6537-4944-8c6d-7a4c97b989b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375048, "uuid": "689b154c-7779-4294-9a7b-acc74b6cd29d", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c607a2dc-0363-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770386248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386248, "uuid": "3a60683e-7e74-41ab-8c0c-3af84471abfa", "comment": "Malware payload (Mirai)", "value": "b0b94b8d005a3937c632a35b40aea13e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386248, "uuid": "bd28e8e4-2195-488a-9185-37381e25088a", "comment": "Malware payload (Mirai)", "value": "0924efa1769009e593f0a8712133623241ca073d641eb9ec3b3720b1e7f601a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386248, "uuid": "e82f8854-cccb-4237-92cc-3b3d44003833", "comment": "Malware payload (Mirai)", "value": "7fe0b40f047d0a7f28caa54f146ceb8135c7460c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386248, "uuid": "e622e693-c1cc-42e9-96c2-979712f257fb", "comment": "Malware payload (Mirai)", "value": "3c3372c3f4372b347968da30910f575366dce85a56322fa81900ca700ac1b51fcffe4ac9ab6808914d7d79118fbc46bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386248, "uuid": "46e8f898-c60d-4fd9-b767-d4d2a0814a49", "value": "T18C148E68FE8E78D2D2C7E37DAD4A0FA230277D749565C0B11A00A29FD5EAFD489D0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386248, "uuid": "4475ec70-e84a-495b-9375-277032d8bf37", "value": "1536:OYtdyYq3BANtiz4UoUWHyeCFbjKEdAStt8YTpQURvqL4dqiofCsHNNjzPx+P7dV8:/yt4wz4UJP8EdAxYC4qfiofCeNRzPx/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386248, "uuid": "3d54ceed-82d1-4397-bf9f-d3b25327c200", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386248, "uuid": "2939b25c-564a-401d-b6c4-4425b2507c78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386248, "uuid": "595620ee-025d-4e9f-b0aa-3afdcb00ed72", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40960e71-0364-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770386454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386454, "uuid": "1f8d51bc-0148-48b7-8ae8-98856cff8d02", "comment": "Malware payload (Mirai)", "value": "0be155bd7196ae9a2d75c5652d9edba6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386454, "uuid": "de6b36ef-94f2-4f34-9ad5-66b6387273d6", "comment": "Malware payload (Mirai)", "value": "0971550c0a7fa3fa54a3aceee31d24c45697010a766273cf2857053b054482ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386454, "uuid": "310d89ea-b178-4781-af20-e8f6369ec692", "comment": "Malware payload (Mirai)", "value": "d4512653042df3aed4a2b00998810e31d8e1dc41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386454, "uuid": "5f5a650e-bf3e-4561-9b66-9837cdc5e075", "comment": "Malware payload (Mirai)", "value": "05a790d2c2decaae7586d0f21ee5ced017a3e9514b899c9fd742d912b5125f1d214ec4404dd3e4b000b9f8d921126d7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386454, "uuid": "2297e0e9-bb39-4e38-a52e-7414fc385bb2", "value": "T11BF33C47B7208FB1C368D67009B3CB67A6E6269216E19985E76DCD107A3075C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386454, "uuid": "8d80e4fd-1328-4dea-9b13-6ac24166ed37", "value": "3072:o3VJgzikZXyrNo/tqTHmnsHgCtEUQW0l/1wLxpvEcJz3nKfau:oFJMZBtqCnFCtE1R1WpvDET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386454, "uuid": "e4f9780c-1921-49b1-868b-ba5ca97f5ada", "value": 166944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386454, "uuid": "ebf42f0c-d6d5-45ad-8f41-40f6a9ac4709", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386454, "uuid": "09a5f351-ed80-4d5c-9a3a-834a14400d49", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23cc3de3-037a-11f1-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1770395854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770395854, "uuid": "ebab53ff-3d01-4abc-852b-77a1b0e86716", "comment": "Malware payload (CobaltStrike)", "value": "4553984db433d9de87bbc8a1a38f584d", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/CobaltStrike.CB!MTB", "colour": "#142B17", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770395854, "uuid": "7f9717cb-bf59-41b9-84d1-28ce51766f49", "comment": "Malware payload (CobaltStrike)", "value": "0b147b343a1e37a94d6e19b5400a5a4082dda5af715d475e8b03b02a5608de85", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/CobaltStrike.CB!MTB", "colour": "#142B17", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770395854, "uuid": "56609bb6-3776-4faa-ad02-f417e8b220cd", "comment": "Malware payload (CobaltStrike)", "value": "04c411dc3a3af741449d17673645349639564287", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/CobaltStrike.CB!MTB", "colour": "#142B17", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770395854, "uuid": "7b8b8d34-99e7-4922-ac41-7d5f1def6b67", "comment": "Malware payload (CobaltStrike)", "value": "d92f8fe8688a2226c6004a9ac262d850b6d2b697cd59d648df7b5c3b6e59f610fc39516badba241b2648af00b0972cde", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/CobaltStrike.CB!MTB", "colour": "#142B17", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770395854, "uuid": "1b0f557e-7ea1-4807-9386-4d093b5a7f93", "value": "T18272D53E3B1398EAC259D4B4C5F39F346D71FC034AE047390274EAB21F756625A2AB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770395854, "uuid": "0131d10d-d250-4a9a-aead-3e0c588d46c3", "value": "b9bd42227fd4867f722ab9dfc47cedc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770395854, "uuid": "6d81436c-1a42-4aab-9331-381fb17f5862", "value": "192:hMD9tEXopVhIRMpKMdAyfZywEKh9MHVp8tcD2ycYycAk8LET9:hG9NLhzpKMdDZIWMHotkaEABi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770395854, "uuid": "741bf91f-517e-4c2a-9bea-6d51a0daf096", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770395854, "uuid": "1cec4ebe-6de2-48bf-8e14-71850b74c670", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770395854, "uuid": "1c78e0b3-116b-4b70-b3b4-534ede929286", "value": "artifact_x64_440166.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f026d1d-0364-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770386370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386370, "uuid": "d03c1117-48d2-4022-8c26-dd924fef3d36", "comment": "Malware payload (Gafgyt)", "value": "5b4534872d9a9706eee855dd0ad3b504", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386370, "uuid": "4fa8046a-ddae-4131-878f-1b7835c677ab", "comment": "Malware payload (Gafgyt)", "value": "0bbba545ef1e456b0b4c91905a51275d05ef34a3cbe1607208ab26acb7551103", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386370, "uuid": "2aa6cee1-aeaa-40d9-b843-2e26fc166951", "comment": "Malware payload (Gafgyt)", "value": "1d814c52a059503aebb26cd34a06c99866969201", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386370, "uuid": "0fd32a6e-48a3-45a6-b792-8165f82fce14", "comment": "Malware payload (Gafgyt)", "value": "7b43b4b780819162f0460cd9a171fe85432105ad46180c95fc09222e0883d6078bf325638cdb8ad09d63245ae231685d", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386370, "uuid": "357a981f-c912-465a-8bd0-f9434d00e00b", "value": "T1AB3106EBD4914D7EBFA4A91731A5480430E0D89A58EFDF77E8DC38D5418DE4CA4C1A93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386370, "uuid": "cf1af30d-540a-4335-93f1-6a183555dca2", "value": "48:vxNLDxxwHKhdJld3Nn5d3wsysRswsswI32d:vxlDxxwHKhrl9Nn59w1ofBwI32d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386370, "uuid": "4e7fc2fa-5a16-4c44-9bce-2ae84f89acec", "value": 1804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386370, "uuid": "502e96de-17a4-4fe6-a1ce-834dc95244cd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386370, "uuid": "aa1ee531-618e-4506-a8d3-f99eb1a61c7f", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f632d528-0327-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770360559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770360559, "uuid": "3f96363f-bd08-4bbf-8bc4-48de498f479f", "comment": "Malware payload (Mirai)", "value": "79a15d9301ebb75872a8d70699ea34a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770360559, "uuid": "e115b28b-943b-49cb-a62b-19fa3125df40", "comment": "Malware payload (Mirai)", "value": "0bf8cedd3c0cd9b09ce8d0ae975de0401b3e0df82403210905dabe7f47206313", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770360559, "uuid": "5464f882-e608-4bba-a85d-21b7f56cd87f", "comment": "Malware payload (Mirai)", "value": "5da08dac76e0c51bfa6337d81a7368f30afb398d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770360559, "uuid": "cb7b9bec-c5bc-48f7-8860-3667a0c6dee8", "comment": "Malware payload (Mirai)", "value": "b894a6a4553a37bf6d61a1b1917a0800f3a3d95d987ddd8b8ea3bc89eb4a07cf0e3628b4af08e07c535d917b42e49fe9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770360559, "uuid": "35506c45-2e45-41f8-ba19-f205523a6bf3", "value": "T153837DC6E743C0F4E8624972213BE7329A73E53D1029EE83D369A972FD13542D61A39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770360559, "uuid": "3eec8dcb-59b3-4197-9e4e-642be6818c85", "value": "1536:st1r6leYcGyLBJOlkUiDVEfV3cxisMDJ+7s3Uk21:st9PyylJOlkUi+fV3cEsM96MQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770360559, "uuid": "6ed7d94c-2da2-4e2f-94a3-8f8d0919f160", "value": 80912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770360559, "uuid": "f3c681b1-f509-4845-9c33-8651954bdec7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770360559, "uuid": "8ac0d0df-8f69-426d-9ee0-a0695c8a9679", "value": "titanjr.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2edad8d1-0350-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1770377834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770377834, "uuid": "489dc85d-7ded-47e6-9e16-1f83faa5c385", "comment": "Malware payload (Stealc)", "value": "66b9d401305b4557071a11c8fad128d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770377834, "uuid": "a05752aa-b251-4d78-88a6-d6fd7fa0438d", "comment": "Malware payload (Stealc)", "value": "0e2ca22da0e4c4b73d68d11f879d0577f5a539c8dc8358c39caa577b89331b82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770377834, "uuid": "ec6292b9-d4da-41d8-bcc9-144ad39de192", "comment": "Malware payload (Stealc)", "value": "b833cc52ee4ec597c8f9b888c841c35c6178a401", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770377834, "uuid": "0bcd54ab-d111-41d6-97b9-f2ad6a639591", "comment": "Malware payload (Stealc)", "value": "e7bfb45eb94d4aed3f9b738ff65ede52b3bfaf41234104f6d4b1dc71d5346541eab3ea069de2ce62df71e1d06edb83c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770377834, "uuid": "a0389cc4-2bb2-4528-8e0d-31e546dc1a60", "value": "T1A4461213B2CBE03EE45D0B3B4562A16884FBEB216527AD1786E08CAEFE15050DD3F657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770377834, "uuid": "bf3dde80-884d-4d9f-9423-5090aca302dc", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770377834, "uuid": "6d8debf0-4a0b-4e13-b66b-b198c79dd223", "value": "98304:crB8ASx+v2Xm3ptG05CDD3IwylvzaYUYb3V9VkoEi1+nPfq3uT+CXe:KMZCGIVF3V9qolISQXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770377834, "uuid": "8209c489-6288-4f71-a0ec-4dca71eeee33", "value": 5773830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770377834, "uuid": "fb07935a-bcde-4770-870c-9b0ee2d7905f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770377834, "uuid": "978a9a9b-e728-4c9a-a1f5-0326a7dfc5a5", "value": "0e2ca22da0e4c4b73d68d11f879d0577f5a539c8dc8358c39caa577b89331b82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe53c91-0390-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770405565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770405565, "uuid": "d414017c-0186-468d-b4dd-8cb5de51c060", "comment": "Malware payload", "value": "3de0e98767035e9d6bcd4fb6635840d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770405565, "uuid": "900235b9-51f3-4fb9-a1bb-cfe66e9f069b", "comment": "Malware payload", "value": "0eda54caf4b219fb51fdd3ad07e0ef150530bb98ebac6effaba93d83291a380f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770405565, "uuid": "55529294-281d-480a-8548-df1d571ac2cb", "comment": "Malware payload", "value": "547ffc5897da0c1ab11c53af76c3ec9c3047f99f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770405565, "uuid": "86bcebaa-37dc-4717-9fb4-c5e1b5cc030c", "comment": "Malware payload", "value": "df614fe5ae473b1df3c22b5398345424be342ff898023ec677dc9f5622b9527b90e381fcdbdfb971259e221a33d33ba4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770405565, "uuid": "32be862a-8241-46c5-9fc6-fef6f9b2a389", "value": "T195C41A7EAC14E327F60CA0BEE287D3534F6578110236BA931CBA972411495739B877EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770405565, "uuid": "2c1369c7-7983-42ea-b742-883d8ab45a83", "value": "bcf81c3e3a1fe52e7b4dee3f058bfdd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770405565, "uuid": "a61e1d31-c219-46e8-a5d8-e3c794df4f49", "value": "12288:lcVR9cLXtGJKYvFSPXLI6zavBjR2+Q40S:lcVR9lKocLISavBjR/2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770405565, "uuid": "3c3ecf8c-2e62-45bb-a1e1-67dc03a6a2fe", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770405565, "uuid": "8d20e6bf-f73d-4da8-94c8-d0e98bf03a7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770405565, "uuid": "7ac46e10-faa8-48e6-8365-1b45b459d0b5", "value": "build_69862ab2d135a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "632c9fbe-03a3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770413570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770413570, "uuid": "58040cca-3de1-4a2f-9b7e-917b909e9ccd", "comment": "Malware payload", "value": "7e6a10cad7d7cb6b6148e497f4fd6848", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770413570, "uuid": "fb43d2a2-e55a-4537-94dd-09dda356f97f", "comment": "Malware payload", "value": "0ede4e11a3c1ef2aa360a9b4ec9b6177ae0b24f3fc4257c51bf9811a49f21952", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770413570, "uuid": "ab318080-5681-454b-8860-076d81e5805f", "comment": "Malware payload", "value": "91801ee16acddbba389b0f33643e91795ea1e214", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770413570, "uuid": "da8fe811-9a8f-4d8d-8517-e1a01c3ef73a", "comment": "Malware payload", "value": "a04f30c9d68acea5bf4716f393bcc81b5ac97b31a2529e1058f12ad09ab0b3f932218e6ae12fcb3404f3625e336725c6", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770413570, "uuid": "3b953199-03fa-41e5-9c58-0b81231f255b", "value": "T17A921ADD2F9C8EBAC79B447D50EE35C992AE63564FD8210CB1ED2FF002670AA51ED841", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770413570, "uuid": "b1649036-f0ca-44b7-abb1-192dc3ceee40", "value": "384:UFdcdM97p6fI5IcGhTUvtklIwY/w6WV1398uO5YwePcKJpUBkzNaSaRkvy9ThtKp:G9J5IcUT/lIwY/w6WP398n5YwePcqUBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770413570, "uuid": "7909af46-7e91-4044-9469-faff935bbe94", "value": 20920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770413570, "uuid": "b225ceba-fb6b-456b-8ddc-66efa09f48cb", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770413570, "uuid": "3acbd8b4-7e96-43ef-9cc8-88cc35c0c289", "value": "SystemUpdate.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5deea321-0335-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770366316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366316, "uuid": "4d4f575f-0422-42f9-8bca-609428429927", "comment": "Malware payload (Gafgyt)", "value": "5e1f1bb71c779e1b74649666de4d414c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366316, "uuid": "8121e59d-662f-4e65-ab36-2c2e7dab7da1", "comment": "Malware payload (Gafgyt)", "value": "0f070694f5431d94b73d3b31e7738f198c43bc01ec62404f2b22134dd28aa34e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366316, "uuid": "511f75f4-4ade-42e8-99cf-2cf04dd2f5a1", "comment": "Malware payload (Gafgyt)", "value": "71111c35c48a113732f7efca233aecd30d74af85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366316, "uuid": "77b6e69d-e072-4fc8-ac30-e965ee41fd3d", "comment": "Malware payload (Gafgyt)", "value": "19d6629a07e125749067f1d3e387c7c6ac149dacdc001a95723004f1dc1cb64940924ef221f0a2794ed86bf37b1f4a7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366316, "uuid": "be656464-fde7-4929-9473-0e22bd5a6622", "value": "T1786629D7B9924942C4E43B77A8BE81C432621EBA9F8612176D05FE3C3EBE1D90E35714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366316, "uuid": "17e44da5-9048-4f81-9117-59d4db037889", "value": "49152:X8aNzsObKFB5N/TvNRLSX0PNW5mwXnR13E5/ii5ohpoH7o5Z5EW:X8FF5N/pReXZi5rH7wEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770366316, "uuid": "dbce4dfa-8de0-458a-a322-344debf59cec", "value": 7078036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770366316, "uuid": "9139b4f7-98ad-4d5f-a3ac-e2246efba48b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366316, "uuid": "f5c6e4d6-ad37-4a5c-840c-55e8efbbaf48", "value": "linux_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ec40e5-0361-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770385392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385392, "uuid": "591219e5-ebed-42e4-8fc7-ae747b15caa7", "comment": "Malware payload (SnakeKeylogger)", "value": "9660d5c2cb70e0d5467ea1a8f168b968", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385392, "uuid": "832eea79-37c0-4476-800f-e4f9985ebe2c", "comment": "Malware payload (SnakeKeylogger)", "value": "0fb7744142d2f6e5ae0e5a7f53336f23dd09c3ccf1112a70791118d46ee58844", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385392, "uuid": "a378625d-408f-45e1-895e-b74353d89b31", "comment": "Malware payload (SnakeKeylogger)", "value": "10823ccf7331839ab72b3b779555e60d737cbc45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385392, "uuid": "3a29cf15-ae5f-47c5-b9ba-bbf3160d4cb9", "comment": "Malware payload (SnakeKeylogger)", "value": "ced1c0df5ffe62505d51791a04d840a533b04d76a4683813cfb0617d55faa30c285bb69017a348a987f3215d29d5477a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770385392, "uuid": "8255d6b8-69ae-478f-9072-07bc0c69a431", "value": "T1CF86338D3461C037C9270FF28054CF639188F8A6372760ADAA916DE67A71E855BF317B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770385392, "uuid": "152d67a7-77af-4412-afee-afb1f607f883", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770385392, "uuid": "5432e9ac-51e7-42bc-a862-8570ae3076f1", "value": "196608:nX2jfwrgLdNNko28WgFpwA90R4urZGKI6E6mrbGlPdLqy1wRs:dgLd/48DPP0bdJENcPhkRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770385392, "uuid": "37f83251-658c-421d-96f6-585570726997", "value": 7957504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770385392, "uuid": "73cdc381-6c76-47d5-96c1-001fe158a6f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770385392, "uuid": "dc56a716-5f90-47ce-94ad-57674ae58f0f", "value": "9660d5c2cb70e0d5467ea1a8f168b968.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e751e776-0330-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770364399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770364399, "uuid": "f210a100-efa1-433a-ac82-930ff5ed0614", "comment": "Malware payload (ConnectWise)", "value": "0f108c3492a5ee388fd35414511dd7f1", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false }, { "name": "Zoom", "colour": "#742151", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770364399, "uuid": "e2958ee0-56e9-4f36-8970-5e21e073a424", "comment": "Malware payload (ConnectWise)", "value": "10567b74f66bbd761e9b9bfe49e0f99e36957c0f5657e9edc25004cb61d2e538", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false }, { "name": "Zoom", "colour": "#742151", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770364399, "uuid": "30ae580d-2054-481d-847b-efdc5ed92458", "comment": "Malware payload (ConnectWise)", "value": "40b4699dc5d0766c3cd7e1e55c73814a5b63fb1c", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false }, { "name": "Zoom", "colour": "#742151", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770364399, "uuid": "0f897d27-32de-47c2-ae3d-1ea9108e5cc7", "comment": "Malware payload (ConnectWise)", "value": "e05b3907682750600857cdc83414a888e7f605e0e2d10979bd1863a54cffceb6a155f4135a3580acd1814307fcdc23a9", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false }, { "name": "Zoom", "colour": "#742151", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770364399, "uuid": "9c171269-10d1-4fff-9023-56f9a8c59113", "value": "T192C6237127E98425F1A79F39EE3A89E229387C64DA16C45F0BB43C0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770364399, "uuid": "b4619e1b-ed4c-42aa-9c7e-ce624d77f33a", "value": "196608:HKaLNkbgMi4QjKaLNkbgOKaLNkbg1KaLNkbgbKaLNkbg:fWgMiH7WgwWgpWgTWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770364399, "uuid": "66a7a9fa-3d8c-4edb-8057-52ce848effc8", "value": 12185600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770364399, "uuid": "da3d44e7-a83e-4ff7-abd5-22e90fe0b6dc", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770364399, "uuid": "28bc6373-3581-4ede-a343-0af5f934097e", "value": "ZoomUpdateInstaller.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aee597b-0308-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1770346877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770346877, "uuid": "a0062146-e8ea-447b-92d8-023ccf83d8ce", "comment": "Malware payload (ValleyRAT)", "value": "2bdff5b351109ba10951c8c842528014", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770346877, "uuid": "755f74aa-5722-432d-b50e-0ea297e6f382", "comment": "Malware payload (ValleyRAT)", "value": "11102393d678f2cd98549207235bda614e2e1fb3ea56fbfca3fe919459aa1120", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770346877, "uuid": "53b26fc5-5c17-4f9a-8fa0-27789459182b", "comment": "Malware payload (ValleyRAT)", "value": "4b7cbd9624d61bff11daf2bd0dd8f160f644063b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770346877, "uuid": "a954fcf6-01e2-4d8d-acec-8d1949824d06", "comment": "Malware payload (ValleyRAT)", "value": "31aedc46d89b28486898694c70839e11600aaa630e1526a5a895dde355495c36626120fc9fef3f393b85397c25db94e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770346877, "uuid": "a61c88d9-3068-4cf5-ad0a-14f61bfc7f95", "value": "T15F4733D245546E9BEF145A7C8187324D6830BE33B311A67B7B8AC682BC2310DF57BA71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770346877, "uuid": "4d85e6df-4656-4e74-85ad-76daab97e545", "value": "d221b1dc8c3a08622f6512e7876527c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770346877, "uuid": "1a809b25-186e-4021-bb51-6a64c8daf1b3", "value": "786432:JbHZL8ucrxkQj265JsddvFtt7lKq/4Dbz5b5Aq:9ZoFH2652fdvgT5bCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770346877, "uuid": "105817df-3de0-452a-802e-396f4f8d79e0", "value": 26223696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770346877, "uuid": "b2516ab6-dfb0-4a7c-8399-f3358c0b4809", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770346877, "uuid": "85b064d0-b542-4927-ac59-22c3449b25a6", "value": "Chrorne0af0-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6713754a-0335-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770366332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366332, "uuid": "5fdef1c0-3001-4b7e-956f-f9486417feb3", "comment": "Malware payload (Mirai)", "value": "079d915a4d4b4b6f9a6237b7fabff0ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366332, "uuid": "cad9c9b7-3bdc-4988-9477-4487b2925506", "comment": "Malware payload (Mirai)", "value": "1218e6668ff21f5d52e973754249ff5191629e0bc64030e1c15b4ee8c1f185a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366332, "uuid": "8c43e0fd-c54c-4e04-8200-b0e0f8b77fdd", "comment": "Malware payload (Mirai)", "value": "679fcfeecbf9d39e6a59e69d25be7f4fcd4a721b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366332, "uuid": "d03cae29-17bf-4485-8674-979e2b8c8b6d", "comment": "Malware payload (Mirai)", "value": "70d5a9c8a396c3c84fb4b913e682de4535737276b7c8088360c52280feec646f6e5ac9bd4d1c043749942c45bb6340f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366332, "uuid": "96feec78-1e62-43f6-924d-56867715437d", "value": "T136C45D59F8409FA1CAC529B6F65D929C33170B75C3DA720799245B343BCB8AF0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366332, "uuid": "6ee78560-4601-48e7-888b-540d75a2bd8c", "value": "12288:lVmneavLrxeFm3JPH2H62m7qgpEorAUPG:lV8vxMa2m7ZMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770366332, "uuid": "445b8aa2-ea67-462b-96ae-c5e40f49703c", "value": 575316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770366332, "uuid": "03bc3440-0e93-4109-8703-385b72402961", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366332, "uuid": "767febb8-0f52-4a90-ac0b-466d07a34723", "value": "data.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b998fa82-0363-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770386227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386227, "uuid": "32864e62-2cf9-4823-9620-fc13edd283b1", "comment": "Malware payload (Mirai)", "value": "e128d97f7e605908483c200298d57af3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386227, "uuid": "44c2fafd-e9d8-4317-96fe-99d50c6de7be", "comment": "Malware payload (Mirai)", "value": "138f53cd84a35d559caf135ba303561ae512cf021a0695007d3f35aa4b2d0ce7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386227, "uuid": "a96be6e8-c5b9-4fc4-a4a5-e4e8d07455b0", "comment": "Malware payload (Mirai)", "value": "762e181072982e25066acda3d266007104ac0e60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386227, "uuid": "ca507f45-ca80-4743-b4a0-9cff7d13ff53", "comment": "Malware payload (Mirai)", "value": "0f10d248c93250f7266be44dd726f083dce1f28740068f7dabc3585f870973a1e16b03e1266139199fd58d43b4e68dbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386227, "uuid": "63098d96-a8d9-4282-aa61-cbbea0b6542e", "value": "T13A6312FA5636BD4FDECC6A3C591022B9A188D2D1F3B7945074CED58D5B1522FD00C7A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386227, "uuid": "fb698bed-ad9a-4539-ade8-f4cc7ec4cab4", "value": "1536:+VUQ0TcrWCT3gcHB+cyepg1k/zJhw7nWAvnQGUgJViXZjb9RJxgNH:Mp0T2WCbgc8bm/gCAv3JwpjbHJxgNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386227, "uuid": "9d357395-30c9-4741-b09a-c3046082d6ba", "value": 70428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386227, "uuid": "1b316e72-944b-42c9-b967-f3a92687b759", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386227, "uuid": "00c68e78-bfbc-4c5d-a7b1-9804f88d0d04", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e61e2ad9-035b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770382866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770382866, "uuid": "9c5c9cba-95ab-485d-b067-15286c0fdeb3", "comment": "Malware payload (Mirai)", "value": "a3da66cc83ca04a0e88b9c9d267852e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770382866, "uuid": "4f2e57c6-be33-4ecd-980e-5d23e2044ca1", "comment": "Malware payload (Mirai)", "value": "141b4f5689cd0694d59e543567a88ebaa527868eb4d812784b37777d8b26c015", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770382866, "uuid": "295d6a92-4047-4d71-bf41-42f9381231c0", "comment": "Malware payload (Mirai)", "value": "335ef440e1afb66ae133d512825d340c65fcfbff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770382866, "uuid": "c218a021-17d9-4128-a2fe-98f28ec316e5", "comment": "Malware payload (Mirai)", "value": "d20e72e7e8e1cf2093fa304a7c418005c1266cb9068cb36d80494bb2777b30cec541216dd8b5e640e79292cd0b4efd2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770382866, "uuid": "15a01194-7fed-4262-b5a5-4fb5ec9aa46b", "value": "T19A438DBBC9A96AE0C944817465288AF94B23D804A6D73EF5DB938D534007FECF9053F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770382866, "uuid": "a57760de-a88d-4b53-adb2-b605f54e7567", "value": "768:/at/bB7hLOf6FaeGuYYro3AyoDJWqYHREoveaLH9CAkYFn79:/at/VV6fNQdJD9YHhGo9CAXF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770382866, "uuid": "d61cdcc5-b172-4f79-a72e-25f4ca55ed0e", "value": 58872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770382866, "uuid": "ede082f7-0495-478d-b68b-df8c2a7557b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770382866, "uuid": "80a516e7-624d-4b0e-987b-42d7fcf94a9f", "value": "mao.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff20fc2-0349-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770375098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375098, "uuid": "bbf11886-0677-4d02-aa50-ba6b00c04934", "comment": "Malware payload (Mirai)", "value": "cca334849098c44bbe6ee3a0b754dd6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375098, "uuid": "d0054a77-bcbe-4989-afb2-cfc9d094e4ff", "comment": "Malware payload (Mirai)", "value": "14d0f6f728b51f3278582e40292b5b04eb658d2bdf904e4a2a1d9323fc7301dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375098, "uuid": "b14c4942-46ac-43d5-8533-6be9f3bfbef3", "comment": "Malware payload (Mirai)", "value": "0dfb8f7a187bfad7324a33812e42a9e2bb8a7bd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375098, "uuid": "ca06a4ca-a1b9-4ed2-8355-c162d41fdcbf", "comment": "Malware payload (Mirai)", "value": "ff2cdcc44cc4627f302f4def0ed10787e3caa5c6c3ee4a434f27abe50cc24a324477e7645070945a43375f980085ea90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375098, "uuid": "5bf49aa8-c137-47a3-ae84-5d49b9d16677", "value": "T11363951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375098, "uuid": "f01dd0ac-ac9f-41a3-bd45-8eb7ec60e3b0", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAh:UnN4ZH2SyOyuIq8LMEIUq+cktpvXzvL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770375098, "uuid": "4e193132-47c8-4455-a80f-109b121cdd19", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770375098, "uuid": "9e05de6b-42f1-4059-8f43-9091a69ecc4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375098, "uuid": "49ebad57-c95e-4835-92dd-9ed8ff2712a6", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7bfb7d3-0383-11f1-a129-42010a9c0007", "comment": "Malware payload (SheetRAT)", "timestamp": 1770400048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770400048, "uuid": "6a4fda64-5031-46b2-b48f-51eaa0b97026", "comment": "Malware payload (SheetRAT)", "value": "6d38d9b6193269e1f27c1a05408b222e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770400048, "uuid": "6215ff57-39e5-48da-92b7-fe4773afdf37", "comment": "Malware payload (SheetRAT)", "value": "1559f49021d417ea46202212acd4138221ca41231741a867d5aaa3a3ee72e16d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770400048, "uuid": "640f74a7-127a-4f86-94f3-b8f61e1408e2", "comment": "Malware payload (SheetRAT)", "value": "b73f70dfb6fda3c4765d68ee68c77ed89767ad85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770400048, "uuid": "48861ea5-3a81-406b-9734-896071fcfddf", "comment": "Malware payload (SheetRAT)", "value": "0e26cb123948b2ebec47a4444e6ce813ac5802721a16673c32ac24dcd33f1dd54becb5e0a184b261420d8407c8b34bef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770400048, "uuid": "33fccea1-4fa4-4ab0-b4d1-c6341c632c88", "value": "T109C44A157FA58E00D491287ECA7E3A09CB16F0F225026347374AF6A15D459EEEE2C3DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770400048, "uuid": "84f13d6f-f126-4fa9-9885-07702ffc5e85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770400048, "uuid": "f8982692-0b54-4821-bd89-bfbd35b3af35", "value": "6144:HxZYyFf7COnQmP+/TxFluGWdq+XR1kiQFACfY0rI4PhjrOSumbYyzbR7PNvbHu7p:R+cf7COQK6JIl50VPhjTHL4JzBJ4OIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770400048, "uuid": "6a755e98-6366-4f75-b99a-aee829b8c4b4", "value": 546304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770400048, "uuid": "b50746f6-ce5d-45b5-baf9-97b91810d712", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770400048, "uuid": "57d870a3-599d-4fb2-9234-efa088bd869b", "value": "nerrest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353c477a-0357-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770380851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770380851, "uuid": "a627f1d6-9816-4bd3-a969-44f71b6997c3", "comment": "Malware payload", "value": "948d1de37ee08a5186840ffaf92c0848", "object_relation": "md5", "Tag": [ { "name": "Babar", "colour": "#E51673", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlySFX", "colour": "#864D39", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Trojan/Win32.FlySFX[Packed]", "colour": "#66B8CF", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Zusy.LM!MTB", "colour": "#F74676", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770380851, "uuid": "9a84158e-a349-44c9-a1a3-a275f683cae2", "comment": "Malware payload", "value": "1563283dc6e72018240bc34062d30361ada87b6006f8ca554b01a2d780d80e2a", "object_relation": "sha256", "Tag": [ { "name": "Babar", "colour": "#E51673", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlySFX", "colour": "#864D39", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Trojan/Win32.FlySFX[Packed]", "colour": "#66B8CF", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Zusy.LM!MTB", "colour": "#F74676", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770380851, "uuid": "ff828871-b08f-4980-9d41-5bf3a8287cde", "comment": "Malware payload", "value": "a62d7602cddf86ea80d328bf5aed7c23495b1013", "object_relation": "sha1", "Tag": [ { "name": "Babar", "colour": "#E51673", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlySFX", "colour": "#864D39", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Trojan/Win32.FlySFX[Packed]", "colour": "#66B8CF", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Zusy.LM!MTB", "colour": "#F74676", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770380851, "uuid": "111f07d4-9b2c-401a-bb04-9dfecc3db9a9", "comment": "Malware payload", "value": "4069ce5a5b3456ed1dedf6a178b7c8674fe3586803ef47afc51b4ef6667777dc087a3a1f2a35a89531da6185c6a92923", "object_relation": "sha3-384", "Tag": [ { "name": "Babar", "colour": "#E51673", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlySFX", "colour": "#864D39", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Trojan/Win32.FlySFX[Packed]", "colour": "#66B8CF", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Zusy.LM!MTB", "colour": "#F74676", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770380851, "uuid": "8e8298de-89a7-47ab-af59-6cb881289480", "value": "T1A2C7331F173089C6D4D441B188A5DEB8176BED255C526F27B0883B396CF32C9AF1A36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770380851, "uuid": "12ef4598-e57f-4b48-81b7-85f59d407b48", "value": "9165ea3e914e03bda3346f13edbd6ccd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770380851, "uuid": "e44eb8bf-302c-4330-a4e7-c2ed3af770b2", "value": "786432:3gnxEdv9z01RbLCJP14XdcrzFOj51o+8v6EjfMrQnGcAvxjVlFBr8RAv4eftJY8g:gx6VzsCF14QUdyZjfMUtApQiTftO8i+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770380851, "uuid": "0428b9f1-2d5c-4bee-b473-08c27b1288e8", "value": 52726081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770380851, "uuid": "4d4bdae5-aa89-40b4-8f38-38197200b53c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770380851, "uuid": "31e0787c-c85c-4092-b20b-1ee6b9194679", "value": "\u8ff7\u4f60\u7f57\u5fb7\u4e00\u91d1\u5c71\u6bd2\u97382.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca86d09e-0349-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770375089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375089, "uuid": "e5f5674c-9485-4403-a5f7-de66ba800e69", "comment": "Malware payload (Mirai)", "value": "6154a1abdc7a950ab5645b6b786f3f97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375089, "uuid": "70e1ca4f-6b46-4e70-b729-cc5e178c5e8a", "comment": "Malware payload (Mirai)", "value": "1578ccd7caaf46e017942c58d341bdd9fa01d85a1b71e4375d36ad851d7a33a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375089, "uuid": "92f4cd59-f5a3-4620-8f51-f730bd5f15f7", "comment": "Malware payload (Mirai)", "value": "ba979da4149f8cc6847a12d0bd9197633de525dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375089, "uuid": "9968ba85-298a-4b9b-b008-c98da66a9011", "comment": "Malware payload (Mirai)", "value": "2fb03fc9ae0d350b8384c64549f4cd82f63aa519d1a852769fb2b4ac9004e25963f0559a72313040315111005ba78b06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375089, "uuid": "34754e06-d1f8-4c39-a75f-2dbebe214216", "value": "T1B8630A96F8818E25C5D5037EF92D128E371227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375089, "uuid": "0a8c29c2-f14a-4767-8195-07d6b3de072d", "value": "1536:Ctn1TVYFxV8rk68mVKmCXdGdl30NJiqrHgecIfIeiRwMr0rmO:mGV2k4VJSCXqN6wMr0rmO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770375089, "uuid": "e1337144-3994-4ec6-ad32-5f1bd44c13df", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770375089, "uuid": "2e623ddc-b249-4b26-87fd-8284b50b6807", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375089, "uuid": "204aa652-86cc-4ffc-b24c-63ea6878e54b", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56f801c-030e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770349820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770349820, "uuid": "7989ccc3-9043-4948-8b52-764a8b34de2b", "comment": "Malware payload", "value": "0ae7e599ead5ee8e467b38754432961d", "object_relation": "md5", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770349820, "uuid": "a1bc0b28-cb1c-45df-a6d1-e88d751c2a38", "comment": "Malware payload", "value": "165b8ef0df95a2afe58d0b591d6c21f52a4ef2a45021c95f2ef93cdd1d0b2838", "object_relation": "sha256", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770349820, "uuid": "f2b098d9-edb7-4f89-a945-bc7c048c2dca", "comment": "Malware payload", "value": "51d199022adf034ab37b34be0b81f69eef7b7eca", "object_relation": "sha1", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770349820, "uuid": "d828f78e-a45b-41c2-b9ef-8223cd9e05cf", "comment": "Malware payload", "value": "f179bbc94a9b1abd8f3055dc058f50217fe959c383651d4cb8b72642c99d05786ec33dc1a7580b488f2974d1bdcaa33d", "object_relation": "sha3-384", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770349820, "uuid": "57af5d85-92bc-49c4-a838-1f04f63742c8", "value": "T1DFA4F737BE696D84DF940EFF8231D5A58DC8E9D391A5C0E1BC400941BEE9BC4F9186A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770349820, "uuid": "b7bf60f4-075a-4c70-b403-9c308b66fc17", "value": "3072:q6/2x6A99US8N3aKOEv3S1AE08LnQVZUH6diyG6vkK/s+GKF65mthVxDU9jAeLk0:q66hgxz3PSDLnQPUH6BU18nVxg9jJL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770349820, "uuid": "acde3b28-313d-4152-abf7-4fcd49ea9588", "value": 458931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770349820, "uuid": "0f8a4b0a-eced-4157-854d-266c3bda1cd8", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770349820, "uuid": "dafc9755-63c5-493f-92f9-3bf5e0db62e7", "value": "Installer.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "840ce7c2-0362-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770385708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385708, "uuid": "7e46c11a-b3ff-4b50-ba36-59e1e40628ec", "comment": "Malware payload", "value": "6679cf6b425730b38fae8ca561f9690a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385708, "uuid": "e494ae8a-f464-427d-b70b-f88bff248b6a", "comment": "Malware payload", "value": "16cab9159777bc81265347572902357ae671454512aa3a5a02f174cf49d5ca90", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385708, "uuid": "9c45a5f7-7f81-45e4-9be6-b874854f5905", "comment": "Malware payload", "value": "ceb6accd7fd3d59a5ff550f7591d8ed38763f2ac", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385708, "uuid": "c185800b-13c7-43c0-93a7-5d97043ccdae", "comment": "Malware payload", "value": "6978248659e3224319b852696be8e8b5bb261a6c0feec3e5752737810b9bea90b4f299ac78dfb546ffb641d412c94af1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770385708, "uuid": "66407dca-dc32-4a33-8441-36f77ec772e8", "value": "T166D48C0DA7A141F9D1B7D174CD034657EBB2FC9247326A9B43E04A862F2BAA45F3E710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770385708, "uuid": "6b0e428d-bcf1-4684-823c-8fb69f952394", "value": "a330d858063c312aaac6d9eaeb29a36b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770385708, "uuid": "c34aaac1-1f12-456d-b0d3-14dd3a79ea53", "value": "12288:EgxMlP+aSCCzKZ+vjeVRXn6BXrnIaLo61:XxMlP+jHzI6B4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770385708, "uuid": "f495fbd9-fa1d-4cae-8ac8-503afd6c5d02", "value": 649216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770385708, "uuid": "db15afc4-cef5-4188-b1b8-2f2859bfd14c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770385708, "uuid": "3a0f6fb1-3f46-4337-8ead-5868c2fe74f0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe33284b-037d-11f1-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1770397509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770397509, "uuid": "2d39f65a-0321-4ac2-9b35-b01f1ab7dfa5", "comment": "Malware payload (njrat)", "value": "10ac3fa8706f38780d6da870646ff9f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770397509, "uuid": "3f75594d-0a2c-4be7-9324-6672102842cb", "comment": "Malware payload (njrat)", "value": "18d31d1e749db2becc1ac8f3928c8a955d69198bc5d01258916f778491a9a88e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770397509, "uuid": "bf1a951f-d250-4dd0-a53f-adc3d8a0f1f4", "comment": "Malware payload (njrat)", "value": "822c9007e273e289ad3e59ab463cd9e93e78b941", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770397509, "uuid": "1df472b3-e558-4d48-89dd-fccdaa7664df", "comment": "Malware payload (njrat)", "value": "c8b955c8a6bcb333f6bff59cce8ecb389f4922887f9592b757afe3fc96007eb5b57cf52fd9d8e6aabc212de2044813b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770397509, "uuid": "033ceeec-d492-4eea-a4e2-afbd433f072e", "value": "T122E2F7467BE58219C6BC1AF89CB313210772E3478572EB6F5CDC48DA4B676D00641EED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770397509, "uuid": "6e25b35e-9182-4789-9075-a38770897fc9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770397509, "uuid": "e48988d8-cc6a-4a8e-9211-b145bfeb3b5f", "value": "384:N0bUe5XB4e0XfOZeANuiEO0YaHWTgtTUFQqzFwM/ZObbm:eT9Bu2IguiEYu9bm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770397509, "uuid": "b23fd75c-2b78-415b-adfa-2ddadd467f18", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770397509, "uuid": "cb54a983-5a44-4410-8d07-7674af4cc47d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770397509, "uuid": "8808e3e1-4610-430f-bbfc-cd004dd3d358", "value": "10AC3FA8706F38780D6DA870646FF9F7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e1c34b4-03ac-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770417373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770417373, "uuid": "b696d0fd-65da-4c7f-9da8-a01777eb1261", "comment": "Malware payload", "value": "c16fb79a4b2ea75004edfc045d02963d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770417373, "uuid": "adae65a1-e080-419d-aa34-cf1c18777a0f", "comment": "Malware payload", "value": "1b78b771a4b7ee123df62de7efc4b26c18f69142970f7afc7b20cccd4518a5aa", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770417373, "uuid": "279abc2c-3184-4caf-873b-750d6ea42599", "comment": "Malware payload", "value": "d16921dbee0d9754d6f0f7dd5b0d809626c1469e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770417373, "uuid": "d2c33f00-6a38-43c9-b169-547cd32ffdce", "comment": "Malware payload", "value": "40cba4b12c7534fdb254320278cc6c945794cc2cd120da69e793c352e5cd289f75ec49374772bbcfa7b19d33fd500114", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770417373, "uuid": "6c603aea-96eb-4c3b-aa6d-3a446a47e25a", "value": "T1E1A533B94BB5524EF8BB1CF6324626006E7EF5A715C6860EB31801376003EDF546B67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770417373, "uuid": "742976b6-ec9e-4751-86ae-c5a6f00ac7ef", "value": "3a8632a6ba7f7c06aaa289e4406ae495", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770417373, "uuid": "6eb7f429-7443-4e78-b57d-f60dadf71200", "value": "49152:tNwGWyecoqNwwDXL/xnFc9xlqXn5u/wTRFlk3nYa:tNBPXDXLJFc9hITR3cY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770417373, "uuid": "c5f9a122-1bec-4a13-88ec-009bf461968d", "value": 2143232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770417373, "uuid": "338e99d0-30ea-4661-9d80-5c86add57f3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770417373, "uuid": "fb2f6211-58ae-46d2-b0d2-a33f250b922e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e4ef9bb-0364-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770386369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386369, "uuid": "12e05848-232b-4e40-a895-ab33a5218541", "comment": "Malware payload (Mirai)", "value": "399121c100131c8fb52537b0bb66d436", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386369, "uuid": "b1631237-36af-4f04-9269-e381c1f1b014", "comment": "Malware payload (Mirai)", "value": "1c4f98b2670703e322dcbe7632ee2710254735e81bb7452fa2b143158a8b7177", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386369, "uuid": "2c7ce422-1de0-4976-8477-013cf9ad7626", "comment": "Malware payload (Mirai)", "value": "fbcb4b7a474497acbe1307c6e5fef4ae8c030cc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386369, "uuid": "128fe492-9552-448d-8754-a3fa7127f69c", "comment": "Malware payload (Mirai)", "value": "12f799e5a2d2dd43b20a435e9674158152aaa3b667e4861019f22f6d65b70090ed5183b1fcbaaa3f5f111dc75a9207ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386369, "uuid": "3de1a4ca-8c82-4152-937a-9ef44501d92d", "value": "T119B3D085B210AE55C02272FCB1870A90D3B16E7B4B9A150B44B3F5B46DBCCD47E1BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386369, "uuid": "60ca24fd-4a4a-40cb-86b2-a8475bc54230", "value": "3072:X5Apzl9NOvXoVLAE375lhYy5SkOXNwuG:aevXCLr59hmNwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386369, "uuid": "a85cd21b-f63f-409d-b2ab-f973a18cc79d", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386369, "uuid": "ef734fda-05c5-4d87-90b7-93d65ec1d419", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386369, "uuid": "4ef18d43-78b4-4745-b17f-af3ec7c769a1", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62617eb-0349-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770375054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375054, "uuid": "8cc5c086-2510-4f78-8f14-d95c9b0a569b", "comment": "Malware payload (Mirai)", "value": "10868d334c11caf411135e78ea3b7b23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375054, "uuid": "62fffadc-0680-4102-b7d5-df24e495c6fb", "comment": "Malware payload (Mirai)", "value": "1c5e695b5402b80a5c7f8236fa8af54c625be858e450cb86e165fabcb1a83f84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375054, "uuid": "fc8b4acb-3bd1-43e7-99be-fe88a3bdd671", "comment": "Malware payload (Mirai)", "value": "21bf337141d96bd2e9d90dbf276ecd991ffbb132", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375054, "uuid": "0c3effc0-4f70-45a5-8189-3fa0154b031d", "comment": "Malware payload (Mirai)", "value": "7c075163ccd98ea0055634ef881fbb58a8498e941cfa72a256849dd18065d91451fa5c62ab3d09f31712f812cef1bbc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375054, "uuid": "fcd5e3b1-dce9-452b-b252-bdf7085dfe20", "value": "T1FCA2E1117F0885CFC435397D8AE8AAC921C2FD29E36C2A165BD0C14BF5D368544B5F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375054, "uuid": "160ababd-98c6-42e5-a9a1-69dcf5d31b50", "value": "384:MY1Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXavIZWmwya6zIQR1ltrDyV3bh/mGW6:798o08kxofBE+ZkXaCEbwPR1ixlmGWPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770375054, "uuid": "1daa54ef-20f0-4f2e-b97b-0d0b08770a3b", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770375054, "uuid": "3f4873bd-abb9-45dc-b2aa-a0a5fbd786e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375054, "uuid": "7784bdaa-e307-4536-ba66-8f8c40f39cc1", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f381b68-0365-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770387015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770387015, "uuid": "c7b49990-146f-4294-b904-60f282590151", "comment": "Malware payload (Mirai)", "value": "a74f49cfc96747b99e16a2f89982047e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770387015, "uuid": "d4d5391a-9bd5-4251-93b0-8a7970c15fac", "comment": "Malware payload (Mirai)", "value": "1cc9c06bcb7f61e37c9589e407269c050174ced4057fe552f0919300d2730feb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770387015, "uuid": "05dea7ee-09bc-4611-b0ca-e4fe0d938e2f", "comment": "Malware payload (Mirai)", "value": "cbf75f8b2ca7e6d7c39545e8f09240d7783f8fd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770387015, "uuid": "fac5a804-a64d-40cd-aae0-0ef35f0f0ff2", "comment": "Malware payload (Mirai)", "value": "b38acef916d919ac77d20602d63ae8abaf113cdffb08f82f1eb8c921bb98f21419ef0388abe7b59a9f839392407218ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770387015, "uuid": "c5758f03-a385-4dde-a41b-a951dd5088be", "value": "T173C3F909AB614FFBE86FCD3746E90B0525CC551722A83F7A3574D828F64B64B4AE3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770387015, "uuid": "e267fd68-ca05-4197-931e-de2d77b8e57f", "value": "1536:mtJ6cGVoVBFf+g6z3jLv514RXxEbOY0+YdW0OKhJ6gposmZ5uBrKnr1FK/YVi0hs:sJ6cGVoF6TPsn6g7mCpO0wVA9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770387015, "uuid": "e3249da3-cae1-46e1-9729-00e8969ab037", "value": 122496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770387015, "uuid": "ee4e863d-8bec-4731-99f9-13e7202280b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770387015, "uuid": "937c06c9-d082-4726-98da-f882cd9111f9", "value": "titanjr.mipsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e7bca47-03b3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770420380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770420380, "uuid": "3ceef685-4ce0-4ed9-98f3-509e3ab37f59", "comment": "Malware payload", "value": "c7ef89d15e7d48b3c86af9007817d59c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770420380, "uuid": "b7326807-699d-49d6-99bb-c74ab2812bd2", "comment": "Malware payload", "value": "1d7044de8afec892897dfd21b4c489e696fa12e6d9699de9d2c2fab871a9bafc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770420380, "uuid": "074580de-8274-46d0-bfbc-41bfbd651d51", "comment": "Malware payload", "value": "ff0718e6540c359b263a09b905eb23d64797ae71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770420380, "uuid": "d84e3e22-a09c-4e3d-a6d8-344df6fe74f1", "comment": "Malware payload", "value": "48fe87c3c779bafb27eb3cd9d7082c53ffdb610f4224e3db1c829ec0b1d4c3e15fc995164378fdc1d1c1b7c14b09bed4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770420380, "uuid": "70a820b4-7656-4d3e-88aa-a32f795c936a", "value": "T1A9B533E6BEE5E44FD19B1637E1C06B64E63D9A8E3459031C3BD212ABC392B355BC90C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770420380, "uuid": "909daefd-e63a-43c8-af95-953eb4b6c9b6", "value": "3a8632a6ba7f7c06aaa289e4406ae495", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770420380, "uuid": "20e3b77e-2862-4244-8312-12b46f5b5f54", "value": "49152:gKHLJjwMbL0baQnHgjPHalvqzPuCN0k28XSnUJN3+b:bHlRL0bfnA7iqzPuw0AJNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770420380, "uuid": "418016d4-883d-4b0c-9704-72d18cd186ce", "value": 2349056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770420380, "uuid": "5303a74d-0543-4d6e-b49c-ef336cc2aeba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770420380, "uuid": "21ecaf85-735c-4fd9-9751-3ccf72b52ad7", "value": "SecuriteInfo.com.Win64.Evo-gen.77884719", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc6eff21-0363-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770386232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386232, "uuid": "72d82e31-1d8e-4eb3-9f87-237aac6d378e", "comment": "Malware payload (Gafgyt)", "value": "dc1d558170e2d67af0a29025b750ec75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386232, "uuid": "76186052-acc3-46b5-a3a8-80c078bea0db", "comment": "Malware payload (Gafgyt)", "value": "1d85c96135065004c0765d205230ce6c869ed4188bf3739364b8abcc14b87a21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386232, "uuid": "1ea231d9-77a1-4949-bc89-642dc3a26138", "comment": "Malware payload (Gafgyt)", "value": "9e5250134126596478c89a5ca05db52e0815b990", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386232, "uuid": "5c2b4715-7577-4f91-b933-9c3f4c392ed4", "comment": "Malware payload (Gafgyt)", "value": "ec34129f74a18193ffb9075836f48888d17c7182d2bf2fc810a8b243adc8440e66f8a43edf35f4f1e061f411df03cb27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386232, "uuid": "667eea72-a09d-4c86-bb47-9d0c3932f61b", "value": "T1D6B328436B1C0B87C49B9AB01DA737F18B69BD7112A351C9A90BFEC04733AB81527F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386232, "uuid": "1cbefe0f-51ec-4773-857f-314f41da59b7", "value": "3072:WD3l+XQzPeV91310pWudkKakpNDtm2pgYMidIP1W:WD3l+XQzPe713CpWCkypxtm2pgYMidIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386232, "uuid": "77005648-7ca3-49ad-98fb-cc91297f6db0", "value": 113194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386232, "uuid": "d18f4d93-e2d6-461b-9310-784b97a4ef71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386232, "uuid": "b91d12be-7bd8-49a4-b554-b7cb86cc0fa6", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad0d735-0361-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770385397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385397, "uuid": "131ceeb1-dc63-4a48-8625-343c81ff8ed9", "comment": "Malware payload (Vidar)", "value": "f7024cc1276c6c18066fec1b5f3b8f8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385397, "uuid": "4f2988ff-d6da-42c8-a1df-c789093ac9e2", "comment": "Malware payload (Vidar)", "value": "1db45d0384af552a6a33aa4127ce3c55276eb43fb3ee65b282ba1e8d2ba5e663", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385397, "uuid": "7764c032-5d40-4d81-bdfe-9d1834d922ed", "comment": "Malware payload (Vidar)", "value": "4125c8f3c49388e96708b96b4a7fc54f29ec6a47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385397, "uuid": "7c9bb64e-c4d7-421b-8a42-f99ea330d8f4", "comment": "Malware payload (Vidar)", "value": "ed35f522be392b13580332a43733893009af6d4ef2b30eeda89817139e57f395f29ee1d65789f2410c4c49663b178bb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770385397, "uuid": "1a41ab4b-ffde-462c-a1a2-2244c47cda1a", "value": "T165561213B2CBE43DE46E0B3705B27264A4FBAA21A523ED5696F444ACCF251601E3F747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770385397, "uuid": "1671e890-45ef-452c-b0ad-9390780a6b6d", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770385397, "uuid": "8bdde67e-3f17-4d11-8582-5c44135199f2", "value": "98304:4r8Qnc2WF1OTdkQpUQ0uerhjGHahlM+eWwYnKtUANZRkq2NgT9FtEkQ1AOMl:O220QkQpUPueZ25tLNlZ9FtQ1Ls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770385397, "uuid": "def5e815-7b06-46d4-a1e4-0f811237902a", "value": 6014835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770385397, "uuid": "2b7ec60f-dd17-4f26-a725-d7c397ff6e70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770385397, "uuid": "6ca12503-bd82-47ba-862b-ea1eeb1975ce", "value": "XnBootstapp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b0b0f45-0362-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770385719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385719, "uuid": "90c27f11-7155-450e-b220-9f37b223e729", "comment": "Malware payload (Mirai)", "value": "eb384a332a9cc09fc64716285b9220ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385719, "uuid": "7dcbf5b8-4f95-465d-82d2-3ecf38ea199c", "comment": "Malware payload (Mirai)", "value": "1ec3c9f380aebd3a35b3149cca53f59e5dbeeb9b23fa90eae22d7e8c846c83cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385719, "uuid": "68524070-e140-42a4-8636-e99b0394d6c4", "comment": "Malware payload (Mirai)", "value": "afc0d43d30c548dc2f3c63ba5b45116dff73b832", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385719, "uuid": "be6f7c28-06fa-43a6-be52-1cb1766ba691", "comment": "Malware payload (Mirai)", "value": "8bc4848ca4fc0a7f64d9c87bd5b092ede7076f7e4314e4c35bc46d43cb5ed37354f14d4ca2e8ee97f9132d9c074035a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770385719, "uuid": "ba648999-47db-4084-83ad-6de3c41ab568", "value": "T1BF043C03659189FBC4D6DFF51BDB95128933F8392B32220AB798BCE51F0DE946E1D214", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770385719, "uuid": "f292e2d8-f422-45f0-97b5-6dc1b2a59070", "value": "3072:LwB04VMozdqOMyJKUayTrqCT/mAxvmOHnd4wvnOp5EHhO:LWnzvwaVZvmOHnd4wvnOp5EHhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770385719, "uuid": "985fe579-27c3-4a23-9555-510cc254ae27", "value": 176376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770385719, "uuid": "ce13ce0a-9e45-42ad-96ce-c41ad2ba85f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770385719, "uuid": "04f4e4ea-1869-4cec-86eb-1d310914525e", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed660a65-0365-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1770387173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770387173, "uuid": "8335415c-acfd-4185-8fff-04036d7867d3", "comment": "Malware payload (DarkTortilla)", "value": "9d972b239ab16b35993511536c913261", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770387173, "uuid": "1ef57b3f-7152-44b1-b259-1a67e6f44a74", "comment": "Malware payload (DarkTortilla)", "value": "1f9188b926fd1bf32c8731d981cbd0be675b10cc1376f0544f01b99486f56e3a", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770387173, "uuid": "a7a6e676-9957-46cd-9663-eb24f1cdcecf", "comment": "Malware payload (DarkTortilla)", "value": "7da0d7568799594d42caa8315a92977862082078", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770387173, "uuid": "5b40e9c7-0e53-4de7-9174-f7e5740e9c53", "comment": "Malware payload (DarkTortilla)", "value": "ba4c70e1029dc7f09c94b06bfbb689671985b245f1402ef6341374532afadb2bf0e6a55e2d5a5168b1c5c1c40df361e1", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770387173, "uuid": "53f2aa64-8122-451d-b195-2fe405438753", "value": "T15E15BF0223E86FA8F4BE97791575402587F8F906D722DB9E3D8984ED1972F80CA51B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770387173, "uuid": "f7091251-d8c0-44e4-a550-978c8bdd50ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770387173, "uuid": "1c1d210e-6be6-4f71-9eb3-77a52530ded4", "value": "24576:9RVzetQbOVebkLKuxjBQcvT8C28IU2O87UR:zV+AbkLTxjBQcvASIU2/UR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770387173, "uuid": "fafa766e-f006-4bb1-a967-a97d05526774", "value": 922112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770387173, "uuid": "1edc7d6c-c586-4a1f-9142-373955861300", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770387173, "uuid": "f43357f0-682f-4d03-85b8-40ae8b9940f5", "value": "ORDEN DE COMPRA ABL245496\u2026\u2026\u20262026_______________PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "839fbe1d-0380-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770398592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398592, "uuid": "b2815f8d-a74f-4ed1-bfe4-9836e24c4b19", "comment": "Malware payload (SalatStealer)", "value": "005ffcf2d30c8061cd2e7e7a61c4e1f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398592, "uuid": "99c5d5d8-2c34-4b44-bc4f-efdda15a9c04", "comment": "Malware payload (SalatStealer)", "value": "1f95f7d6ce13690766f0d14ed0eeef4ba9906e525e2ce3abc19f2bae128765cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398592, "uuid": "4614d548-5311-4dd1-bc35-060f9e2365c9", "comment": "Malware payload (SalatStealer)", "value": "b9ebcb71acb05241e5bd26aecdcade958b90ca14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398592, "uuid": "5db74f89-6051-401e-8615-8203e7477754", "comment": "Malware payload (SalatStealer)", "value": "8f7d326c630d718e113ef0231e3c2cc81ec79e5dc62aaca37ec39e421fe44cf5e53e66eec2b77ae1bfa7e7237df9c53f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770398592, "uuid": "32be7f2d-fa77-4bd9-89b4-017f2438277c", "value": "T1B18633D5A3B109F9E9A7903FC2B5C189E262B46B8B65C3CF576006522F23BF05939F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770398592, "uuid": "30d9b5cb-1d70-46d5-96a7-55c0d814b814", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770398592, "uuid": "fcf7e4e5-5590-4b67-8b73-074cc5960e19", "value": "196608:ZOO0/zYA1HeT39IigwTauDXURuA1AG/kCE3:ZOOszB1+TtIiF2uARuA1kCE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770398592, "uuid": "dea9fd0d-511c-4531-b78b-de66c9bde8bb", "value": 8589748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770398592, "uuid": "f1e2058e-1bf4-4f26-ae93-ee3e697059fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770398592, "uuid": "bc788735-f285-4e46-a744-56e5fd2281a6", "value": "TeamSpeak.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6edace14-0335-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770366345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366345, "uuid": "4fbf2075-88fb-42b5-ab05-f9ed04f74ef7", "comment": "Malware payload", "value": "ea01ff8af651492adf0198e7462c2c97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366345, "uuid": "5e087136-a72b-45b8-a907-43742352fa33", "comment": "Malware payload", "value": "1f9d84dddfde1167a4c51ca35e0b8cb9aa22fb4f0e909b52587b542fc88e0430", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366345, "uuid": "279ca323-8aa3-4995-8f87-87fd1e5bed98", "comment": "Malware payload", "value": "ddf96b2c61e25b9fa0376f42a592f83eff4c132f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366345, "uuid": "65640e38-cb4e-44de-9ee5-cf45a33e5425", "comment": "Malware payload", "value": "62d76b1d00312c90ac4126b58c545b6938c0c4f618eead4c5922a57b36123f5fa816cd1cb63d4dfd334a7a751b3194a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366345, "uuid": "cc135b57-613a-4317-9ef4-f9ff3d40e924", "value": "T131864A977A68E70FC22423345DB2CAA827691C9545D79617B341FF08F9B20AD4E6ECF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366345, "uuid": "cea0d765-6043-4c67-aa47-21f61364c44c", "value": "196608:UMKEKj0d1afXzEOIgP/BDzyjLWrK8j6fYBRnCL:UMKEKj0d1afXzEOIgP/BDzyjLWbj6fYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770366345, "uuid": "aca70c13-6655-4f9d-9c44-3f0d251072ac", "value": 7864499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770366345, "uuid": "76baafe2-9bf2-4da0-b2ec-5dbfa8037867", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366345, "uuid": "20c3133e-b104-470d-81d5-783264f63914", "value": "linux_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f937922-0335-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770366319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366319, "uuid": "f2535ae7-634f-47cb-9d7e-68636c1b38b8", "comment": "Malware payload (Gafgyt)", "value": "079f4ed2c15db7156e5e6f7468e95327", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366319, "uuid": "82238696-634f-4995-a255-12cf1bf3a106", "comment": "Malware payload (Gafgyt)", "value": "1fa1151854b5dc78878b55bab4a533ca6434e9b93c2231ac62773efd79bd104a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366319, "uuid": "7cdec9b8-8628-48f2-95a9-2f83cf5d6404", "comment": "Malware payload (Gafgyt)", "value": "ea53ebc75fcd38db2c0ab54cd8641ca5c7e04d1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366319, "uuid": "dee2856b-f21b-4cce-9d65-0526b44c1354", "comment": "Malware payload (Gafgyt)", "value": "973c28dea60078d77e7be3e6e904836360a8ad3a7e69f2b64b963d574d89d976898d84ae2d52ab78f75add91be55ec88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366319, "uuid": "be9a362c-387c-4e49-ad96-35d6e5ce120a", "value": "T199762AD7B9924842C4E43777A8FE80C472631EBA9B8612576D06FE3C3ABE1D91E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366319, "uuid": "89cd2c82-ab50-4f4e-b8cc-c100dcccef0c", "value": "49152:mjeb9BoJxCKk+P7yULH/BAAZW99FkycOommlqLjlV+NFw2HtUfANd+rrVZ5EV:EeZBi7yo6N2Htxir5EV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770366319, "uuid": "615990f5-ddc3-46ba-9222-499159a59d2f", "value": 7143572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770366319, "uuid": "c9696e8d-519c-4897-aa12-83ec3d1e74c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366319, "uuid": "9743b97c-761d-4f78-aedb-c27916295fe1", "value": "linux_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13371c5c-0364-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770386377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386377, "uuid": "de4448c6-c4d0-422f-85b0-e5eea5135c93", "comment": "Malware payload (Gafgyt)", "value": "3361a0e475502afa8b87d1a542306a3e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386377, "uuid": "606d6917-6085-4acf-be9c-f9aa8adf81fa", "comment": "Malware payload (Gafgyt)", "value": "206ed1f6b61827f4c3ad3eba9ff59579f1b4d71f838ba532a8f222a913a5d1f5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386377, "uuid": "43382590-512a-47c2-9bf7-5f993b305cce", "comment": "Malware payload (Gafgyt)", "value": "378b8a6de9d24f9d8e00c2adbc4c2af3d4119ba8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386377, "uuid": "d15903ea-e75b-4435-a0ec-b9a50b00c698", "comment": "Malware payload (Gafgyt)", "value": "40407d7aaf20bec77b26c7087ce14081885f30b4d1e615f30c5928927285e56454ade23366905f9cc51afba5b624bcad", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386377, "uuid": "2c187dc5-d2a5-40ac-a5a9-8a5fd4711f96", "value": "T1342145DA11B6C5B42CA2EF5771B9874530C0A2A630E79F14ECEC38ED408CD187061EA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386377, "uuid": "d4ef77ff-42c2-426b-be55-7b9ba56ca86a", "value": "24:v0Bchf0BohuYJ0bSms08nL0aFbWCJ0V20I5L0wNIlT:vychfyohuKyS3hnLtb1JS2H5LMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386377, "uuid": "afc947d9-6b6f-434b-9037-a103a4e82518", "value": 1152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386377, "uuid": "0ec757f1-b575-4408-9116-74b344e9bcce", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386377, "uuid": "2fcc6743-4c84-4638-b085-6a7c7c057285", "value": "skid.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcdfadeb-038e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770404755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770404755, "uuid": "ae779c1c-8a93-4109-995f-fc3aa6a06e7a", "comment": "Malware payload", "value": "ecb4626307dcf6dfb724603fa3efbd1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770404755, "uuid": "addf1655-a28d-45ce-bb22-cc99491a5336", "comment": "Malware payload", "value": "20fc906d1e988f4cf7b34a2c5d71254c50896ef41b8f9a7f0b6f1ed9b3faa368", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770404755, "uuid": "0f554413-b451-40f1-b060-3e59a4c5750c", "comment": "Malware payload", "value": "d0abac54d649dae6d3f13cdc7b8895eccfc97a52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770404755, "uuid": "3ec2a545-efe0-44cf-8aa3-bbc23bfe066e", "comment": "Malware payload", "value": "31a523da76c2bbf4708c047c9a870172393ca94e899dc5f1bea42ff33671647d86387cc059c950745f063849dae44005", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770404755, "uuid": "4941dcbf-8e17-4d0b-8363-d2f6a659253c", "value": "T19CA4F80BB2918E71D2548732C1DE480057EA9A8667EBEB0F395613D93D033EEDE06B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770404755, "uuid": "54de9d47-e4a5-418f-8abe-d41d40f13582", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770404755, "uuid": "bc48a651-fb1f-45f1-b343-c867b9f3a6a5", "value": "6144:vfu9GZUAa4JnePN8fDWaQIrDRwiMs6LwPxt/XhLnZ:v29GZUAHJe0ipc9nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770404755, "uuid": "24cf7028-dae3-402b-8ba4-ad5fb0a5d1af", "value": 490832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770404755, "uuid": "b7ffa114-1eda-4b64-8153-b7ac0acf1584", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770404755, "uuid": "a7e7180c-7454-4afc-a6b9-dd5b55b41c8d", "value": "fst2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09e11ecc-0364-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770386362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386362, "uuid": "73296088-daf3-444f-a770-825aa94b46f3", "comment": "Malware payload", "value": "527c337e35611b2531b9a84c0c3e9b67", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386362, "uuid": "3791802e-6fa1-4e0d-a616-f6af0628a73c", "comment": "Malware payload", "value": "2214ba34f6d555a27120bb117053ad4615cc9939d97ea11b23e3427ee35581bb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386362, "uuid": "c2252514-ef0f-4f23-8c31-f9694ed9be12", "comment": "Malware payload", "value": "0fb29978a317b285157c6b2e503815c1129b9951", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386362, "uuid": "20ba2f5d-c7af-4e58-9113-d1d7fd02ccdc", "comment": "Malware payload", "value": "4ee6d369241175a2f715ef0b9a85e3917e4587583f440035f9d43707909f68c869a341f7ee886aff567a9175e4eefdeb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386362, "uuid": "9b8a89bd-57c2-460d-9d20-c802b97465fa", "value": "T16F5150AA2110C7B19604E64EF7F1313C9607E0E39EEE8605ADB01C5C2ED5DCC27C6A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386362, "uuid": "f99e51b7-e95e-417e-8858-6a0b3d19000f", "value": "24:eP2JMaQbiBKpuZFEuEnE2EhEAqAbwZSJUfVChM3s:eP2JMaQbiBKpuZFFcvymAbwFChM3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386362, "uuid": "93455b4c-d11b-4760-9f7f-a77765238a7c", "value": 3063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386362, "uuid": "b63e5c43-cfca-4a58-a69f-79ea2a1dd167", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386362, "uuid": "9cb819dc-1538-403b-b554-c8e906d1bd02", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7088c03e-03af-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770418746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770418746, "uuid": "8826fa56-bb1b-4aae-953e-52e639213121", "comment": "Malware payload", "value": "a20e887f5f353a44b2054415fa9d5985", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TGR-STA-1030", "colour": "#BFB2E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770418746, "uuid": "7860a79e-d423-488d-9431-272d12365e08", "comment": "Malware payload", "value": "23ee251df3f9c46661b33061035e9f6291894ebe070497ff9365d6ef2966f7fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TGR-STA-1030", "colour": "#BFB2E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770418746, "uuid": "1a90007f-1a85-473b-be16-6f0f1c2e98f5", "comment": "Malware payload", "value": "8fff81911ae6900a6170014f3fb337a9f6763f62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TGR-STA-1030", "colour": "#BFB2E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770418746, "uuid": "f58eb2e6-9495-475e-a5c1-131c1582aeb2", "comment": "Malware payload", "value": "703565d04646a828556be9dbfdf4160de1f8beceb46c19e80d44877897304cbba80486eecd8249213e0519c91125ed9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TGR-STA-1030", "colour": "#BFB2E4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770418746, "uuid": "a2d926a5-816d-40bd-809b-c0bc5cf31f65", "value": "T102E37D5BB3E434FDD5B78239C4A14605E772B8720661DBAF03A881691F237D09D3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770418746, "uuid": "f96570a3-46dd-4f0e-ba6a-79f17c09d3f7", "value": "854e2b63200cb1f1fd77532cbea7f503", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770418746, "uuid": "4aa60243-f19a-4976-8659-a2b807972e2f", "value": "1536:kCFBR2Lbd53PnoC0NFpumYYyEkSgdP3pjAqYCsWPdd09dljRb+VwCSu4:H2LD3foTjpOYbkLdP3dADA3Mn+Vd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770418746, "uuid": "1c5fca89-c32a-4d75-8e42-9e3393f4ee09", "value": 148200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770418746, "uuid": "34b47c33-f17a-41d6-8074-ac86bfc2d664", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770418746, "uuid": "b4c84fd7-417d-4aa7-b24e-2bcf63269838", "value": "DiaoYu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db0efe65-0343-11f1-a129-42010a9c0007", "comment": "Malware payload (Fuery)", "timestamp": 1770372539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770372539, "uuid": "99b7dbc8-7976-4877-81ab-e7c1e115dd6d", "comment": "Malware payload (Fuery)", "value": "9008184aa4d525168dcb65a938645bb5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770372539, "uuid": "09b5397d-b655-46e5-94a6-ff82c5e84508", "comment": "Malware payload (Fuery)", "value": "24b68cc56ca49a71fe5b439d0c765afe01552472c3793562519984803e8d1db7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770372539, "uuid": "078fbc91-f112-47b5-94d7-152dffc35c17", "comment": "Malware payload (Fuery)", "value": "737dc9393e89992059d0b6dca0f9fcf974145466", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770372539, "uuid": "2a6addbd-c3dc-45b7-b053-58355831969d", "comment": "Malware payload (Fuery)", "value": "f44953cdb97b15366130b56b227939c37dd1d93aec10211ff847721a093034880118c063e65f86369bd99696a1df8068", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770372539, "uuid": "8ee7ffe6-c16c-429f-837b-b48f1c46ab9e", "value": "T1EA15120E7B59B951CA0C4EB38403508C81F5DA6BF063F66E49DA4DF72CA3E58E84B593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770372539, "uuid": "5d8e7bf0-f3ef-43d4-870b-9849dcbae9b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770372539, "uuid": "a14dbeba-5455-41a2-bbb0-7aec6965e41b", "value": "12288:6WzSKev3aGuMRFp0/1ep/G3snDfdLpISdQpCMj1iDt7He0iOIpYIqwEcGFasxR9X:61/F01e6irdVhOni9+0iOIaIW9A/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770372539, "uuid": "7aa915c7-f659-4752-b0ea-fe42224a329a", "value": 956416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770372539, "uuid": "1f94560a-a24b-40f0-9f30-758bad2bb91e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770372539, "uuid": "a6a1b3e9-212d-4142-ae76-eeb723320dfd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd2e0d6-035c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770383281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770383281, "uuid": "066885e9-cbdd-4229-882b-cce142f2d72d", "comment": "Malware payload (Mirai)", "value": "8939e31dc576c898d941b14e4592be7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770383281, "uuid": "c2bfc2f0-b87a-4407-a876-f713b7de9386", "comment": "Malware payload (Mirai)", "value": "2577146d5291c674dad1c9eac1025d721b468b63614e2c2fad89a950aa2c3b53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770383281, "uuid": "64477bcf-0d52-423a-a1c1-d2a54301f8d5", "comment": "Malware payload (Mirai)", "value": "23f184e8a4cf0985e149fe78f8858e9c9795b6b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770383281, "uuid": "9509710e-78ab-4d24-ad96-e0f51606d891", "comment": "Malware payload (Mirai)", "value": "1992ea8920889df250b05684c7ed7ceeb470dfb7e710229428fe45920ab9e519249cf14e46aef637c0484e8e1009cf6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770383281, "uuid": "d1097910-40a1-479a-aa49-8bc8994ffc25", "value": "T11353498AE68BD5F0CD4A05B0157FFB3DCA36A8303234CEA7D7C4BA57A9E3642A05115C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770383281, "uuid": "e2b83f46-2115-493b-861b-789e38b16893", "value": "768:CohndpoMMRfCfRlXDvsa5PwNXxIKBsCt/+wQugNSXwG/d/tSyMgfFkIb1PcLtup2:CvtCfjp5PCXxKuttS+fduLMp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770383281, "uuid": "3ceb8c00-78cd-4821-9e50-3d9c6838c709", "value": 63860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770383281, "uuid": "b7f13fe1-3068-45dc-a735-ea0a0c5a526b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770383281, "uuid": "1bc028c0-a546-476c-93f7-f1e08bc972f2", "value": "mao.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37737739-0386-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770401041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401041, "uuid": "99aed62c-752c-42f3-b937-d251ae3ea7d4", "comment": "Malware payload (Gafgyt)", "value": "785548c4ffb26d6d28c41da8c87358e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401041, "uuid": "5cbad2ad-c4f3-47f2-8070-624f6ca9acc9", "comment": "Malware payload (Gafgyt)", "value": "25d1bf916e49bc1907c909e28366741760f7ec6a733345742333d03614245ba9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401041, "uuid": "712fd3d5-e4d3-433d-ab26-38a5a7fa0449", "comment": "Malware payload (Gafgyt)", "value": "75985d8051bf3195db7a2d4c07d9af373199009d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401041, "uuid": "1bc80ed8-3a16-42a6-8784-52836c17a673", "comment": "Malware payload (Gafgyt)", "value": "de3aee4d96370f7ddb7aec10596b416eb72e714890631121f0af6a6124f15e89fd344ce7e5cd1b45704b8fb007838a1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401041, "uuid": "fdfaa106-bebc-41ef-96cd-cc8d9764dca3", "value": "T10C933B0348615FB3C0456DB126FB59340B67BE260F4F1E9A752CAAF4474B8CEB41EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401041, "uuid": "04d00443-41e5-4d36-9b83-746ce2c10b5d", "value": "1536:vghck8XcYT8z7XKDbTD1hulgkn2JxZ3CU5h8OWI6MaRMnhR090jUeQfXm:quqvaDnulgT3V5h8OvYMhR090QeQfXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770401041, "uuid": "0d1fdb39-15b4-4e3d-86c8-c95dabda9c3a", "value": 95921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770401041, "uuid": "7d2fbbb8-5d88-4ee4-a28f-1b514425a61d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401041, "uuid": "cb384043-eb71-4882-b215-bd6074182dab", "value": "yakuza.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60505b1b-0337-11f1-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1770367179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770367179, "uuid": "8e0e71d2-3f77-4880-867a-1b3d1ce93dd2", "comment": "Malware payload (DonutLoader)", "value": "1bccbbf61207fea7629eba7e762dfc68", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770367179, "uuid": "ef15f50b-1e36-47e9-94fd-94a93b191e0d", "comment": "Malware payload (DonutLoader)", "value": "26ddeea6d5171984cd054b33cab67970716611064972b44ed7297703d0848df1", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770367179, "uuid": "edb0b897-c544-456a-a0bc-a09bb136b103", "comment": "Malware payload (DonutLoader)", "value": "7d21d241d327aae9341d38b44a5e41259163a93a", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770367179, "uuid": "df296ed0-607b-49ba-b8c2-a0e36eb12e47", "comment": "Malware payload (DonutLoader)", "value": "24ffec4cd9876af7aaf5c59fdd70357d4b0490967f96d6d777213fcccc4e9bb3e5f0fce14df20bd732ec04020843a634", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770367179, "uuid": "9c4481de-433a-4db7-a441-5f66c5835171", "value": "T1AB47338302504DAEEF384E3ED153119C6A317D3BA602211BBFE5BA11BD6250AF67FD61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770367179, "uuid": "b8137ecd-2952-4065-aaa4-842f40b7cda1", "value": "d221b1dc8c3a08622f6512e7876527c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770367179, "uuid": "6e7c234a-69d0-4a8e-be36-41b687688e36", "value": "786432:ybHpjizEMjDcB0izBfrTcrZ3hEaQ+/u2sQao5AS:Upjizzs0izBfr4r1GysfoCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770367179, "uuid": "b0e84df7-8f7b-42e9-bad8-183af1b385bd", "value": 26221572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770367179, "uuid": "918d6b4b-eb1a-4527-b898-c9b3444feef6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770367179, "uuid": "1fcaf69b-5aa8-4555-856f-ef3c29120f9c", "value": "cherome.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4fe41f-0386-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770401046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401046, "uuid": "a086b9a2-ea9c-439a-9fb2-0dc45175644f", "comment": "Malware payload (Mirai)", "value": "5dc4bd41e5d2eda16e1b1b0fb9d79a67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401046, "uuid": "46638054-7675-4bc0-8061-cae9b210b12c", "comment": "Malware payload (Mirai)", "value": "27b8c721c1d3ea2d7554bb42c6ce55498cace81cda175268dca354aa5ddf047e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401046, "uuid": "013452a3-bc11-46b5-8abd-ef8e3e10e379", "comment": "Malware payload (Mirai)", "value": "06832447a7a0b226b709296d9835198592bf9edf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401046, "uuid": "c2a43cf9-39d7-4dc7-b3b5-ce2791a130da", "comment": "Malware payload (Mirai)", "value": "3b82336ae925680684ff084a631599fa1d1f92d764f1c7359d860c80fe541292c205fb0b7f6c6a276dd409af2b0f495d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401046, "uuid": "89423175-39ff-475a-85aa-e8c57a1def5d", "value": "T15EF34A17B4C084FDC49AC1745FABB136D972F12D5238B15B27C8AE262E4EE305F2D684", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401046, "uuid": "4ee2cd69-676c-456b-868c-7f03a161403b", "value": "3072:+ARNmPDA6l7Xj1nIVGyBCc7Z8O7eu2yqcEDyD7DKUlgvePaUjOdlsS:NRNmPDAu7Xj1nIVGy8cYu2yQq36eMnsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770401046, "uuid": "bc39c292-a556-458b-9a6f-5e06715da770", "value": 157464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770401046, "uuid": "516024c4-ba45-4817-a66f-f7c74ec162db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401046, "uuid": "94ce19db-86b5-4304-88b9-6deb16b88724", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7733d12-0390-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770405524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770405524, "uuid": "d789975a-1e0b-4ba8-8eee-cf4ef2159bf0", "comment": "Malware payload", "value": "98262b36c79756e665bcc1a27d1aa066", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770405524, "uuid": "40e1dbe1-166c-48fe-a0ca-8e0818870f2c", "comment": "Malware payload", "value": "28e24f39b6a409fa52f95f9e4aa80c81efa41650707c51819fc4e1968cd82bd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770405524, "uuid": "d95aca83-042b-41fc-b765-aaa4a27dc873", "comment": "Malware payload", "value": "f027462aca0456e96c5620dcbcace73771a15720", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770405524, "uuid": "a11d4b2e-c24c-44de-adf9-df11d2542593", "comment": "Malware payload", "value": "6d7518b88e29cda6ec8869036871c7ec974c3d551c217934d143f949aab4414343f21af0310635088a7206c2365ce8a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770405524, "uuid": "060b81f8-8f98-4435-ac7e-ab0062a96d02", "value": "T16AC41A7EAC14E327F60CA0BEE287D3534F6578110236BA931CBA972411495739B877EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770405524, "uuid": "4faa5958-60ad-4a62-986a-1335b9ea6d71", "value": "bcf81c3e3a1fe52e7b4dee3f058bfdd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770405524, "uuid": "4b6ed779-bf82-44a5-98a2-c46f9cfc8907", "value": "12288:fcVR9cLXtGJKYvFSPXLI6zavBjR2+Q40S:fcVR9lKocLISavBjR/2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770405524, "uuid": "9d863649-3e72-4e3f-8417-b0ca91af92ba", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770405524, "uuid": "2e5e872b-11d4-4c5e-b955-0b27cd3472f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770405524, "uuid": "de7b32e5-e99f-40cf-a387-5cb743eb1a81", "value": "build_69862cc692c37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3faa46fc-0339-11f1-a129-42010a9c0007", "comment": "Malware payload (FantasyHub)", "timestamp": 1770367984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770367984, "uuid": "cf753052-3196-4fcd-9a0e-b3b257ac9f5e", "comment": "Malware payload (FantasyHub)", "value": "00d9cf98baa6178949969d3471691dd4", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770367984, "uuid": "150c3818-24c5-4cbc-b53e-57334d7dcfe0", "comment": "Malware payload (FantasyHub)", "value": "2a5f808f305334a0cfec1daa7290ace649079ab9c6dbed43f77ffdccb55c6e31", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770367984, "uuid": "789d0019-48a3-40b6-ad24-610a7425cc5e", "comment": "Malware payload (FantasyHub)", "value": "f702f56ebcb68301508084a6045925b34c49c274", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770367984, "uuid": "a34f03e6-7d05-41aa-bcc9-fdedf83ef766", "comment": "Malware payload (FantasyHub)", "value": "73f63cc3aa560a5c1fb665ddff61aa768bdf297fca6777cdd5a22544201ac696e574b717ee2e2eac6bd3ef91cf2f271a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770367984, "uuid": "5263086e-5c1b-4592-8636-e08617d4a934", "value": "T181963396F729A52ED97B41710A8A473223669E09CEE7D307A1543B2C783B3C98F44FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770367984, "uuid": "d94cfb5b-21bb-4ee6-bd09-04829c859998", "value": "196608:64jSh1dNhS9hLoukJaWL7+RkS4/UwzG2iNmKr:9M1dNhS9h8b777SiiEKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770367984, "uuid": "6f7734d8-3a4f-4ef7-b173-f4cea7f9efeb", "value": 8633097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770367984, "uuid": "f53ef5c9-5856-459b-a7ae-64825bc82863", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770367984, "uuid": "e8321ace-605b-4961-a8c9-9eb1ff009bad", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18cfd19d-0351-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770378226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770378226, "uuid": "cb71904d-7cde-4f49-a5a7-9ec45d81e6e9", "comment": "Malware payload (Formbook)", "value": "d3d9958028d3890264c6738189000d75", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770378226, "uuid": "62e08a6b-9bcf-43b7-9e11-f23198c9cfd5", "comment": "Malware payload (Formbook)", "value": "2ae88c6c45b699f6a0b3095d1384c62e88e183006d1db844c58f01c1215d789d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770378226, "uuid": "3effd0cc-3128-42e3-862e-7b414d799fee", "comment": "Malware payload (Formbook)", "value": "3429527b70e11a2c9ae0597f6fed3712a8361659", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770378226, "uuid": "7e32caa0-e3c3-475b-a967-136cfa91351a", "comment": "Malware payload (Formbook)", "value": "426394c99f10bf9862350e1a10c91de07c981ff7aaba7cf9e0092377b069fb67e9a7b303813e9709dfab16efcd5d4e78", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770378226, "uuid": "293ca310-6c78-409c-8a50-269a89258021", "value": "T1BCF4334D49E5E9F9221B41C2F2EFFE5E6AE412D8EE599768111E0F203EA5FD0D04C8B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770378226, "uuid": "d7adffc2-5966-4ee3-84da-b035768925db", "value": "12288:U0kWdZcodQfVPBL75c9GkQbKpAY5ggCjwFcUO1iN3hqyPDCRtcimUKjDAd:UydSUQf7L7+wkjpn5ggepYHCfci7KjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770378226, "uuid": "2c5dc521-4797-42ba-a876-b5a25d46ccf5", "value": 727265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770378226, "uuid": "387c749c-4b80-44b4-892e-f21ca863a988", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770378226, "uuid": "c7ef460b-014e-46c8-b5f8-e99b6c35262f", "value": "PI Confirmation_xlsx.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c48c3ab7-0363-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770386245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386245, "uuid": "3a9a25dc-17f6-4df4-8686-e50150f015ec", "comment": "Malware payload (Gafgyt)", "value": "d54ec5de04fb548de381ec080f70cc9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386245, "uuid": "4967846d-e5c4-4ba8-9146-c51137fadd3c", "comment": "Malware payload (Gafgyt)", "value": "2b04ce9a9dbbd083bfbfd62d282eb9b8563854f1492d29b23b6ed5d4e2bef654", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386245, "uuid": "9df27632-514d-4602-bd56-345f42902123", "comment": "Malware payload (Gafgyt)", "value": "d906c85b72c39af256c804b47bb134b8b40a86e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386245, "uuid": "7264fe0d-06f9-4d63-95da-2d6f8facb91b", "comment": "Malware payload (Gafgyt)", "value": "61b57f2f685b2f1aec978c1b96123f3c4ca84267c84e49f5bef3cc5498fb94048a0a45cbb51a267debd1665c80796730", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386245, "uuid": "7a0ef713-f472-424e-a62d-2963e532cc68", "value": "T1F2C33B06F5514B53C1C3177AB79F521977232BB897CB33229A24BFB42BC179A0E3A950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386245, "uuid": "8c77bd0e-e502-49da-b1a1-290df79d38a9", "value": "3072:Yd5adFfNQamBJl1OQ5hudKRvF2/bBbmOQUJ1UXpTn:E5adFf4OQ5hudK9FabBbmOQUJ1apTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386245, "uuid": "91d0692b-7d41-4156-af57-b4bc33c0b403", "value": 118812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386245, "uuid": "2ebc07b7-1b23-4b24-8607-c02e4ffd7bd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386245, "uuid": "ebc4aa48-c977-4711-86f9-eff6f7dc9db4", "value": "skid.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b7b1ab7-0335-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770366339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366339, "uuid": "d209f0ad-dfcc-4dcd-ad78-7c21ddcb9cad", "comment": "Malware payload", "value": "d67d6c6a1aff159fdecc34301f37cbff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366339, "uuid": "5f22d429-d64d-4d54-8b03-7c9223591ab5", "comment": "Malware payload", "value": "2cbb6e278e9e92642e2fa2e2c0d191571e10cdd38a2a303cc7bc21448dd03927", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366339, "uuid": "b543b60e-8d99-4ed6-859f-d61f309aa3f9", "comment": "Malware payload", "value": "fd31a4451dae51ce8b71a63db59e972125566ea6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366339, "uuid": "849549bc-b5c9-413f-a246-19a38b31bebc", "comment": "Malware payload", "value": "ddd029741089e497d2eb4e6823fdb052030f3a153d3b04c36688e424a0e2e10e5ccb9a4a237245fef803a0cbf4fce72f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366339, "uuid": "59eac0f7-ba58-45fc-b2d0-5937b3745c50", "value": "T1888629D27F98EE9FD29433354EA6C23873E53D00C1B010379616FB192EBA2A49957DD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366339, "uuid": "3ba6bb24-fc30-4103-8f58-804e93953484", "value": "49152:Dp8hs8vDlxbwhm2Wr3LQt7VGg0EcKE5r7KAnosrlYHnYZSaQnEtBANHHP5EQ:Dp8hxKp7VGrmWztBANnBEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770366339, "uuid": "89d274b1-315a-4872-b739-cee66682dca7", "value": 7864468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770366339, "uuid": "a3eefc7d-8dea-45a0-a8cc-d15f9ad423e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366339, "uuid": "356dd5b6-b716-4d0b-8ff3-f6b80efd3027", "value": "linux_mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f70bb654-0327-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770360560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770360560, "uuid": "47ed444c-e497-4ca3-82c3-90eff835e187", "comment": "Malware payload (Mirai)", "value": "c88afe6fafa3dacf2d09b3bb2fb7f752", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770360560, "uuid": "1a0792a0-37a0-4ef8-83c6-19c468f76395", "comment": "Malware payload (Mirai)", "value": "2eb8c17d21eb60f6994990f5a870dde9d55369ba76dd409f469cf96ddbfd2b03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770360560, "uuid": "30c90cc9-3d8e-4316-80e1-a539ad2f4c76", "comment": "Malware payload (Mirai)", "value": "9d91129952bab1e147be2852fabe0988fd6b7d20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770360560, "uuid": "5fe4f101-193b-44ff-b419-6c2734aba81a", "comment": "Malware payload (Mirai)", "value": "91aa89c437b2dd67ccb7f56aa60d4fe88781df727bbbf8053aa6e8f72a9585d9c4d89f43058d3fec5c40b5a56308c16a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770360560, "uuid": "d5c58998-55f4-4a17-8b45-71030f9966da", "value": "T19C838B23C93A1EA8D84844B0B0B48F755B63E115C5672EFB599AC63AD483EDCF2463F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770360560, "uuid": "22309cdb-68a1-4846-8fdf-9d4fb27b5bca", "value": "1536:4PDsxy8Hs0EaUCNhboKZvqYd+PRCaWCNn7Hyw:4rsx1EdO1PZL+PR79D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770360560, "uuid": "5c8e463b-b4f1-4384-bfd9-365f70ae6a1d", "value": 83812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770360560, "uuid": "36cd85da-09aa-4fa7-8f38-14ff1daf7ea5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770360560, "uuid": "043f38cf-92c4-48a9-af5a-70cfd50a58d6", "value": "titanjr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060d459e-0315-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770352425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352425, "uuid": "5e489b73-2d83-492e-856c-500571ae820b", "comment": "Malware payload (Mirai)", "value": "5248ebf83ac376fa07a4ec082909e060", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352425, "uuid": "ee9ac3f8-5741-46fb-b3b5-5301a7a579be", "comment": "Malware payload (Mirai)", "value": "30fc234d3430e2bdd8d738dd12e5759822bfe4c2d0830be5eb91302478d27afe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352425, "uuid": "e134c1da-e481-4bb4-8d61-2e44528ab655", "comment": "Malware payload (Mirai)", "value": "cb2187655ab42bbcd8dbf0c83bdedcf57bcc0e4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352425, "uuid": "04b1b226-cf74-4c5b-b032-88d95f3508f3", "comment": "Malware payload (Mirai)", "value": "b776b3478c7e43cc509a39fff12bce506734d7b182420339d4e3635376ff054bc07ee6cb26228832c30dc8c9e458a909", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770352425, "uuid": "6f6bca8d-9537-4e61-a873-f040d7a6719e", "value": "T12BB30946EB408B13C4D51779B6AF42453322EB55A3DB73068918AFB43F867AF0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770352425, "uuid": "26502caf-b026-4646-9538-d1d61e097828", "value": "3072:r7st1KSBgE3Q3ihXXrPlGIhX26iM/9E5m:r7st9BHg3ihXXLljX2PM/9E5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770352425, "uuid": "744c74e2-261b-4957-805e-399c17b81bc0", "value": 114187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770352425, "uuid": "3a69e29f-e36e-4d5c-a4c8-2cd202f5a5ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770352425, "uuid": "72246a74-867c-47c6-b40f-29d223472bda", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72238141-0346-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770373652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373652, "uuid": "9cba43b7-d12d-477b-9fe9-cc6cf8cdb6fa", "comment": "Malware payload (Mirai)", "value": "fe9218b2afab262baf1e57da5440c92c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373652, "uuid": "e565b903-94eb-4314-8089-0380285f1702", "comment": "Malware payload (Mirai)", "value": "314876980e8c2785963dbe9e1a34464e4b9e4a0898461a69d879363fa838b27d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373652, "uuid": "c9599f1f-0510-4fed-825e-6e9d5ea37c33", "comment": "Malware payload (Mirai)", "value": "4271f9995953a7a831418d5e9358c961d80fd24d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373652, "uuid": "541251c6-3ae9-43ea-bf6e-894ce83670dd", "comment": "Malware payload (Mirai)", "value": "cc3039964857fce76016e7a93cb5ab469d61b64900ff9feb30f8267ad90e9b0fd682850c5de809d673c0938f17258103", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770373652, "uuid": "c0f25869-d5d5-4987-a512-5d3ed18305ac", "value": "T143F3E198F890EF72C5D9127AE71A054D735307B8E2E9320698259F3033E7A1B4E3BD56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770373652, "uuid": "0e7af558-b26d-4596-94c2-8ca1b189af05", "value": "3072:rponhnSMawdDVH5lcZ6lP28cjW5MXhaIp+7DyA5St3X1ZsAB:rUhSjwxVZl44emMx1qY3DB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770373652, "uuid": "fc1125f9-e234-489a-9ba5-4b2597b82484", "value": 163992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770373652, "uuid": "24bec8bb-4171-4ef3-a4c8-d3504fa37f8f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770373652, "uuid": "4631ebda-ff4b-421f-8fe3-b7716db70e61", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5fcacb2-0335-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770366518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366518, "uuid": "4da85026-3401-4a1b-8d99-d44b7cbfda4e", "comment": "Malware payload (CoinMiner)", "value": "85697272c9b647984a2f90b8ecbfc401", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366518, "uuid": "46b3a271-0ed5-4e64-a944-eb4e3a25c1f7", "comment": "Malware payload (CoinMiner)", "value": "31dd07a9e3c84d5d139e41bba7a39fe449de128bdf7498062fb3d21f3d121fb5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366518, "uuid": "29936057-8426-4a14-84c8-08ac16aca019", "comment": "Malware payload (CoinMiner)", "value": "177e45612083a09bcc858e7145b55e6defc4c161", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366518, "uuid": "4232e272-42da-49b0-85ea-95c0cc093180", "comment": "Malware payload (CoinMiner)", "value": "5628994f75934ec37f4ef3adcafe5ae7823775981a5ee31326f8fb5afb5653487bf0ee7842636fb0ae5bee08fa65df56", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366518, "uuid": "ea90646c-5bd5-425e-b357-a1459488edaa", "value": "T111F73370AA101F57EDFBFC3030E99A968E8B41B671261A13C310FB552DFA94B0DA1D76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366518, "uuid": "14963140-10a1-4c8d-b286-0a9b357ba77b", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366518, "uuid": "b6be58e4-97e1-44fb-ad38-353e1c7d1355", "value": "1572864:Bwh+qp/lz3oOEb5FsZRIEx4Hw0jOb3JAoo65TCKUe7ekPujkg/FfvZj:B0p/lUOuFiCWmo35TCvemz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770366518, "uuid": "d81a7233-7310-4760-989c-4fdf45461ab5", "value": 70244864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770366518, "uuid": "1a077bc0-11a2-47ee-8dcd-eba2a31921a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366518, "uuid": "3e297c62-c04b-4be1-8200-281d9cc923f2", "value": "dreamywarev3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a59170-0364-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770386460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386460, "uuid": "78c0be0e-0111-4501-84b3-41a2b8ffba1f", "comment": "Malware payload (Mirai)", "value": "feea781aef2ac92e722a07280b86ea5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386460, "uuid": "ec3e0981-e123-4104-bf24-716dab8a9d30", "comment": "Malware payload (Mirai)", "value": "32696dc94df7f7be42cf5cf4628c8e1173ec6a701c4947965aa0594cce826a51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386460, "uuid": "da39b495-98be-4de2-a3ce-4f61586e98b1", "comment": "Malware payload (Mirai)", "value": "04811795b29ff23333d10791ad17e1abaf5a54af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386460, "uuid": "ab96ec3f-d229-4204-8e75-d1eaf7f6331d", "comment": "Malware payload (Mirai)", "value": "29841216bd4944867447ca4e7beba653d9ab776746c6b3ffe988cbd7fd86a0eb09a219ce0bf94756e063b46164cfc66f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386460, "uuid": "019ffa47-c8b1-4cd9-a8d4-74d1dc01f2b3", "value": "T1FCC35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386460, "uuid": "8c031386-44b0-40bc-bbf4-f1c6d5703d77", "value": "3072:36tJsoRNjmj1VGCLUZMIV9Sr+QVrxZNiogw:VoRNjmj1VGc3rRioX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386460, "uuid": "d98f7a66-f670-4198-9d9a-316a1404cb57", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386460, "uuid": "c9cb79f8-75fd-4bcb-947b-a623bdd90d27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386460, "uuid": "a131dde5-1162-4093-8972-6a67f274d254", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e517c3d-0352-11f1-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1770378719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770378719, "uuid": "9def7c17-fdfa-45bd-ab47-1318b7dc0fd2", "comment": "Malware payload (NetSupport)", "value": "8039ad684d74037481b7b2a1d16380bb", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770378719, "uuid": "d685456d-45b6-44ce-a2c9-4561cbd8167d", "comment": "Malware payload (NetSupport)", "value": "33c76a863943e86e970a5fab99f28cfb5abc2b00a781fd8517f0d6e8124587e6", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770378719, "uuid": "adf20253-aa9c-4df6-8c97-9ffa33e4c8fa", "comment": "Malware payload (NetSupport)", "value": "0149abf53f329edff7a60f5d7222f7733ad1f058", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770378719, "uuid": "efcf5e4d-8128-42ac-aa28-47e70d608548", "comment": "Malware payload (NetSupport)", "value": "4ce8bce0240e42fc3034a952db0fa97c0accc6560c5702f6d21ece504cd297510437df52f9d54cd8eb11c891fbe5e68d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770378719, "uuid": "096ae933-4fd8-4f22-b25a-1d6b8eaaf541", "value": "T14A52CF08D9A8A5DBF48E27B20CF6B68389C604E979DF480B9795CE7D7779E703342580", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770378719, "uuid": "cf50cc7f-6239-4c4d-bc05-9250757d190a", "value": "192:+WriwpNU0g92R9vXRnBQAEmUBRc5MYWdCf1bj146gIYMp3Uk44eQO60McvV8CBQq:cUR9vXk3RcLdgIf3JeQv+8UQfNQqWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770378719, "uuid": "142b9f57-c8b5-4183-a009-22ff34be4535", "value": 13844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770378719, "uuid": "4641ba54-d0da-401a-81cd-c11a46f1f851", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770378719, "uuid": "015cb0a5-66cf-4fd7-b833-a0760cc24bc5", "value": "XavfsizlikUZ.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dded003-032d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770362907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362907, "uuid": "7ed5fd5a-a1a5-482e-88bb-a8d75633391d", "comment": "Malware payload", "value": "797bf36b54b080ee716f35de2157a9d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362907, "uuid": "387829dc-d013-4768-9ed1-209eae68dacd", "comment": "Malware payload", "value": "33e983b61d9ed68c6863bf5a7e81ca1af6a3ec3a48aca87e56d2cf46b23987e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362907, "uuid": "27db306f-14b5-40a0-a744-5b0a22d14e3d", "comment": "Malware payload", "value": "70a928fc6a7fa6069c379bb345ae795481fad3ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362907, "uuid": "7f231991-679e-43ba-bbd7-cc40289f0aa9", "comment": "Malware payload", "value": "972cd947c97b2b8a1f7c5a91742907911602250856b3cb30c3755bfb32a7e26983e7132dd0b9e54d75bd5cfdc5990ae8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362907, "uuid": "066e4bdb-468d-4961-b66c-46e93e639c6c", "value": "T1E6F5337683F25B6BE84BC2B6FF0D842E1F65D2B19280C3B3794A32478110B6D5B56F91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362907, "uuid": "4379eb38-15d3-4529-8013-e9b0e3660e2e", "value": "dc165dbb08d3496b7e9dd836bba17e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362907, "uuid": "a6a22f2b-a0c3-4c0e-b9bb-f32aaca791be", "value": "98304:xft8pg1WaffmzuSHYh+d0/F83t8mZHv3Hh9dUMY:xapPaf4/d0/F2ZHPHhnU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770362907, "uuid": "09d11858-b742-4f79-878b-e493dc3a6a54", "value": 3621644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770362907, "uuid": "f75bf9e8-85b2-4a59-878a-01600c869a46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362907, "uuid": "9cf5fc33-55f5-4ec7-8951-e3049bfde7a5", "value": "SecuriteInfo.com.Win64.MalwareX-gen.66295139", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dea01b6-037f-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770398072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398072, "uuid": "0cac79dc-e478-4574-94ac-ec99abe69fbb", "comment": "Malware payload (Gafgyt)", "value": "14613dae9a528c2dc9cbd4850452a146", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398072, "uuid": "5452cafb-64a2-4680-ac15-5146144cfcf2", "comment": "Malware payload (Gafgyt)", "value": "365cd3282b3432cc647b460b5dc5339f71bf984803273f56f750e3b0f3df5355", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398072, "uuid": "4bc7e205-80fe-4bb3-906d-1bfa9c9b4872", "comment": "Malware payload (Gafgyt)", "value": "d2acaf4922dfa376cdef3c88609d3e4abb9b1e7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398072, "uuid": "498e2852-b4ad-42ce-bc9c-1b635e2fd27a", "comment": "Malware payload (Gafgyt)", "value": "2b1f1f522b368d0ef531e7c6f805aa7286fd72307a49ed6811fa7236b43a72ae6112f040ba1a0ed6870ceacb335ff0bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770398072, "uuid": "62e6f35d-f6e5-4804-8515-9b227295fb66", "value": "T1B8932B86E642CAF3C4430AF5029FAA590732FE2A4E3B8EA6F71D7DF49B115C43215791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770398072, "uuid": "916d4c50-c5f9-435e-917a-9c8d2f16b751", "value": "1536:2XwWc3fJOB/R4twwKWwCwyIZWDq1S3u8A5hhKP4JseWshe0QzUzJYQ2Wk:QcsB/R4tTdwyIZWDq1j35hhKAWUe0QzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770398072, "uuid": "cbef4977-2088-4038-83c8-4f51ee9d7448", "value": 91540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770398072, "uuid": "31294cd8-88f6-43c0-9d6f-daf6caffd772", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770398072, "uuid": "20407919-03b7-402b-94b9-6583088562b5", "value": "yakuza.x32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7531c21-03a3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770413684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770413684, "uuid": "06e55760-3c62-4b6c-9d94-3dc4b21af8ad", "comment": "Malware payload", "value": "ac3e5d89fbc43617c9b216ea660007f4", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770413684, "uuid": "4452032a-ae29-4783-b6c6-ebcfd04fa163", "comment": "Malware payload", "value": "36c1732f328c1d3b4f98adb7109c41421274d298fad5862fd94d6fbb6fc698d9", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770413684, "uuid": "f84fc2ee-d129-4dcd-8cbc-3ca5e78c7eb4", "comment": "Malware payload", "value": "81dc567574c77fe3de1247ff6c1049d8c93f0ad7", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770413684, "uuid": "31852905-045e-418f-8016-efebebe9ccfe", "comment": "Malware payload", "value": "2c6280dddb7423cd791279a9569892ae89cf97e00674bf9746fcc496990735bfe4477b6a38a589e6166482f453ba53a9", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770413684, "uuid": "b813bc37-19af-47cd-8873-419ff894943b", "value": "T1889219E85FDD8EBAC38B547D60DE7AC582AD63558FEC220CA2DD1FE000670AE44ED815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770413684, "uuid": "960bd744-3d7c-4edc-ae60-73308ca2a57e", "value": "384:GpBSp6fV5IcGhTUutklIwY/F6Wi139BuO5Yw5Pc3JpzBkzNaS/RkUd9ThUKB+/gE:GpBd5IcUTelIwY/F6W039Bn5Yw5Pczzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770413684, "uuid": "69254e4b-7490-4fa0-818f-58a120602842", "value": 19487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770413684, "uuid": "41b08755-4156-40a4-bd2d-59325b635e70", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770413684, "uuid": "bcedfc0c-2a2b-4a5f-8d89-f8715d7d0fb9", "value": "SystemConfig.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f15d2cb2-030d-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770349384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770349384, "uuid": "b4812f81-cbec-402c-a127-184bf5c11825", "comment": "Malware payload (Vidar)", "value": "ca2bcef12715ebbf615618c024d6786c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770349384, "uuid": "c82a6562-8aed-46c5-bea6-4f02eadaa680", "comment": "Malware payload (Vidar)", "value": "39253378fa4b06bcab0a3c2ce8b295388ab98c29a2f7478206b80d04606bb481", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770349384, "uuid": "bb731b89-ffb8-4295-8784-f397b013c81d", "comment": "Malware payload (Vidar)", "value": "296491cb6fd7fb49f1eff097dc85a82f8709a573", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770349384, "uuid": "2759ea48-eb94-4fa8-8ade-6c87c4adecf4", "comment": "Malware payload (Vidar)", "value": "7e2bf36953f9147f504399d7c12fe1126c802d24a0d5df5c418e4e9d1af5cec73db929089e110d75676e7441447ca952", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770349384, "uuid": "dd3df711-54f9-4e63-98d3-cfd60feb1e60", "value": "T16E365D87BD0580B8C1EA9030E9257291BB307854073473E7A9D679751EBBBC06EBF768", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770349384, "uuid": "892dffab-f8ec-4ed0-90cf-72adc5614595", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770349384, "uuid": "29efc9a1-4cdb-4bdb-9993-2b619402fd77", "value": "49152:K4v3+d9UQRjXN+XZUTHbkzVvwLZgKeeD5K18:vKRjYyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770349384, "uuid": "b5602aa1-f8ae-4ac3-8f3a-95db724cb772", "value": 5115040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770349384, "uuid": "1dc4e5cc-f5ac-4c85-8538-db9456d49d88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770349384, "uuid": "452d492f-fcda-4f43-a663-476f12316a2e", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cdaa981-02f0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770336572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770336572, "uuid": "b6831ed4-5c69-4859-8d63-201f8a7d1550", "comment": "Malware payload", "value": "6f0b46ae9cebb67befb1032ce65bf32d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770336572, "uuid": "ec8f6ea6-89fe-4c96-a9a7-c80f91909d73", "comment": "Malware payload", "value": "395ab2370e825c13750e45825c38ab59c89148169a6c8d0c97035537d0ae5116", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770336572, "uuid": "69fffc10-00c3-4654-aa08-1ea68fad1abc", "comment": "Malware payload", "value": "f9e5d19010e99e4a0e2ab47c2ec3353a9a00496c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770336572, "uuid": "47a1aa27-b1af-4531-b65c-05dba9d4508b", "comment": "Malware payload", "value": "cd3e1ab4c733c2453cae3f6a6819fe331990c0be9f11da038752bb55ea64792f1b08abd426ca126971be4cf31044a2a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770336572, "uuid": "c8e9967c-1462-4b0c-8b0f-efa7a45f4bd2", "value": "T1ACA43A06EF440FEBC4AFCD30852E875B24DD8D9706D5AA78A1FC899CFB9C1495AC7848", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770336572, "uuid": "3f2d3314-ac38-42f6-9197-36ec6c31a908", "value": "12288:9rjId06FDJQ62CChwRpTbJCQYAGWCtdI/e519V+7TqUviJKz7KXm4E+8pm8qPbR5:Y0roW1r271+kgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770336572, "uuid": "69d17468-d7b6-426b-98c3-7ba7f7238944", "value": 472977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770336572, "uuid": "fbf2ccbb-8faf-48b4-b823-1056c192af09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770336572, "uuid": "dd3f5ebc-2e71-4c14-8263-212888ef6fef", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f05d07e-0371-11f1-a129-42010a9c0007", "comment": "Malware payload (XenoRAT)", "timestamp": 1770392142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770392142, "uuid": "653a9189-9395-4645-936b-03953c241045", "comment": "Malware payload (XenoRAT)", "value": "325acc44ca0d568516af27e1ed385518", "object_relation": "md5", "Tag": [ { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770392142, "uuid": "e987bd69-a53b-4956-b77b-aac1539d7458", "comment": "Malware payload (XenoRAT)", "value": "39be74e0f0541333793e540e862e3dba711e2f6260a6a6130ee6fb6661a6ab75", "object_relation": "sha256", "Tag": [ { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770392142, "uuid": "56dae01b-07f9-4c1c-9006-168e467c90f3", "comment": "Malware payload (XenoRAT)", "value": "38ec586991c2ea563e43521ba5aee41a37fe93c7", "object_relation": "sha1", "Tag": [ { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770392142, "uuid": "788be31a-eed9-4ac4-ab82-105a3dbc6bf1", "comment": "Malware payload (XenoRAT)", "value": "53274596e87de283844291c558a16e21916f311794a95ec93d30b771bdc5edd381c01bb66d7c496e037dcea753a37496", "object_relation": "sha3-384", "Tag": [ { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770392142, "uuid": "7d9b5cd6-eca3-4dce-b8db-e36e8c83d82a", "value": "T16592D02415191BA6ECDE107FF105CA85F0F438AD007AF59BB2A17B474C867A3606A2FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770392142, "uuid": "801328b2-c696-401b-bef1-cf3e40ece8db", "value": "384:qulAmhAW9tg+LzBSEKgbK+4CW9Vk4B09S5jeWZOHsU4jZhBoztQawILu:qYA+1O+L1SE5jQHTdhBQo6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770392142, "uuid": "3b3e4bee-8591-435f-a102-7847176baaef", "value": 20848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770392142, "uuid": "8cce6595-03df-45a9-b8ec-ee123d3abf8a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770392142, "uuid": "7fb3ba96-6d9d-47b2-8f0b-72831e70ec48", "value": "iesetup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9d704f-0360-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770384734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770384734, "uuid": "9574899f-fadc-4fd7-9a7e-579569d5f8da", "comment": "Malware payload (Mirai)", "value": "5991b6c6b8e96e75fdb71ae25b68bc97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770384734, "uuid": "dbdb15c6-9f67-4820-a912-142f809dd45d", "comment": "Malware payload (Mirai)", "value": "3b02eba2fe8307b2c7d3c8821793d10760db9256dd2fc96c9533a56c903decf0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770384734, "uuid": "f5415641-2dae-44a7-8a75-916a1eb97b2c", "comment": "Malware payload (Mirai)", "value": "8a42f0f1451a99bf66af7c6736d33d64b6e68a79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770384734, "uuid": "8adf0609-accd-49d6-8476-cec21a183aed", "comment": "Malware payload (Mirai)", "value": "3ce949fec54fe4012481c719f3d30dade474322a4c7cb55a0f50e49d77c7c4c61ae1f4f01b51092f805e4070c53e21c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770384734, "uuid": "8b6cc505-709e-4c91-8e05-b1b519e36059", "value": "T1C7C3E706BF114FF7D89BDD770AFA0B1529CCB81A26BA67357534EC68B10A1CA16D3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770384734, "uuid": "b4328168-8213-40ae-ad21-7138914da1a4", "value": "1536:dlO3hgth2HDzXRVZ5KKlyCBB8bvq3V5oyY8gFZuRNtUtNSamXX7jVkals:jORgth2HfRtKtvc/tY8gF6nbjls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770384734, "uuid": "4d5ca7a4-965f-4797-a0b3-36fbbe615add", "value": 122444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770384734, "uuid": "d4b7aa97-1d30-4e9d-8b3c-90b22586b50c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770384734, "uuid": "6690fc10-11cb-4cce-8162-c69b9b56af38", "value": "manji.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d51cd55-0360-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770384837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770384837, "uuid": "4313d2fe-792e-4696-8af6-8dc557a04d6e", "comment": "Malware payload (Mirai)", "value": "445e1aa204961c457d0c5a0136288c52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770384837, "uuid": "78693567-9440-4fc0-9330-2c3f47593681", "comment": "Malware payload (Mirai)", "value": "3b8413d98d4afaa76c6a33f0e0faf57eada9a99fec9809fca1f6eced2841b87f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770384837, "uuid": "2a375fc3-5c02-4f9d-b4c7-f401fbef9152", "comment": "Malware payload (Mirai)", "value": "ab37f48113827b29a3d579311eaa6c79392b7016", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770384837, "uuid": "54af3482-ac1c-47f2-a345-f0dfdf00e261", "comment": "Malware payload (Mirai)", "value": "537a2323e01d78ca480e9bc64d705762ca57fff419c8c736641ef2f22fb70e344e009f1ee43e2c1e10a6a585e1356779", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770384837, "uuid": "3736564c-4e5f-4ed3-a4de-d5b9a2b60fcf", "value": "T147C3124B4265B378CEB3E377909C08C5B471AD89E1895B8A50D8271BC9F799C2B3E703", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770384837, "uuid": "e37c2103-ad6a-4cd0-bef9-601e7adf1eba", "value": "3072:bXz2Lxj2TNP9RxDjJ9nMw1XqsgIxSL7e686oR/w1tKG:32F2xXJ9f1+uH6oR/4tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770384837, "uuid": "401d8337-fd8f-4ac0-b2b9-023b5a46dd63", "value": 122068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770384837, "uuid": "1b1f918a-6b59-4513-9a42-54a1dc9ca91e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770384837, "uuid": "8b81cf65-2c4f-4777-a868-89356dbc0727", "value": "2.off3.ru", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ff4c20-0361-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770385417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385417, "uuid": "d8a9847e-4ac7-46e1-a8e2-e7a21e6f0b49", "comment": "Malware payload (PureLogsStealer)", "value": "7714b76087e4e15dc88060d277e32132", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385417, "uuid": "3ae3320a-600d-480e-8ee0-87bc9472fbd5", "comment": "Malware payload (PureLogsStealer)", "value": "3bdb6d2cc2125ca6b5c61dbbee32b5b625d96378064df19c506ec04487834a96", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385417, "uuid": "83df03a4-ff4b-4898-b3ec-cdee59881a5c", "comment": "Malware payload (PureLogsStealer)", "value": "c88859ff597fc67dde5b35bfd24ac7fc75d1afe4", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385417, "uuid": "cb22dd2f-54a2-45a2-80f8-02066626d46b", "comment": "Malware payload (PureLogsStealer)", "value": "4c1df0bfeec6d0021608bbdf0e963ec94df98adad4b860ed76e7a2f2058fa89198d2cf36075af301d469b19ca0c2c559", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770385417, "uuid": "c475a7f1-a203-4e30-88d7-ff09ffcc6b17", "value": "T11B1633223DE867DBD4C7557B1303B324E4693C21E769829B1648FAC42F3E5697B038DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770385417, "uuid": "6da5e162-28df-4d3d-ae11-65babaa9c0ff", "value": "98304:BuTMX6w9mHJbA8+v6l+C58YEHs12VRV/EIULRampKGR1:SMKw9mpPljeYEM1GRVXULa01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770385417, "uuid": "fde95f00-02b3-4e20-bacd-53b1a834cee1", "value": 4218880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770385417, "uuid": "8973767a-b777-4821-90cb-55b267271403", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770385417, "uuid": "625bab9d-5630-4397-9003-34b11bf9795c", "value": "TASCJBAO.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23faca6b-039f-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1770411746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770411746, "uuid": "20639702-4fed-4ea5-b08f-45c943a3dd4c", "comment": "Malware payload (QuasarRAT)", "value": "6b97cb9edf071f21d84a8af189c7f55f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770411746, "uuid": "19e93c4c-58ae-44dc-8df1-8b2c2bfb077a", "comment": "Malware payload (QuasarRAT)", "value": "3c06688424a49260b67ca87b024358d49677314696edcc015e754634fcd63564", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770411746, "uuid": "e58b60d6-9f75-464c-889f-1bef040d1879", "comment": "Malware payload (QuasarRAT)", "value": "f8c813ac7876c0ec161cdc0c8ff73ad675bfdcb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770411746, "uuid": "cd728b53-0885-473a-ad95-49e2a4fcba71", "comment": "Malware payload (QuasarRAT)", "value": "02da4030cff7c419fb9c7f0e6276d0faf692b7c24e1a434558c05e00c8af8141d5ba5f34556067ffdf8c34ab5f388f48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770411746, "uuid": "bde8aaef-0c12-4216-843b-e6b1e0991adb", "value": "T1DEE54A0477F85E62E16AD3B3D5F1542363F0F82AF3A3EB0B5191677A1C93B4098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770411746, "uuid": "29ae41f8-4d2a-4fe4-8286-c2c939b7b7cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770411746, "uuid": "4ae61984-135b-47cc-97be-5d77627cf07e", "value": "49152:av4FM2eBaGlMJPFlUERb6HXqwxapUmtmz5JoGd+STHHB72eh2NT:avYM2eBaGlMJPFlUERGHXqwxWUmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770411746, "uuid": "56accc75-1723-44f2-97b2-0ebb1571a2bd", "value": 3266560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770411746, "uuid": "8d88cf20-12c2-49c1-b500-87194a4ef6b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770411746, "uuid": "106e3dd8-89d8-4b7a-8574-0d57f965866c", "value": "OddsVortex Core.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a484dd98-033b-11f1-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1770369012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770369012, "uuid": "b5acc640-8551-443d-ae9b-b819de05fede", "comment": "Malware payload (CobaltStrike)", "value": "83e436a2fb009a486a1d4158ccfbf0c4", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770369012, "uuid": "bc1502ea-6c42-49eb-b72b-4c28b0aedba7", "comment": "Malware payload (CobaltStrike)", "value": "3d8d0c15272b1c4f73a22af7599aad7c34b7c7bbff4030f11e8e15a1999b176f", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770369012, "uuid": "2d8bb8aa-3e7b-4f69-9b23-e77b6047b77a", "comment": "Malware payload (CobaltStrike)", "value": "c747d945300bd2a3377d072db2795620d1a48dbd", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770369012, "uuid": "5d9871c0-c848-43e5-b74d-7936a9ae1c12", "comment": "Malware payload (CobaltStrike)", "value": "095f9193be9fbd8e5bb06cb0f5005c91987e563a2d838227bb1d8c9eb96e9be351d10eb29a2072e87984322f232efef3", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770369012, "uuid": "958da507-71f2-431a-afa9-b50bab745716", "value": "T1B8624A57B7E04AD9F4794078C8371E05D576FD204B22579F03A4816E2EB3784BA3A762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770369012, "uuid": "1c7fc4df-793d-4042-a6fd-4e94754a5791", "value": "b5b3a7dac87bbb540df01a8fe3bbb08f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770369012, "uuid": "00ec1f3f-3955-4e0e-b9f1-5f9644afdd38", "value": "192:NN9eAeIvP/e4QDBXcxyXE1Ewfrvp+ycR/Q+XGuCdjDh6I9Bg++qPWFgDvLW:sXNXSy01BjpIXGL1Dh797PWFMzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770369012, "uuid": "b82fd75c-6c62-4cb5-85a8-79e04bf4be3d", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770369012, "uuid": "9bce2355-2acc-4755-9dfe-a06f10798b9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770369012, "uuid": "3c81baac-caf7-4088-8fd5-3b5b1c14f3a4", "value": "3d8d0c15272b1c4f73a22af7599aad7c34b7c7bbff403.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66907280-032a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770361606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770361606, "uuid": "7f896623-9ab6-4cc5-a3ff-811efdfea6b5", "comment": "Malware payload (Mirai)", "value": "2f5eabb63e2752f8c14de0c1823ff94e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770361606, "uuid": "6cc4942d-58ad-4e62-bf4b-5ccca611ef07", "comment": "Malware payload (Mirai)", "value": "3e2adde81b5ce116098a938d79fee54f375ca47dfc472343d9caaae7b6eb4d4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770361606, "uuid": "eb30b9b9-6496-4bbb-8c0d-43a46608dbee", "comment": "Malware payload (Mirai)", "value": "cfd96f7ad6a5053ad89e08ba7c429138f49aede0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770361606, "uuid": "63bd29f5-4ab1-4111-b888-a1de41c8a92a", "comment": "Malware payload (Mirai)", "value": "201b721d3f2bea451eb92c4d419628ea95e109d61913a32dbe39757ebd6195212e5423e8dc015a69710e196904f2276f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770361606, "uuid": "97deb0e4-f969-4a13-8038-48cbefe67157", "value": "T10833950A2E11CFEDFB6C873447778E21965833AA27E1D645E55CDA002F6038E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770361606, "uuid": "f01ee0b8-5018-4478-b8ed-d87f2b855a8c", "value": "768:GdgEGfgtXjpBW6JEroHndaIaaajHnyYkwfhw4LDTrPlxIWm04I:5uj3nUeduzyJwffIWm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770361606, "uuid": "c5d4d809-7f42-45f0-9fde-dbaf51c106dc", "value": 52932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770361606, "uuid": "e2eb62d4-8c51-4df3-872f-8a241d67e7e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770361606, "uuid": "71f1ea7b-5872-498d-89db-1d02001808da", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da51e014-034f-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770377692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770377692, "uuid": "0237c26d-19ac-4f9e-a576-1356b0649fd6", "comment": "Malware payload (AgentTesla)", "value": "156d7d672a965db1cb5b49e0d034f500", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "byteguard", "colour": "#CED109", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770377692, "uuid": "37a30557-dbe6-426c-ac71-b636e024531f", "comment": "Malware payload (AgentTesla)", "value": "3e4dd5cc476b671b8fb6677053900afb24fec1657ff4181b85964c2c305db5a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "byteguard", "colour": "#CED109", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770377692, "uuid": "db13a367-95b0-45c8-87af-3d5eb963e188", "comment": "Malware payload (AgentTesla)", "value": "ed094e99c9d0899c9f395c409ff65d5e3525d8ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "byteguard", "colour": "#CED109", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770377692, "uuid": "b5dd1a76-83ff-4603-9b95-eaf8891aa72f", "comment": "Malware payload (AgentTesla)", "value": "525651c6cf0292dd22cf839a75796b1d9bd60da26eb04c8c712b45f8286b59366a6faf0d531ed42d15d7d679b15418e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "byteguard", "colour": "#CED109", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770377692, "uuid": "40e1bbb2-4a1a-4926-b6cc-7093fd06a058", "value": "T1B875121EF354ED45C2FD227F445A7691CBB592F62B02AA4A3E1C92EE3D1078C5F812C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770377692, "uuid": "d413abd2-6123-4fc6-a3e3-36afc3a27a8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770377692, "uuid": "f01b2fad-9715-49fa-b691-b4cda5a2a151", "value": "24576:oyvhwUHYSw46x3SYiWQGJVb4160ZGZvj2M8vK6avr1z+PCvdlimv+j70QxXb:/ixS/E3Zi1G2sJj2M2aD18jgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770377692, "uuid": "ecfddf41-ead1-4686-b016-e4f40305db6d", "value": 1603584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770377692, "uuid": "f05618ae-84cb-4aa1-84da-c8350d93f0ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770377692, "uuid": "64c72260-5d5d-4dff-8a07-acaaf6bc4bce", "value": "3e4dd5cc476b671b8fb6677053900afb24fec1657ff4181b85964c2c305db5a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74624338-0385-11f1-a129-42010a9c0007", "comment": "Malware payload (DattoRMM)", "timestamp": 1770400714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770400714, "uuid": "7369e458-56e7-4aff-9f04-1248c41361fb", "comment": "Malware payload (DattoRMM)", "value": "be1b2655d8e5119847dff75c765f7847", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770400714, "uuid": "0b20bd5b-d9df-4326-978a-64888f8be955", "comment": "Malware payload (DattoRMM)", "value": "3f8044e8f6f54e672ac5213f768a53f4127b3710aa8b56a1f2662c9f31751ae3", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770400714, "uuid": "ff9ba60a-7d9c-43e9-92bb-81de035a12ec", "comment": "Malware payload (DattoRMM)", "value": "4ce9dbb7b33587f3fb1bd5b8beaea67d780085b0", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770400714, "uuid": "3c565720-8204-4fdc-9a7a-d5efe6424ee6", "comment": "Malware payload (DattoRMM)", "value": "d62ee254e86b1da4ecd36aeec0a00d62ec5028db6a94cf70db0cdc52182a7f12a7d15665d337634413a6489f4c6e1e1b", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770400714, "uuid": "96fa27fd-bf55-4e70-bed7-e4c7350bb294", "value": "T137B63313C57BCCE4CB234678D6E10A46BB4A058A9C5AB8D4F584633E55D34ADEF38B8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770400714, "uuid": "d58cad1d-11ba-46de-b6b1-2bb6e1b26663", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770400714, "uuid": "daa22118-39e0-49cb-b0ba-736ad17a74fd", "value": "196608:4aZk+wT0rsRTjTtR43PG8PZHj2BPFOsti7A95R8jsFp29XaIT030Hy05s6r8Ar8m:SnT04RT9R4PkE7Ap84p29qIT0Z6rXr8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770400714, "uuid": "19a6e4b9-8c25-4d94-bb74-664123d5e3bd", "value": 11055792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770400714, "uuid": "0fba3645-69c1-4d8d-8603-025b09febea6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770400714, "uuid": "9927889a-d54b-42c3-b99a-3c67c2985151", "value": "file2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a894d6-0363-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770386239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386239, "uuid": "94780da8-218d-41b1-866c-3968271edd75", "comment": "Malware payload (Gafgyt)", "value": "238b2a1b1d3aa106626b5ec78c562bc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386239, "uuid": "8d99f54a-9698-4d82-abdd-35bbc33152fd", "comment": "Malware payload (Gafgyt)", "value": "41061a2a00d12a372849fabcc1acb5e784cca814ee1f66bb9f9d5cf445b35827", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386239, "uuid": "c23e95df-54fa-446c-b54c-9961041d1d86", "comment": "Malware payload (Gafgyt)", "value": "3fb99e94046591a64116c4ab0fa485a2c71ee43d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386239, "uuid": "359589c7-f551-49c9-8d2b-baecab9085f9", "comment": "Malware payload (Gafgyt)", "value": "a79b16de6d2598b741655d65a02ac51a9e111a8c33f160aaef3563faadd957c5b1be03ed382ace0666cba9b34654a839", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386239, "uuid": "d5218735-88ae-4c4d-b64b-e871b13819dc", "value": "T1C1B33B4795A89EB3C086BEB525EB59300722ED120F2F1A9621387BF4437F5CD741EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386239, "uuid": "17f1672a-63a2-41e8-9c20-02b92ac1ac48", "value": "1536:Aq/W65rWXAiP5dfK4EBbkb25lyDQnAjC5B5+TjgkHmmycgYVLu1IPYC:R/vp+9C4xb2Mje0j/HmDcgYVy1IPYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386239, "uuid": "7daf4226-dd30-4359-bf8e-a98485d35f95", "value": 108486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386239, "uuid": "8ee8f111-7da4-4a66-929c-e5ff71f5ff8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386239, "uuid": "4b28f39c-bb3b-4746-9859-8bd85866fbc5", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244098ab-0392-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770406163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770406163, "uuid": "d41da65c-e4c3-4d9e-b3a7-99a9f2da4b14", "comment": "Malware payload", "value": "9f58717a6a86631d8a4ed8dec5c0a921", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770406163, "uuid": "55fb9e6a-5747-41e1-99ab-f64302cc7192", "comment": "Malware payload", "value": "43d6cfb1bb0735240f98748c9a563586af2ea869c99d04f3b526c195688a2ce4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770406163, "uuid": "aa1f8c3c-c65c-45a5-a835-6c4ef9afa48b", "comment": "Malware payload", "value": "f9bd7818b63d4bed62d59080ffb9f36f23e251cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770406163, "uuid": "0060db71-9e0b-4530-919a-8179fad99d4e", "comment": "Malware payload", "value": "37008abe6fee6c39a698369189d23a21f4ff5427375cd4d3591ce8b1003fcc9c83f7240978a15363eac08c7b20d345e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770406163, "uuid": "cd46f100-b524-46e3-8165-6661217c3368", "value": "T19EA533D98B56C258EAA21DF377BA5454239BE0A1A35D2BBDCC14DEC4B1F6CC6C20C1D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770406163, "uuid": "2c51366f-6ed1-4f7a-abda-d6b7589e107e", "value": "3a8632a6ba7f7c06aaa289e4406ae495", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770406163, "uuid": "531bd635-df07-49dd-b0c7-f0fb198d7dcb", "value": "49152:7wktjEj0ODx3kLYN/rIcsO/G3fPskXGUocyPrFH1uJaXT:Rtj5ODKLqUcsMGckbyjJ1uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770406163, "uuid": "0c5b4e34-d272-423e-a764-fe0752b92741", "value": 2217472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770406163, "uuid": "0969a4ae-9aa9-49ab-b5e0-8bad690cee65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770406163, "uuid": "287c07a2-378d-4ae5-815d-550fcce74ea2", "value": "SecuriteInfo.com.Win64.Evo-gen.21259946", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e79289-0374-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770393274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770393274, "uuid": "8353c1ae-c7f2-484f-a1dd-a9f679c99e58", "comment": "Malware payload", "value": "80ddf0bdbd9bef2a2f240536a726cc9e", "object_relation": "md5", "Tag": [ { "name": "Agent_AGen", "colour": "#118452", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770393274, "uuid": "9d593601-51e7-49b8-8044-90452a6078f5", "comment": "Malware payload", "value": "4410442a1ab1ddb19c40bec809ed78a7183cb28fbf990fa23ea6796c8f44357c", "object_relation": "sha256", "Tag": [ { "name": "Agent_AGen", "colour": "#118452", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770393274, "uuid": "08b18cc0-e3d5-45f8-b64d-70aa7a6b9bed", "comment": "Malware payload", "value": "fc259c1cfd9271f623ab931d3e819d314f53d85e", "object_relation": "sha1", "Tag": [ { "name": "Agent_AGen", "colour": "#118452", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770393274, "uuid": "b93cc43d-45d5-47c6-9964-2034ca0d008f", "comment": "Malware payload", "value": "d6c08a6829b5c51190ea3ae04136db94063d5febf2b0f9e97c446027d62ea19ba309667960eedabd2f2e33e3152d7bbf", "object_relation": "sha3-384", "Tag": [ { "name": "Agent_AGen", "colour": "#118452", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770393274, "uuid": "19fcf278-29bc-46a6-858d-fac73665f63d", "value": "T15C283331B2636DA8D62FA3BFE1A46FC940307CE1731FD56763787BA5857168621B2803", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770393274, "uuid": "58de7bea-45e3-4daa-8fdb-c7ba53203fdf", "value": "1572864:HhUMFKBc+RUCWObNJSVzFaFgB7hvUFaXg2x3XqRAmj+mvWYgxK+ssymA/Fjof:HfFKcJ5mmvaFgjLgV9jBWYgxKtsybN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770393274, "uuid": "b765f169-609f-4438-9ff9-ef0803c0e8b4", "value": 96370688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770393274, "uuid": "07cf4ec9-c7ec-4f0b-a066-8020c15ad633", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770393274, "uuid": "79f55cf3-3340-4bab-8229-cfe00c8b6376", "value": "AJiaSu_4.9.6.0.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb6585a5-0349-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770375063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375063, "uuid": "5b15e1e5-5744-4e41-9991-ecf49c84f93a", "comment": "Malware payload (Mirai)", "value": "df6b4cbae0e07ce11ae7ed5de3d19b75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375063, "uuid": "5f46dd0b-8ae0-4f76-a5d1-5564ef5e2031", "comment": "Malware payload (Mirai)", "value": "45145360b6a17541fe46ead925604d63a66f4de7410339e19a5344672a39d8e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375063, "uuid": "d5c43bed-201a-4587-a74b-633f5a5e2eaf", "comment": "Malware payload (Mirai)", "value": "308d89c38f1135138fb6389ba51050a821e458b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375063, "uuid": "d7a76f64-2aee-4102-9876-d220e4fafee4", "comment": "Malware payload (Mirai)", "value": "e6776de9f186e1bed5f6dfb267028ef0843dfb0104ad6a96ece67a89a2376670bfc534d8b797dffea98ef91e53e9bf9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375063, "uuid": "4d3d9748-4855-4b25-810b-aa024df9e896", "value": "T1E123F148C4072070DB945F3BA9B6D492AB8767F402BF32B7100CDB6CBDD9406A5BF992", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375063, "uuid": "0a7cd605-93de-402a-b3f8-68148603c064", "value": "768:E/59rdeujU9ZNqmiz/zPwTLx3qL419q3UELlX4ezjo1GK63RrlL8edQN4:E5VdeAayzbPwTdqUILlJjo7i1lQeui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770375063, "uuid": "9786a6fc-63f2-4540-9355-6890af2424dd", "value": 46684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770375063, "uuid": "6f0b3595-1877-42a5-aa25-49f01d1de249", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375063, "uuid": "7b32c880-890d-466b-9442-557b567a9b34", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79f6caf-0366-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770387539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770387539, "uuid": "bccfe705-eac3-472d-819e-3f6f22b79f91", "comment": "Malware payload", "value": "769687f93869a70511aac1ef7c752455", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770387539, "uuid": "c91e28d1-5b05-4339-accd-4f97ba9a8ce1", "comment": "Malware payload", "value": "46314092c8d00ab93cbbdc824b9fc39dec9303169163b9625bae3b1717d70ebc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770387539, "uuid": "728c32b8-7cde-45cc-ac4b-d221c75b7fc6", "comment": "Malware payload", "value": "ad833604d230b241e180950980ea462b3812f82a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770387539, "uuid": "3d80d5a8-995f-4f62-8a05-277053a0d251", "comment": "Malware payload", "value": "1e36efe746a64e8d449455687774323ab3e73166ec2996ca1045a6c25cdac8e12a44a472a688181bb9185dfb0702a4a8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770387539, "uuid": "63b42ad9-737c-465f-a1a3-95859a0c5548", "value": "T157B1B313A3209735C5DA0336190B6E86E63B1D240FF605C79FB6E618A5722D93779910", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770387539, "uuid": "3891ec26-ce5d-4a1c-9efd-10c122b7dd69", "value": "48:vpgdn5Vnzk+0DPzdCH4iz40dMtvEAJ5B6NDGEhw0njK:Bz+iB0ZdmtMy5B6NDGgX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770387539, "uuid": "d758f9be-390a-41a5-ad58-d08650f2fe3f", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770387539, "uuid": "eb8981fe-c85c-4a0b-bd59-4cc17798f4b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770387539, "uuid": "f839dd17-7e26-4755-b7c4-8b80fc2157d0", "value": "Avk.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb303db3-03a5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770414657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770414657, "uuid": "e9a9fb57-ef0d-4f6b-a060-751b8d1e2fe9", "comment": "Malware payload", "value": "45af835a196c1529c597704fb24b6fd1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770414657, "uuid": "0885ae20-e915-45db-ae5c-145a5025af2d", "comment": "Malware payload", "value": "48ddc0de7f0282c81174dcce0a6d6222a2162fef37a06eb7cfbfdf532914c398", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770414657, "uuid": "adc95495-2c96-4437-9b45-b2090e67f5b6", "comment": "Malware payload", "value": "2e803bc46536326d86eb50878dc4388e6c63d780", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770414657, "uuid": "b7c14fef-a193-469d-aa71-1b574253b7b8", "comment": "Malware payload", "value": "0e8b47200b10575a0b7ed5cea771a08c980a4dbe2612b0fa5a2238bd139652ae9370886c149d24d36276508f98b1e132", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770414657, "uuid": "d8e528dd-6d97-4d5e-8ad0-06dbd43a1d79", "value": "T158A533473E41B67DEE6F76702D2E0F64BA09B0871C738A7B34F1DE15787A440A9618B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770414657, "uuid": "e403ea54-0b3e-4eab-a171-f40fabab4dd5", "value": "388dc1cc36ef83cc05ae9d06320e5c56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770414657, "uuid": "53522da1-6663-40df-8e16-d6ed263a9ad8", "value": "49152:EKAd5ZaAUL3Qf+yaWXfLcnjwFvJE5d081H47+GHbsvt:EKS3aAeyZfajahm08g+G7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770414657, "uuid": "42ebcdcf-a15a-4559-9e90-4329aad8ee07", "value": 2249728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770414657, "uuid": "21c46319-4099-4c76-bb6f-39582603e338", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770414657, "uuid": "2dfa756d-7895-4842-8110-d26c61face54", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65becbc4-0301-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770343996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770343996, "uuid": "a684354c-7849-41d8-a0db-5a1c22839d6f", "comment": "Malware payload", "value": "93ef9ed66e48aeba8f123102781f0e7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770343996, "uuid": "916f8256-dc8d-403f-98a6-cecee9f265cd", "comment": "Malware payload", "value": "499be3164c590264f230f6319cf9bb2bbd241515c03c7b23accabf7382707207", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770343996, "uuid": "87a824dd-d170-4c70-ad41-26b469de2238", "comment": "Malware payload", "value": "dd1b8fea1486cb0faaafdf3ac7f267e6cb1767af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770343996, "uuid": "360a2759-0ef1-487c-a066-51d38690952f", "comment": "Malware payload", "value": "89619bdd9fd6ef683e6ab724e38d0646065722f7d26f9016537997dd806802a5739f10662ba9fe69dd3cafd5ab888098", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770343996, "uuid": "dcbc5c81-65ac-4a1b-a787-160e3d0cb6f6", "value": "T17E1833B21E4E14E7C4248CBDF843B433C16AAF2E95193968086E79776873FC61C2A757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770343996, "uuid": "c88cc275-d16e-4322-8bcf-8c128ed38cf0", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770343996, "uuid": "5aba23a3-e8d4-46a5-80c8-88f09f309530", "value": "1572864:KzKav06wjmfPUVOMIMsmbbAAlk+C+EPNMGfEWza2ra4jAom6EYm9dkQKLYDerBd:KzD3wjesH9bADwEZfjrrNkoFj2yMD+Bd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770343996, "uuid": "3125d567-b47e-413c-ab97-51e5b0fd5cee", "value": 87985256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770343996, "uuid": "70e756e9-2daf-4af4-a6aa-fa5dcf5551ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770343996, "uuid": "2c267763-fd08-4c34-bf92-e61920059d3d", "value": "Xeno-v1.3.20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f516ee-0386-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770401035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401035, "uuid": "5a3c776b-82a9-461d-a859-788645b72fbd", "comment": "Malware payload (Mirai)", "value": "a0a9193c8e9b57edd07e2019c2ab05ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401035, "uuid": "93d3ab9d-1c6f-4c21-8456-e782b36a5928", "comment": "Malware payload (Mirai)", "value": "4ae348c6bec7cba69b030a8556bb72c384923bda6b2aad78f91f0fad880c120e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401035, "uuid": "a78781e3-1bd7-4a71-a6f1-812c12a703c1", "comment": "Malware payload (Mirai)", "value": "eeab9c67df2a944494a024bc65d47c8a49f7b89e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401035, "uuid": "11ead4ca-36c2-4671-99db-6032e83c5dcc", "comment": "Malware payload (Mirai)", "value": "70904335e0080c7357a2b983d84c1545c96b9c6a4e6fc9f0ed03eb313ba31a8cbe7e4194d17b78d4a680f951622cded2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401035, "uuid": "bcd3b99a-d13f-467e-b04e-ee22e312b5ab", "value": "T130F35BD7F900CEBDF80AE73B48130505B230B7A210D25F37625B796BED7A1990967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401035, "uuid": "cfa4cbd8-9c6f-46ca-9eb4-565eee499820", "value": "3072:nY5EEAVTJCEjc0jqfQEX1QX/IuuhmsjPVvjbiwLhPKyG577h:n6AVTE4EXmXAupsjZL8yGl7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770401035, "uuid": "2bea1b45-b568-4e99-a1b5-169e99b456db", "value": 168032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770401035, "uuid": "0abda284-dd25-4b02-a0a4-d13f909be83a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401035, "uuid": "71c564bd-8e42-4465-bde6-08db5ae2fe63", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b2e82c8-037a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770395893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770395893, "uuid": "6600a950-2c62-4e4f-bf13-6955c53e52df", "comment": "Malware payload", "value": "8b258a5d34635fe6b4f35b9bc02e3a66", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770395893, "uuid": "4cf5365c-a975-49d2-9129-7c5c3eb00af7", "comment": "Malware payload", "value": "4b2e112fcaee79c482043e653ce46e0abe0d37c9ced48412ac0ec5096bf925a0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770395893, "uuid": "2bcdf834-0477-47e4-b24b-0c86c83875cf", "comment": "Malware payload", "value": "5246c69ce467af8eed33048b0f3b0b63e2e0c644", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770395893, "uuid": "88b8e1a7-fdba-4e24-b15b-92cd1230aeae", "comment": "Malware payload", "value": "5b40f7ac022ccc276902e762ecc29514ba6b80c0e062cc3f4afbf52c3e2fe10819d3fe707e997c273030a43d4ab6d648", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770395893, "uuid": "f450fd1c-2ab3-412f-8a7f-ab80bc8fc13a", "value": "T156E69F7B62B801E9D4FBC0B9C6469513EBB1741603B467DF09A08AB61F23AE05F7E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770395893, "uuid": "d16043a5-cdea-4ff1-b584-ede3aa6d061d", "value": "09ef4e1ca89c221279d752366e794d35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770395893, "uuid": "095b2df7-44c9-42b1-ab46-a77f4bf6cbba", "value": "196608:49/2aRUKzs7VQglbcGH8Ci+m9hsfHF25Lxb4H98:6/2aRzzrglbcWdi/9hsfHuLxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770395893, "uuid": "ee6f2ecd-f3c7-4d72-aedd-409d11a4e96f", "value": 13997056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770395893, "uuid": "45731062-8d11-4678-9401-436a69047b43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770395893, "uuid": "41c76d5f-4099-4387-8626-63a195e0ccec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15c3694-0363-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770386240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386240, "uuid": "14e02ea1-be8d-45a3-8606-ef9ed000c1fd", "comment": "Malware payload (Gafgyt)", "value": "fff63be9c077d9766e9c5c1e2f2ff25b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386240, "uuid": "bea77442-f40a-4bad-aad4-91462d6dea96", "comment": "Malware payload (Gafgyt)", "value": "4cb93f270b727d4968bcfeaf803f4ead48a43cedfe52c90b0141139381a55f64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386240, "uuid": "848d98a6-b634-40df-936f-1500958a1473", "comment": "Malware payload (Gafgyt)", "value": "19c9d22f9256512cd3e5ee8f852e8550b2c4eb64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386240, "uuid": "b9e996b2-1977-47a6-a173-628105d98041", "comment": "Malware payload (Gafgyt)", "value": "11514f7a10f6628e4ca51a1e26098551f0a836dc46c21baace2d7cccc67f08536d323d4a541ff16ae1659542291ea9f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386240, "uuid": "5dd3ad05-9d3a-4e54-bbed-2c1295eeed2b", "value": "T104933B17A652C57BC08762F41BCB9A11AC13BCBD0B63A30673D4BCE82B159D72DA9F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386240, "uuid": "e4d50181-db2b-4687-89e6-01842789b9c7", "value": "1536:W7WREyqkQc923v2uNi7pNF+BoD3pphanvn00GFmoI5um2Xj5YZA0e:4RkQT3v9EbYBo7pphanvn000mr5um2Xx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386240, "uuid": "77aa8c1a-381b-4cfb-a93d-7005d98633ae", "value": 92932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386240, "uuid": "ec69017e-8fa5-4e8a-a38d-8a5a4caa17c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386240, "uuid": "8ecd8681-e024-4259-af5a-f703a05fa1a1", "value": "skid.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "386ccad6-0386-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770401043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401043, "uuid": "99e12698-d6eb-40ac-85ee-8c531ba47e97", "comment": "Malware payload (Mirai)", "value": "daa456e0fdd14dd7e607e0a8dad7429f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401043, "uuid": "34490dce-45c3-4f98-9819-d2d51e832333", "comment": "Malware payload (Mirai)", "value": "4d76fda4c4ab7e1099e7b007855ee285d14a3f19b83fa72b1297c636c67e9948", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401043, "uuid": "b9210997-8bdc-4e99-b93a-87c950182c6a", "comment": "Malware payload (Mirai)", "value": "e9d8419ecceff73f4a85f419fee80df696d9a149", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401043, "uuid": "6089c872-a187-44df-84f8-a86ddb90320d", "comment": "Malware payload (Mirai)", "value": "ebd5e858384668e710caece34872ff4b33dea96c9913c81b2a9f2720882cf596e818c0df19196bb037dbe1da8be762a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401043, "uuid": "9976f189-129b-49d0-9b60-22b620041f86", "value": "T17614A81A6F228F7DF768873447B74A24975C23DA26E1E641D2ACC1106F6038E645FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401043, "uuid": "63fae920-bbae-4b4b-9ac1-220ef740b710", "value": "3072:2z9B1P4RLOCgIMJm2NC55cqpw91Ul5S4D1:2j1PwOrEQOpw8lk45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770401043, "uuid": "3b9af17b-7af9-4dc0-9d3f-9ad0d475d3a7", "value": 198380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770401043, "uuid": "46dff520-a910-4aad-8f15-c6a8e7f19f8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401043, "uuid": "92bab0c9-fd56-49b0-ba3f-ab14abcab4c9", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d8b3675-0364-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770386368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386368, "uuid": "dbb05454-5b5f-4cb5-9144-248861a92236", "comment": "Malware payload (Mirai)", "value": "c3e6e3d3af32a8b507ce5d5c867e04b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386368, "uuid": "3ea0cca0-9f74-4f72-8a48-473d1228acf5", "comment": "Malware payload (Mirai)", "value": "4f039aded6ab4f03b65c154041c75c4f11afeabe9ffb3ac97c9917899afb848b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386368, "uuid": "4a61e54b-1125-402f-ac0d-aca76b330a7a", "comment": "Malware payload (Mirai)", "value": "a697a50f7e904975b3e09c5ceb0fecf62c93489a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386368, "uuid": "461f59c1-0d09-487f-be1b-74b2d9e5e918", "comment": "Malware payload (Mirai)", "value": "0d3516b3cff7bd2f9262a847fabb54cb522ea0c84ca3efc42a0f132c7b0588306eb0f3ca11fadb7d8313ffa3d84c06b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386368, "uuid": "47e0cc58-39e7-4968-bc1f-a13b479f0326", "value": "T10DC3F185FB636991D0A342FDA4C00AC387912E318BA217480699F774387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386368, "uuid": "06082213-3c63-45a3-aae9-e32df82f12a2", "value": "3072:SBdQK+TG2nIjnRdZaUXUSgkLCCVwHWiEiBtbMMTnu:eMQRtXU9kLCP8ifbxTnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386368, "uuid": "a1f206fb-6f94-4dff-b4d5-70a03dc47694", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386368, "uuid": "1b628245-202d-4004-9912-8df4bad00b48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386368, "uuid": "9c3040c3-ace2-4668-8f91-586e46161cc6", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36918261-0386-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770401040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401040, "uuid": "892ab883-596f-40e2-8905-789e9846f76d", "comment": "Malware payload (Gafgyt)", "value": "d11c94d9171551156d0fd939c1e951e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401040, "uuid": "3189a810-e0fc-4c17-8693-8f39c9c20f5e", "comment": "Malware payload (Gafgyt)", "value": "4f8dfac7243376ab1e024d88ec75205101d0348f4a69160d34ef733bc54a04ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401040, "uuid": "9a662d17-dd93-473b-8bc5-ef4ed9c5b65d", "comment": "Malware payload (Gafgyt)", "value": "fd6476be5e96f62442e64e53da69532fb1318dd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401040, "uuid": "4975a8f0-fd6a-49a7-9022-2795e6b56bc4", "comment": "Malware payload (Gafgyt)", "value": "556bc741b59db07bc538293a07f7b50774ccd1e9acb5afeb8479d800a630c2ca2332512b7538782053eb84d08a2620e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401040, "uuid": "79dd3b77-5509-44da-9e90-1c34ef6ba750", "value": "T1D2B3E867BB11CEB7C85FCD730AAA8615108DA99716D47B6BB3B4C95CE70694F08E3C80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401040, "uuid": "56de15e3-611e-483d-99aa-aa814d08e42b", "value": "3072:RdbrMMuPEqcG5h1znqQxmkizF9GhsRiAe:R1uMNG5h1znqQxmkizF9GhsRiAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770401040, "uuid": "3e666262-4ac7-45ba-89e8-0acabbba9f22", "value": 115387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770401040, "uuid": "b521b07c-213f-412e-96be-c053c38d6c3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401040, "uuid": "96e9f438-8d22-4bd1-85f6-35de8c0ddb59", "value": "skid.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b3db0c-0386-11f1-a129-42010a9c0007", "comment": "Malware payload (DattoRMM)", "timestamp": 1770400961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770400961, "uuid": "bca9f10b-c7a7-4602-aad0-d91bb868ebe9", "comment": "Malware payload (DattoRMM)", "value": "d4d635dc50f157d52e61ad67d67c90cd", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770400961, "uuid": "f116b34f-3d23-4ba4-9949-876b114f7656", "comment": "Malware payload (DattoRMM)", "value": "504d9f052bddb17d2231280218bc246d552281bfc81a0dbd88c309b3e5165651", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770400961, "uuid": "1e580e98-8eb4-49e0-9b90-20aa831edd47", "comment": "Malware payload (DattoRMM)", "value": "7908ed85808b8af524831b4a6204e909d6bf2d2d", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770400961, "uuid": "575d3579-060d-40a3-91f2-f3e592718fe2", "comment": "Malware payload (DattoRMM)", "value": "74072afc2279dbe51c1a6dd3cf6f68e5a0fdf04165e67c4a3e0368a2b932469051f46cd880f3fedbe165a38c82299801", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770400961, "uuid": "163db812-651e-4f71-a03e-e2550cf1bc1b", "value": "T1D1B63313C57BCCF0CB234678D6E10A46BB4A018A9C5AA8D4F584633E55D74ADEF38B8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770400961, "uuid": "4c00c6ca-0f0a-4d70-9434-e36bb6c3c1f1", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770400961, "uuid": "45c3b7cc-8e65-4297-a333-59a031e39a83", "value": "196608:+aZk+wZ0rsRTjTtR43PG8PZHj2BPFOsti7A95R8jsFp29XaIT030Hy05s6r8Ar8K:snZ04RT9R4PkE7Ap84p29qIT0Z6rXr8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770400961, "uuid": "b5db1a96-e6c2-4144-aa46-5dba514d6172", "value": 11055728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770400961, "uuid": "730d6b81-4836-4577-b3b1-4bc9fdb9ee4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770400961, "uuid": "99a592f7-81f6-477f-a323-8eb380b711ef", "value": "BidProposal26Ref01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1071f0a9-0364-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770386373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386373, "uuid": "fc5059e0-b7c9-43a1-809b-eaf386dc16cd", "comment": "Malware payload (Mirai)", "value": "be8c46a6e4bd8ea850c16ad01c81b3f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386373, "uuid": "d316bb4e-4319-417d-8fd7-15449affcef8", "comment": "Malware payload (Mirai)", "value": "5095dc1dd7840e0adcc303bd7fde79860f6ef2f7bbb4efe965ad1504b45732ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386373, "uuid": "7d36ae6f-20ff-4f89-9565-fc51a702e29e", "comment": "Malware payload (Mirai)", "value": "c2efc48deb6f56a064714033eeb4fdc1834db256", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386373, "uuid": "a226b91f-fe51-4757-ae1f-9aef2e232bbc", "comment": "Malware payload (Mirai)", "value": "d204ac5d31c60ffbc81942ddfd2adae1c0040b4e582fc73c6e6d42e702573a2d37b6ff9a8955ceae3338d8912a4d24a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386373, "uuid": "8ad77617-7bc2-48ce-a67c-4d59412c59c0", "value": "T150D3CF32E0086DA0DD2116B4347659BC0340DEB40BD59243EFBEE59E28B7DA57DEEB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386373, "uuid": "39874b9d-7ef3-47b0-8a65-46dc714b2294", "value": "3072:kNulV+GOAc3YSmDEjdX/VuHVv3WDRGGRhaUNZkP0ZKa:yulo2ubIVv3sXL5NZmOKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386373, "uuid": "53b93cfa-d671-4cdd-ad6d-725888378a83", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386373, "uuid": "58c31dcb-106d-432c-a50e-68735de5e52f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386373, "uuid": "0276e8d0-46a7-42a7-b732-9583ca4648c5", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea2f5b6-0358-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770381404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770381404, "uuid": "f5a830c0-8871-4ffd-845a-7f7c2ae7a0a2", "comment": "Malware payload", "value": "15c050ab85745058011fe100ff28ad91", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770381404, "uuid": "5c5d3034-549e-42ad-97d7-271cb5757aaa", "comment": "Malware payload", "value": "50ad41eee68f3a5f4969700bf9265bea45d0b385b4a21b253d3a68e64b446851", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770381404, "uuid": "f626788a-fd8d-4305-84fb-74c1b2f0fba7", "comment": "Malware payload", "value": "604f0684725e2316ad3680850b9e618ecc9ac84b", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770381404, "uuid": "4ba1617f-6109-44ab-8759-476c4cf39031", "comment": "Malware payload", "value": "07cef2afffad0ab09764f6f3d5ec085682ad767cb6295d3ebac24b347b8b491bf907a23729d4342be996aa38c84ccc5e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770381404, "uuid": "9a588297-b580-46af-a735-f340768f371f", "value": "T14E3222BCC9E1FCC4870F32D0A5D5F6C1205A9713DEA72ABCF99814A517503A9EBB918C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770381404, "uuid": "7aeb9010-9d43-44c6-a438-8bba17f0c13b", "value": "192:4S+cXF6jeljKnvrdnmnio18J8xQ7DaVU5UbCDEh+XfMlbtGVLqvlX4:4S+cV6+jKnpnmio18JACOawCAh2fMlcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770381404, "uuid": "de8b995b-21b0-41fb-b79e-a42940fc1b7a", "value": 10942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770381404, "uuid": "dd66f0f4-ee36-4781-b6ff-16274b3b6afe", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770381404, "uuid": "e9b18434-0f35-428a-be80-0f7fb694a9d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9350d1e-0327-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770360564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770360564, "uuid": "e3a3ad6d-46dd-4104-b6d1-a76bcb079a27", "comment": "Malware payload", "value": "96a17104a4838e467691e7cd329ca08f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770360564, "uuid": "8021050a-e1f4-459e-9e15-8e65e1830d9f", "comment": "Malware payload", "value": "50e09b9476af6f67238e5299a6aa3b2cd27b7d4c172d51176640b652e79aa64e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770360564, "uuid": "1f4a35a3-2221-4743-9ce0-6948c3beb0a9", "comment": "Malware payload", "value": "0ee761605df876baea3059f69bf5c485df62353b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770360564, "uuid": "42f1d928-a850-4594-b43e-0ec151c8d9ec", "comment": "Malware payload", "value": "e5f0cf258cf9fe51ff9d619ba2b782ed0b69add56cca93f639a470120f22d1a60fad1fb6c8b586d58d041b5d1945d5cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770360564, "uuid": "e931117c-cb0c-4b5a-be45-3cb06e5d935a", "value": "T171936C42B70C0A43E0575DF02A3F57E1C3AA66E120F8FA89790EDE4996B2D325547ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770360564, "uuid": "1e8ce211-5abd-4ac2-8a7f-c11e6938fd04", "value": "1536:nJetUgSEiuMZpVo2RdinOhknVtAIW2o+9xKTDxgCEzF3qA+WM/0l1WrdF3n5+G2o:Jikn4jgfTDCC6+WMyWrr/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770360564, "uuid": "8bbf98f6-34ef-41e0-bd02-7afe20c9b11f", "value": 92048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770360564, "uuid": "a8808261-73de-4122-8ea4-1bdb3a3efe78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770360564, "uuid": "3281150d-9b93-464d-8b5e-b1228e6fa4f0", "value": "titanjr.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b43a275b-03af-11f1-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1770418860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770418860, "uuid": "842d0d29-144a-4b3c-9541-39b3782a66d5", "comment": "Malware payload (CobaltStrike)", "value": "dcd660f26aceb67e48e1096a8a209f70", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TGR-STA-1030", "colour": "#BFB2E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770418860, "uuid": "54786e50-4540-4ab6-9208-0b888976fd48", "comment": "Malware payload (CobaltStrike)", "value": "5175b1720fe3bc568f7857b72b960260ad3982f41366ce3372c04424396df6fe", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TGR-STA-1030", "colour": "#BFB2E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770418860, "uuid": "7207c549-2c62-455e-a5fa-4f24ac08cf84", "comment": "Malware payload (CobaltStrike)", "value": "1363a0f9381ae791ca3e5483949759367e5015da", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TGR-STA-1030", "colour": "#BFB2E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770418860, "uuid": "0511f6fc-43ce-4c75-9a53-6dffc0e2857b", "comment": "Malware payload (CobaltStrike)", "value": "af6362d9650a55cd3487e3bfdcc38776d18cc529fd15ee6aeb110ab11b8fe31f025dff946521f725d966573d858e8fb4", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TGR-STA-1030", "colour": "#BFB2E4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770418860, "uuid": "0514aaaf-4b8a-48b2-876a-72a46f101b1a", "value": "T1AEB46DF1BA00FCD1F56F0A76CA75B8691232A623D9D79D8E40647B820B73711FE17846", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770418860, "uuid": "6cd5194f-4084-4350-8a5d-0f3b321aaf1f", "value": "7c65649150f0bc99d03a9629f9f3ea1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770418860, "uuid": "4715dd0d-1b2d-4eba-bfb6-8272f24b4684", "value": "12288:r2RAvIIfLenn2Ai1+R/jhk6F5ZgDcRch9pUsFz:xfLCn2Ai1+R/jhkMZgoROUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770418860, "uuid": "8dea4606-338c-4812-963b-967ed908dc92", "value": 531856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770418860, "uuid": "5579e125-23a7-467a-a854-f7c42340275e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770418860, "uuid": "6ad9ee5c-563e-4019-ba27-8ac6cc78f0bd", "value": "msedgeupdate.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d4cc64-0349-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770375086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375086, "uuid": "f5375679-5761-40fa-ad6c-60f205047d98", "comment": "Malware payload (Mirai)", "value": "92bbde10b1ae25d8948a4d3cd1ff9569", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375086, "uuid": "ecfed360-f173-4d2a-8cf2-ae829b5c6b6e", "comment": "Malware payload (Mirai)", "value": "53094c65412f109a71f7eee3bfa906f51797d4b611e623e19c18b3d410a499f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375086, "uuid": "1e496c41-9756-4c21-a3da-469e3c1f1854", "comment": "Malware payload (Mirai)", "value": "44d7b63d72a81b776fbf5fc4fbc729594a49e047", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375086, "uuid": "ec880e8b-a3c3-421d-a243-639a1f7d87f4", "comment": "Malware payload (Mirai)", "value": "4430518b8c71b15d28b2443da26dbdd4098d4fa05cc457c9b43e3f22266ce46733a5e32ee9fe4d837747168b4944cc58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375086, "uuid": "70fcd01d-1689-4644-ae53-916ad535d9cc", "value": "T18B231791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375086, "uuid": "d3a0be43-97ab-4e22-b871-7721f2a2924c", "value": "768:hPiHxmKTeSIb9yAAGxo42k846ZQk8PHAmauf/RWFstM2UA1mA2EDEy0eYjW9THvw:humKFGxqk84qEHAmauvGhQVPat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770375086, "uuid": "41f519d0-487a-4e2a-9628-4b1b93362e5a", "value": 47084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770375086, "uuid": "1e66ab84-8f6a-437f-a26b-4518273d7f15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375086, "uuid": "768bbf8c-f535-4d87-aa32-bf268cb159f0", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bce4254-0335-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770366313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366313, "uuid": "f0ad23a9-379a-44b5-b7cf-3c1720be8012", "comment": "Malware payload (Mirai)", "value": "df592f94d70476053b9e9d8cf7006feb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366313, "uuid": "3f662ac4-13c0-438f-ae13-83975369a3a9", "comment": "Malware payload (Mirai)", "value": "532ec8e2f5d69e3b2bab31e8944c7aa0f3f7c1640bea213f8b4c21694e768a2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366313, "uuid": "fced5e66-7bcd-4cf7-a41f-2c544f575fa1", "comment": "Malware payload (Mirai)", "value": "6394a0e69f9273d26a50a0f3a7d8dede404a7da7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366313, "uuid": "44d57b2f-32fe-4e79-9b82-aef0a318bef2", "comment": "Malware payload (Mirai)", "value": "5b88943b64c6ca65d59b49f31190f7b39492d9b8482185ccbede7b5f8d7402e65a099bb8f9034be83cef0a0377833e75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366313, "uuid": "6b528369-45df-483e-9220-74be95833dac", "value": "T1A7C43A59F8809F61CAC52576F75D829C33134779C3EBB20699245B343ADB86B0F3E642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366313, "uuid": "6f3b364f-e7a5-4075-96c6-5b57612c752f", "value": "12288:oMLKaxf4o4Zg0XNSlGLk75DJ+AI8KgpEorj4N:j7f4pmlGL+5J5I85X4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770366313, "uuid": "ab5f1bc7-dd22-43bd-b261-09e52070156c", "value": 575212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770366313, "uuid": "f2022611-fc20-4aa7-b01f-b0bc0048dfbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366313, "uuid": "8ed47afd-24e4-4f08-bea6-124596ae066d", "value": "data.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05289c1b-0315-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770352424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352424, "uuid": "733a7327-0500-4dd7-936d-e40166d542ee", "comment": "Malware payload (Mirai)", "value": "06dd9809ae46b586e9adad8f759b91b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352424, "uuid": "4ae8bdc7-80d3-42f5-a26e-64e26ad37b4d", "comment": "Malware payload (Mirai)", "value": "5342651023332e9872144e2a72862eebe893d66ada4bf8179164e36b5d631b8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352424, "uuid": "ad0b76f8-a72e-4cd2-8353-fa816110531e", "comment": "Malware payload (Mirai)", "value": "ee4c25afeadf3fc412b81fe57afb043c76987b6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352424, "uuid": "172def8b-e8bb-4ea4-9759-0defcc33d1af", "comment": "Malware payload (Mirai)", "value": "d114d91afd033b3ee3fefd01fb4933a26409e6f026098e818598ee3ab5c36e89e45f8ccf3f14e43efe44ca5b6a57a3eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770352424, "uuid": "72267701-e467-4294-b266-c5f361452eba", "value": "T14213E503B949D4FDC58DC134076BBA3E882AB57E4278B6F6BBC4FB126985E605D1E804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770352424, "uuid": "0e8e13bd-3d4a-43e1-aef7-8d083b4a629a", "value": "768:xQqo5NLlIMpQRAxZTFQ0qea5YzNGCOj9n5xEygoHrrHwFXb1XVMhZrMhMrMPV:Jo5dlIMpQR4ZhQ0qea5YzNGCOZnDEwYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770352424, "uuid": "40ac36dd-455b-4941-9abc-7daf38685ef2", "value": 41984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770352424, "uuid": "a26331c3-21bd-41eb-a3b9-d705b06469b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770352424, "uuid": "3bc4fb08-2ecb-4493-b830-93a06d399945", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321e629b-0387-11f1-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1770401462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401462, "uuid": "54571aa5-ffb3-42e4-9421-332960c2d81e", "comment": "Malware payload (SantaStealer)", "value": "5e7be9a2d398a7be76084b4d098e12a1", "object_relation": "md5", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401462, "uuid": "52831e97-e528-4d8d-9681-a2f9f07afb23", "comment": "Malware payload (SantaStealer)", "value": "549a26874eb9a1ec254d989eb98039d3b86bc90fb66f6f78bb84a814afddafc7", "object_relation": "sha256", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401462, "uuid": "ff5945a5-e5bb-4deb-b51e-aa6e90f83839", "comment": "Malware payload (SantaStealer)", "value": "3a891d4f832b5160bbaba6940930a598c8a5762b", "object_relation": "sha1", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401462, "uuid": "25b57bff-bed1-4c59-8be2-f142a90409a9", "comment": "Malware payload (SantaStealer)", "value": "175f9d08a52b175ebc5236105b5536beb4bf5a0c4a828265eabd78b07d001ce2fc60e6d970a630a576e725692ed438be", "object_relation": "sha3-384", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401462, "uuid": "2e4f43fb-5f0c-410b-a4a6-fbeaac122a34", "value": "T19DD59D0AE65349D5CC6BC0BC838A7131EB357C79CB282EDB17D18B613E55B806729F86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401462, "uuid": "96a36bc0-6ef2-48bb-8f8d-6657f1c4fb44", "value": "bdcf6640dd39be2f9b3b5476d898a6dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401462, "uuid": "5fc9e30e-33b3-4afe-9470-3feadc1e712e", "value": "49152:KFxz4wLgW0B2MXHWeGLzCnx7Rt80JjIGr2yXEJmgS/VcEIuFZ:dpW0jWeGLzkx9KAjcyTxK+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770401462, "uuid": "49fa7c42-0a85-46cc-a863-86a2a64f8657", "value": 2984448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770401462, "uuid": "12a1a75f-0bff-4ecc-868b-3d8decbe26dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401462, "uuid": "293f81ad-9565-475a-bdb8-c6ece884e1ed", "value": "549a26874eb9a1ec254d989eb98039d3b86bc90fb66f6f78bb84a814afddafc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b5bf27-0363-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770386226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386226, "uuid": "02a47b7d-55b6-45db-bf36-cc336db484ec", "comment": "Malware payload (Gafgyt)", "value": "3323bc40db461e0b39bef9be0d398dba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386226, "uuid": "1961d0ef-0874-498d-bf18-fef5c7f17f87", "comment": "Malware payload (Gafgyt)", "value": "5559292bac8be104d9e8f8cc3a102072d98ac275d6756c9ee9c56a734c57f22d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386226, "uuid": "380e6176-15db-4a21-bf13-c76e7df7ece9", "comment": "Malware payload (Gafgyt)", "value": "555a2aa435de2d4f6a5771917ab2b6bd98cd12e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386226, "uuid": "863338e7-2664-4901-abe3-8faec0213525", "comment": "Malware payload (Gafgyt)", "value": "9765c08bea51404010ec3529a1cafde7ced616cc7cd263faa9febd4e43a2ec6759ba964220179d80b616da69602022e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386226, "uuid": "f16eb283-a9e5-4984-bb50-29cfe25be443", "value": "T129B30692F900DFF2F40AE67604C34B2566B0BF660F536A66B21739A79E721C43867F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386226, "uuid": "ac31a46c-d364-48c8-9b05-63440b5af021", "value": "3072:gLWUEK1FSHGfs1QbEE6QyPwRs/avcWVRm2pgYMx3IPtW:gDsGfs1QHyP6sSc2Rm2pgYMx3IPtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386226, "uuid": "af263601-1687-43aa-a559-e81510c9a6fc", "value": 113759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386226, "uuid": "347c5263-c10b-4272-9701-3e80908bc486", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386226, "uuid": "8abe0417-ac2f-4925-9f6e-ecef8ab51c43", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd66829-0362-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770385644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385644, "uuid": "e31cfd2c-8007-49c0-be60-c66822e9c495", "comment": "Malware payload", "value": "c24275c65db280f28305ea0fe63b6920", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385644, "uuid": "3b6fbbc1-1393-4f8e-8318-555da2604801", "comment": "Malware payload", "value": "565e8e919262238bbb43ed6ed0675a2f42084f69194b70e66fb595189564cef1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385644, "uuid": "f9e26ac0-8e3b-41e0-b73a-6431cf10a4de", "comment": "Malware payload", "value": "35f05d3ae6316f359442e32557a1af2ad7af6ef6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385644, "uuid": "c3e6de7d-7585-4bf4-86a0-041ec4aeb44c", "comment": "Malware payload", "value": "b2f9ebb8455d4fce2e1a82b3268ba51721c0f81c8159ba35b3230113e99cbebb75f76d2a16627ab2c4cb7aaaf1bbe46e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770385644, "uuid": "21050476-835f-4216-9247-7cc6daf5ae94", "value": "T1D3F05C20C2084E6AFC5A5772911B33B6E3A18260168D178D58D0ABA79912653B6E9215", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770385644, "uuid": "b37a1f3d-208d-47d5-9bcc-60e7e7d357b0", "value": "12:5jghRXIGoC90TzoE9BQ+bSBqiPbkyhrtat:9eO/bQo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770385644, "uuid": "b0841705-36f3-4ab4-9819-b612cf48d0b3", "value": 454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770385644, "uuid": "a054c3c5-5329-4202-806c-e707f17329f8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770385644, "uuid": "1aa9e08a-5346-4f6f-90e1-f03b68b884cf", "value": "486263.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e5a59d2-0386-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770401053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401053, "uuid": "c688237f-5b9c-4f8f-b927-0add0a42f141", "comment": "Malware payload (Gafgyt)", "value": "ad2bc40d2b3e4dd1711320aad3468b2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401053, "uuid": "c7e666e5-3c70-4838-b73f-1e063138b2cc", "comment": "Malware payload (Gafgyt)", "value": "5665e76bde5c245f25c950f8f1d6186e7ab70428dd19a0c89a23457f2ffa9283", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401053, "uuid": "1e026359-733d-4fbe-8886-7bcf54caa4bb", "comment": "Malware payload (Gafgyt)", "value": "e5ce573b8ebc0aa50bc6ae0e16e29cb575d59735", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401053, "uuid": "1b53d33b-4955-4acf-b240-f5e1f353e369", "comment": "Malware payload (Gafgyt)", "value": "cfc7b97dbc47aba541e2ec8d9ca267bdca3072ea756b4971724d69b7622c43a04c0dccb9e500dd1ee7bd6c27a8faa59d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401053, "uuid": "d05d294e-7ceb-45e8-b1e3-d1074dd837d7", "value": "T102B30901FC404B27C7D267BBF79A438D77366658ABD7331266296EF02BC17982E39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401053, "uuid": "3e5d1a13-4ca9-46a5-bece-7cf21cd870dd", "value": "3072:pqDUOulvQ+nozmuCoJraQSZk15h8jbOwSfTll7HoDQHDVpZAlvm:eJrke15h8jbe7HoDQHDVpZAlvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770401053, "uuid": "8245ea0c-3a6e-460f-b3ed-940d7057f4d9", "value": 109446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770401053, "uuid": "857934a6-988f-4f2a-9e7f-b62af981db1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401053, "uuid": "065534c2-8d69-45f9-946a-5d6f5dcac1b0", "value": "yakuza.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce3c1acc-0349-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770375095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375095, "uuid": "bc7a895c-49b8-4642-a005-539d0f681bf1", "comment": "Malware payload (Mirai)", "value": "02ac7aa27d45bdd90304a889a6c2b4ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375095, "uuid": "402ffa72-c091-4d68-b57c-ad3ea82cd22b", "comment": "Malware payload (Mirai)", "value": "5670233c41ef49c506861e988e5639d8716f1db5123a3dde74fda969307706c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375095, "uuid": "04a47950-7ebb-4fb0-b077-6ddb00a89409", "comment": "Malware payload (Mirai)", "value": "6458181c5365c15ae4685b2ad710b1aff3a8c0f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375095, "uuid": "6cde5d83-61cc-40b9-99b5-cfdc2edfcc62", "comment": "Malware payload (Mirai)", "value": "e0bb1b6bfa32fb7d3316cc764651f40dab88c21a3b16765029d874b872c0571023d0269325090dea2f313bacf3ec65a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375095, "uuid": "1ff881f3-7dc3-417e-af04-fd30c10ac5f0", "value": "T180431891B8819A23C5D4137AF56E56CD372123E8E2CF7217DE214F613AC682F0C6BE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375095, "uuid": "c66aadff-1f3f-46af-b030-04102600a3ed", "value": "768:LhSM9DMLSORTIrL8uvehp9H0grZQPyoWKaX3LV3StuR/C71mA2EDEy0eYjW9THvq:AM9CmL8Yip9/FVoWhl8uoQEnfJxMLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770375095, "uuid": "c46aed79-5c9f-4c87-8e24-fa1d86110b8d", "value": 56152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770375095, "uuid": "e34463d5-6034-481c-aa99-75f0967aa22f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375095, "uuid": "11e19e3b-aa16-460f-aab6-49e15b3892f7", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cdbf254-0386-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770401050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401050, "uuid": "198876dd-f954-4f97-812d-00036e96c099", "comment": "Malware payload (Mirai)", "value": "2f261c507b63c15d96a57cdc771acb1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401050, "uuid": "5d39dad1-f686-4faa-8d45-045ff1fc3a68", "comment": "Malware payload (Mirai)", "value": "567efc0e2ca0ffcdc15952c3f7f8af8029d2e42626c09345dab933974364cbf8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401050, "uuid": "7b50b1e2-cf8b-40be-8d22-1b61fb7466ca", "comment": "Malware payload (Mirai)", "value": "7b4f5da21af504bfea0b6bc795b73e25e3296bc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401050, "uuid": "d7e6dd9a-e747-4c4e-b8f2-93b645b860cb", "comment": "Malware payload (Mirai)", "value": "61c92a81169960c7b9311495960641b875d52de60e7f30d772d66a78d65937fb955220b1c46cae0aeaf6eeac5f5e4b4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401050, "uuid": "471ba744-3949-4806-b9de-2105615cfa01", "value": "T11BB3D86A3A21AFFFD06986310BF7AF2087D422D626915383F15CD7585E3128D2C5FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401050, "uuid": "2f8a76e2-8f0c-4766-98c7-c4768d2b4646", "value": "3072:0VW0fIHznlZD5h50qBkxmkizF9GhsRiAe:0APT3D5h50ZxmkizF9GhsRiAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770401050, "uuid": "a0f5dfdc-073e-4a44-b485-fe65b2254f98", "value": 115243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770401050, "uuid": "0ab21c90-3a6c-4fcf-9cbc-269470df17d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401050, "uuid": "948f940a-1018-40a5-ad0e-6812aed8bed6", "value": "skid.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2ecab10-03a7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770415475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770415475, "uuid": "8e2b0a08-2360-4903-aaa9-7337502cb62a", "comment": "Malware payload", "value": "bcfc618ed2c0bdd43d210febbf20a503", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770415475, "uuid": "69406bf7-dd1c-44c0-b77f-c1193e35c449", "comment": "Malware payload", "value": "56d00499eb283d7a803c195a9ff568ec3290c3d7205a3e9f30e65339598c4bc2", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770415475, "uuid": "464df0cf-f354-4066-bdc0-0baea405f272", "comment": "Malware payload", "value": "c80505de95e4a299c124d2ad9b86ea2423f730dc", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770415475, "uuid": "1912589c-d459-4557-b6b9-9e76e191ab00", "comment": "Malware payload", "value": "96f71c43c9029787f8278dad5047c7256ae78868dfe01ea7446e605aa0adab7fca6af184918372d51e5f589724bd2f07", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770415475, "uuid": "046a5547-fb9d-46ea-905f-2b3da63bb21e", "value": "T14AB31B7F1872EF6BFA9195B9500C2D07DC1656F3A2334C1C592CEBE5A5E23043AE86E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770415475, "uuid": "e0944d1f-dbc9-4a18-8a15-11fb90f5e707", "value": "1536:yEyoQ8CAb0G67f7C/8HRic44H6BkDDNd0lOXOEN0P:6/Tu0n7fzic4xqVe8OEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770415475, "uuid": "ae650b41-ab1b-43d7-813f-5b64be691f55", "value": 111808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770415475, "uuid": "123bf092-ebeb-404e-97f1-da3c107d54b5", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770415475, "uuid": "4f1a3e75-a752-4a0f-8ac6-13ef4773c232", "value": "Mandatory_Compliance_Notice.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32604623-0386-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770401033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401033, "uuid": "6fb21d33-7674-45b1-b2d0-f03b747227bd", "comment": "Malware payload (Mirai)", "value": "cef1fa761d2666b505d0d2acb20c3cee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401033, "uuid": "51d4efca-a6b5-4da6-b598-7a256207e969", "comment": "Malware payload (Mirai)", "value": "59367073b13b3ed8e71eb3d54650e6a7182eb55654f3a179e83cbac654c8cfb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401033, "uuid": "84cdf87f-27be-4a52-84c4-0f23f4f4971c", "comment": "Malware payload (Mirai)", "value": "93ca215347518150f88fde2fe52e6ae7ad92f5af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401033, "uuid": "378ce5c3-6232-443c-a348-0348c796df75", "comment": "Malware payload (Mirai)", "value": "b24f68d361b0c5a24a79d2fe3cb80dafd4f31bf03febb8d2b25458fe3e49cbec16d1b883ee9c39a0b7db9928b7f2928d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401033, "uuid": "517b9940-51c5-4d11-9b58-110c79b8005d", "value": "T17AE31945F8518E27C6D522BBFB5E42CD372A17A8D2EF31079D216F20378695B0E7B242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401033, "uuid": "a94efd8a-cf69-4768-9340-9b7b507e51ef", "value": "3072:pKhGCBiKSukyduMJiT544GvtKTYCfhqIX7:pKLiQdjJil44GFK8CfkIX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770401033, "uuid": "2ada7ef9-6037-482e-89e4-bdb6e3b06971", "value": 154496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770401033, "uuid": "88d2f985-e034-4bff-a0d4-c0f08742f7aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401033, "uuid": "3974c214-0e71-43bd-ab98-4a436fd07c3a", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733c907a-037d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770397276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770397276, "uuid": "fab35d6c-7234-42ad-b7b1-bf1bfc58b6d9", "comment": "Malware payload", "value": "37f7b9a0141587098416c3b31429bc4f", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770397276, "uuid": "166ac6b0-c9f4-4d19-92b7-812ce7bb917a", "comment": "Malware payload", "value": "59cc79ff9d3f48eb66c1d1e8139a9257bddf1115d925b641d792ec71e577e46f", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770397276, "uuid": "8b148fe7-910d-4d6f-a673-7d72cbfb8b40", "comment": "Malware payload", "value": "c4a1c66397531c86d710759b0e754898cd8e166e", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770397276, "uuid": "9cb8753b-7d3c-4689-be05-87038de57ff5", "comment": "Malware payload", "value": "88bfb155a67af7fc391dd1f18ee04e874381dc5989223bae1c8f33d856b87249c9ea966f5c650c28b368835d4a763f8d", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770397276, "uuid": "f4f76e9e-662c-44e0-8572-80a5d7ead170", "value": "T156E5331125E5FEA4F5ADC45EB17EDFAC22281C2E3DD8C06CB22A0DBE16597C6C4DC216", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770397276, "uuid": "a8ab9c51-e6df-4fbc-9d2f-654dac802f02", "value": "98304:5VvLcUaFfPKVbDV8GiYcCFpUvjQDSReSf:3ztaFHYXV8jT0p4Pnf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770397276, "uuid": "a7b6cfeb-d623-4c16-a046-23f68f279e9d", "value": 3273864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770397276, "uuid": "388a0a8a-4885-4aa4-af60-2e34138c07a3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770397276, "uuid": "72b40726-dc29-4a5e-ac7a-2f9adbdeacac", "value": "nOrden.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c68dc83-0390-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770405398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770405398, "uuid": "98ca343a-bc2d-4891-92cc-dbdb53202b39", "comment": "Malware payload", "value": "53f6b8fbd8eb8d0b96c26d8d69dd661c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770405398, "uuid": "c795e3d6-4da5-4132-be79-a3dcf610c0ee", "comment": "Malware payload", "value": "5adf8dec18a90f3170616bb0b8d84be0409e0e2bb3d110b87a4bdb0d07ce54a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770405398, "uuid": "b2f41ae9-8d05-4d67-97b2-023f141e1286", "comment": "Malware payload", "value": "0c99c378e4df948c6768fb0032e6072aa2e638f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770405398, "uuid": "5e00a61a-4cc3-4aa3-8594-310869c3c536", "comment": "Malware payload", "value": "add6820637b68407dc25d02fa881318a57e85271bad4770dbaa6ff090f7e7cfaaf41395a07e35858562201dc5959a97d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770405398, "uuid": "3cc00e1e-cd10-4120-8ade-8cb7e685614d", "value": "T1B5C41A7EAC14E327F60CA0BEE287D3534F6578110236BA931CBA972411495739B877EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770405398, "uuid": "ec11cda2-030b-4925-ac47-3e4170ac7adc", "value": "bcf81c3e3a1fe52e7b4dee3f058bfdd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770405398, "uuid": "02368eb8-6ba4-4327-966e-a5193f066918", "value": "12288:4cVR9cLXtGJKYvFSPXLI6zavBjR2+Q40S:4cVR9lKocLISavBjR/2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770405398, "uuid": "abd792b1-253f-417d-96aa-887683dfd9ab", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770405398, "uuid": "7c8289ca-596d-460f-81de-a6c5873a7851", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770405398, "uuid": "186f84bd-ef0c-41d9-bb12-4c7af321e383", "value": "build_69862bdca4e8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0fc9dce-03a5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770414640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770414640, "uuid": "fa39e7b1-95d8-4023-9c19-3bb24a306950", "comment": "Malware payload (Mirai)", "value": "e0ba767615a6b7aec325b203f0cee252", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770414640, "uuid": "da88fbcc-3d69-4eed-9857-013a76bce5dd", "comment": "Malware payload (Mirai)", "value": "5b2d1c29b8ed43cfcb986d567ac88d92b864069000e4e52fcba270bc52970c5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770414640, "uuid": "a420fb19-2fd8-4142-8145-3e37aa3ff3c5", "comment": "Malware payload (Mirai)", "value": "49681668025c3a2edc7a01c75d446f9de0e73c0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770414640, "uuid": "6e5180e2-0a69-4304-9204-1c7f1b8f0a4a", "comment": "Malware payload (Mirai)", "value": "7130554f41b8ad786d52a2bf1a1c1f653413d882a259810eeb0d7fd2b7fa7b1f0aa8da37e31424433a9a3637ba67ba21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770414640, "uuid": "c15b30c1-7745-46c6-870b-cb5c7713bea5", "value": "T1AC933A46BC819B11C6C512BAFE1E118E3323676CE2DEB2229D209F3477CA92F0E77555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770414640, "uuid": "bf4103be-408d-4904-90b4-f8dcb3d6734d", "value": "1536:hlnlJ/NOPXec4f05FrRkK36ATIaR1pXCBdaiS5yd/CBsG5gYJ0Z:7/NkI0pPDkaRHyd/CBsGSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770414640, "uuid": "3112e707-dabc-4659-b887-004520e0e99d", "value": 95544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770414640, "uuid": "82aa7a15-baae-4aa8-a45c-aa3375f5ef92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770414640, "uuid": "64e1b105-7dd7-4cc3-89fe-624ac1e60756", "value": "binary.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6808c3ac-0375-11f1-a129-42010a9c0007", "comment": "Malware payload (XenoRAT)", "timestamp": 1770393821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770393821, "uuid": "7003ccf5-c9f6-4abc-a2ee-fbf10415e26a", "comment": "Malware payload (XenoRAT)", "value": "be85f7bfeba9ed8bbafc50506684c92f", "object_relation": "md5", "Tag": [ { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770393821, "uuid": "1844b522-0f38-4d8b-aeb3-902bccd620f4", "comment": "Malware payload (XenoRAT)", "value": "5db086ff86d440010cbd7db21d0aaf689d37cd967545b0d34dc517a06c477970", "object_relation": "sha256", "Tag": [ { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770393821, "uuid": "bfee3546-bbb1-4e4a-b36a-d4bb67340813", "comment": "Malware payload (XenoRAT)", "value": "02d61a15d73b50d98a5e02f0a11a130012ba815a", "object_relation": "sha1", "Tag": [ { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770393821, "uuid": "fcc4253f-9bd9-497b-b9a1-f6eab0c3cc87", "comment": "Malware payload (XenoRAT)", "value": "e0e6ab4d6fe79df36f3edc2486011da9a52aaa14de3242bd33b8875b5c12931f464ed6d53a10ca36ca0bc87611b5142d", "object_relation": "sha3-384", "Tag": [ { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770393821, "uuid": "bd079148-8cb8-413a-ad96-fb0491f7265d", "value": "T17592E1C733DF9524A7A1586200C2E126D0520CDDCE5162669EBF2CE62C5F894AE978BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770393821, "uuid": "d0efad50-a272-48d6-b016-6aa4379c3805", "value": "384:7zzaf7pCUTVLtTO1BMI7drbL250D7YZFriHj0n6AydK:zGVJqMI7dS5SSkjA6LY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770393821, "uuid": "81983680-f46f-407e-a7d8-4df4c083b043", "value": 20857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770393821, "uuid": "28679742-7619-4a4f-b3f9-5d09ee322c8f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770393821, "uuid": "0026af5c-8e99-4906-b69b-82e845681e68", "value": "iesetup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc78d035-0333-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770365670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770365670, "uuid": "c4e22bd8-07fe-4070-8242-896b19e7fbba", "comment": "Malware payload", "value": "24cbab538874b7201d3e966a632a9a7a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770365670, "uuid": "fccf2ca2-31d2-46dd-8c57-4df01b202e87", "comment": "Malware payload", "value": "5dd94f22ac1bc108c20e4734691a8aea0f1f1e2f536052d4e097ea6be1677a43", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770365670, "uuid": "da948d6b-6e88-4b5d-a029-5ea81e1930a5", "comment": "Malware payload", "value": "6e090e10f7cdbf0c9068e621229beb9cbfb86f30", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770365670, "uuid": "709d8d1e-0d38-4e10-a195-933ab2e74d84", "comment": "Malware payload", "value": "72e579f411a5bd70d5ce44a0181d343764e1ae8ea4947c50980ea2e0832a3dc71e0c6720df7081332d85333352b8befa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770365670, "uuid": "16cd1a8e-647d-4f75-9852-0135c4e4f711", "value": "T147B4DCDE2EC2F15E0F825923F21AF06DF4F598F0535A5C28A4CC1C48F9A16D5BE69239", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770365670, "uuid": "c7e45fb6-6181-4651-84d0-770fb991547d", "value": "3072:Ot7P+P82pvOFv9PfPhP0PTP6yv3vOP1PV4Dm3s2Q6zUqtfINFB8yP/Pzv/PzvJvF:s2yn3s2Q7qeDBRg/V2KgYY8DtoLZHxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770365670, "uuid": "1ebc7d2f-9aac-4f8e-a014-4e71de31078e", "value": 535552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770365670, "uuid": "2b0bea0f-87da-45a4-8c51-8ac66bdce419", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770365670, "uuid": "93a5e48d-67d2-4ff7-9ecc-ad17e0e4afbb", "value": "PO 0489.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a285514b-0344-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770372874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770372874, "uuid": "7ed869e6-12f4-44a6-8bbb-ae8e0b3f166d", "comment": "Malware payload", "value": "c74028c3075fb04370e509759f5ab8f2", "object_relation": "md5", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770372874, "uuid": "0772c317-9ac8-40be-b090-156af7befaf3", "comment": "Malware payload", "value": "5f0a8fb984f5fac8718e1cf760a3f997166ff968df2531a094cf615514072576", "object_relation": "sha256", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770372874, "uuid": "a06d4d43-e781-4c1d-af41-19560d815a32", "comment": "Malware payload", "value": "8e4da325e0b24a897f95366ae1f0aa23115e4b77", "object_relation": "sha1", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770372874, "uuid": "f486b6a6-1353-42f7-96ac-639f692e4b23", "comment": "Malware payload", "value": "51d8ee750c683d4e220875e5395e1eb74757735347ac2c02da60104b8ef23fdd51a4021e3039565c5c63df15eac8f800", "object_relation": "sha3-384", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770372874, "uuid": "6ca1a59a-7c58-4373-a39b-95d21f64a93c", "value": "T1A3223968B371C268C0568D753FC7548A362E7D11A8E8A6B76006B36D04F5E0E2B209D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770372874, "uuid": "f473b608-2f9d-4bac-b79b-30ab0004eeef", "value": "48:+agBva0kQRlEFlErlEli5sGULbGdS52KsErIEGgJGKarujgOX/88Mcc3c50s8gLV:+BvaYcb/52KZ9ar+08Mccs4uV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770372874, "uuid": "74e01a25-8fea-492b-9394-0cf8f10abc81", "value": 10682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770372874, "uuid": "769be009-5781-4164-9cfb-1ff813abda82", "value": "application/vnd.ms-htmlhelp", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770372874, "uuid": "7b7e71b0-d839-4d61-95e1-caf8970a1d7c", "value": "what's up .chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "696d00d6-032d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770362900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362900, "uuid": "f02a1105-5602-4322-a214-50bc8841735d", "comment": "Malware payload", "value": "a34d42ab3a888ee41f47d1569067d29c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362900, "uuid": "ee6fc695-c03d-4a0e-88d3-c5e25416a6ca", "comment": "Malware payload", "value": "5f2955c09b3a7883a3450b230fed00f32d2601077c80e5b10d1b3d5480760c16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362900, "uuid": "b8d514e1-97dc-43af-839e-c2e3a671ea20", "comment": "Malware payload", "value": "6cb683f9eb96ad14ade399ea2ab3e456ee5910b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362900, "uuid": "eca84ff3-b5d1-4da0-bfa2-cc9a6fd12e6b", "comment": "Malware payload", "value": "73a78c686a2a15bcf14dbdeea36e9335060c33d94eef39faa034414ff72db637909059ed1e7394276d6e088bab73dec4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362900, "uuid": "464f394b-475d-4dfe-96c8-3beb7fb03f10", "value": "T1FFF5331C86E0B361DFE574B5BB0BDD465F0033A1CA28F3C9561392EF9D4D276A3A6A04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362900, "uuid": "2d0a53ff-7457-4bc0-98cf-3cf5e3e0abd9", "value": "6934ed3a02a2a030a65365486cb8cb5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362900, "uuid": "4fb55ba8-bfa6-4603-a934-e485636d114d", "value": "98304:7dKhUgypxumKW1YmlAcwZ8CQQHeFXnWmTICV7YimAk:QMhV1YEwK/JnWmTzV7Yhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770362900, "uuid": "99080e1b-9daa-4a78-bfe8-08fef34c73a3", "value": 3470204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770362900, "uuid": "d17224fa-4af4-4136-bb63-d10b5a3984d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362900, "uuid": "84c92f5e-e08f-42fd-a2b1-7ded189ffa67", "value": "SecuriteInfo.com.Win64.MalwareX-gen.54315363", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa945f2-0360-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770384860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770384860, "uuid": "ceab18d2-c9b2-4959-8e8f-ae1c33f0ec51", "comment": "Malware payload (Mirai)", "value": "19db9c845c071e5a9f300acc6daeff8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770384860, "uuid": "da64dd93-f571-43e4-8d7c-6e99923ee8da", "comment": "Malware payload (Mirai)", "value": "5fbe57d352d0106bb7d1d22fca5ebeef08d6d6bffe19b2f61dc0f4427febbdef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770384860, "uuid": "fc50dc0d-7a50-42e1-b521-62f962cf78aa", "comment": "Malware payload (Mirai)", "value": "b921bbcd8655dde0733841e158bad6746143b329", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770384860, "uuid": "195786d4-a62f-4fd9-993a-c17d39c5ef3f", "comment": "Malware payload (Mirai)", "value": "64515cfedf145ca6159e5fadf5c9b4a8551d707e7bade5d4650de387756b888efaa82bb5edf2ba1b10cd048cf28b571e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770384860, "uuid": "93445a4d-a64d-4239-ae4a-eb2659a32217", "value": "T16B745D076B8020BEC192C17057DF92A3E733F4BB1121755E779C9A342F07E616B9ABA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770384860, "uuid": "970794f3-aaf0-4540-8d7c-b9d52a31efb7", "value": "6144:6lS+Rbsm9YXhQMRAOLFSUDwNdqA9AJO9ydQtzEd:6lPW3idhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770384860, "uuid": "c7e8971c-0b57-46f3-90a3-b871e88c444c", "value": 341672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770384860, "uuid": "845dbace-620a-454f-a5db-7ff799f07c47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770384860, "uuid": "e9fdeb44-01f1-499f-88e6-ffb9b97964e5", "value": "2.off3.ru", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d368dd06-0390-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770405598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770405598, "uuid": "6667094c-a9e2-44c6-acff-21dfb455636b", "comment": "Malware payload", "value": "d8259811a30817a0fab0f108f0caf40b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770405598, "uuid": "43ea3571-dea4-4da3-997d-07ebcfacdf25", "comment": "Malware payload", "value": "5ffeeaf5b984521dc92adab9f51e853eed7eb5611154a425986653b7fe9401ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770405598, "uuid": "3d3cb439-1d1d-4530-ad2a-a94987ba24e9", "comment": "Malware payload", "value": "08c655f9123fdb8d4534436872464da3d817c77b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770405598, "uuid": "857ba37e-a88e-4775-ba57-07d5db9e6901", "comment": "Malware payload", "value": "384086899c69548e5aeec381ee6f494462e0007514aa2a96cde2605fd6e68331ba833a700e73a28ed1ee7867fb7a8520", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770405598, "uuid": "20b74fe1-fcf2-42e0-afa5-b57afb599e99", "value": "T163871256E2FD00E8D5BBC0B8C6575517E7B1341913309BEB66A48A692F37BE0AE3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770405598, "uuid": "31d828dc-762f-4485-b4a1-3e7995dcdcd3", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770405598, "uuid": "dd9ddacf-48ea-461f-bf9c-931f8bf1aff9", "value": "393216:kKxapWfkhInr4SvhZ6sRvI9cR8vq/mQFgeyh0LfHPQu2jYvnUwEbc/81v:u4iMr/vbpvuY7Key+7PJsYPUlbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770405598, "uuid": "bef97e1b-2b44-4f0d-8b8d-6feddebd97f8", "value": 36331464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770405598, "uuid": "068a9c29-2f2a-4260-872e-ef15b2d35c79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770405598, "uuid": "d429fe1d-3215-4b4d-adea-8ed615ea4eb4", "value": "MsTeams.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b134bd97-0349-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770375046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375046, "uuid": "ed8aa952-a910-4d8d-9db5-4c00d36a5f9f", "comment": "Malware payload (Mirai)", "value": "fa44d1e4e01eed5f129de271b6cb54c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375046, "uuid": "b8eb99b2-a5ea-49ff-8b84-aee7da0e9006", "comment": "Malware payload (Mirai)", "value": "60ebed0563242cc751164681132c91b120114eac0bf4619be128832087407707", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375046, "uuid": "50315e4b-2787-49ba-a6c5-6ac776d69bba", "comment": "Malware payload (Mirai)", "value": "5d925c2a7917926c49dd9b154174f0ab994c1b31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375046, "uuid": "c3af1bc0-26be-447b-80e1-bcb416a0f5b5", "comment": "Malware payload (Mirai)", "value": "9bec300dd8ff5e3a23161971a3600fa048f63e1f61eece94066f92f2098893563e308ee7bb99adcc7b4da216c57e2196", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375046, "uuid": "9af398fa-1024-4278-ab80-81c7a92515c1", "value": "T16CA2D075E3896AB2FBFD9F3088C1C381A7F41BC536DAC9AB01479B226011496B744DD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375046, "uuid": "6adc60a7-c725-4b43-9fa1-0f05c21be8da", "value": "384:B/gNyF/M84Tp2YshxqlDvRJ6vqG93Gw7M4uVcqgw05VxJL:BoNytlSVsMD56D937o4uVcqgw09F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770375046, "uuid": "60baf6bf-3ae1-430b-bb6c-1a4b5cecd161", "value": 21876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770375046, "uuid": "f842e809-34a8-48d3-8e2f-3732eed92c35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375046, "uuid": "4c6c1a90-186d-4433-965c-05186b85038e", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a917d00b-02fd-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770342391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770342391, "uuid": "826f612f-e3a4-4c77-b2e1-977184044dd1", "comment": "Malware payload (Formbook)", "value": "9dcbf7871f0c7e20634eab8cb4648efa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770342391, "uuid": "19abc63f-1405-4585-8b52-98818bb0728d", "comment": "Malware payload (Formbook)", "value": "6260096294fd508c4091e7376bc96ab489f5a5ce77b349015927dd25d16f998e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770342391, "uuid": "86731de8-9e1a-4007-8ce2-57b419ac694f", "comment": "Malware payload (Formbook)", "value": "c7d5d3594b5b4ceaea632384c438e4b4f1993145", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770342391, "uuid": "20e1decc-b95c-4855-945b-ecb031fe7f01", "comment": "Malware payload (Formbook)", "value": "89bbe443266b92e7cf0062d829bdea66186abf084cca07d61c47edb4f7e5a6e53f7092fbcc00ee5f77139aa8acd9d50c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770342391, "uuid": "71abc371-7838-4e0b-8c4c-20683fadd6bb", "value": "T168D5CF55A3C815E8C567DA34DB14A332C3B179624776E18F0A9AC31A1FB7E918B3F702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770342391, "uuid": "c3ed4f57-8f41-44d0-b51f-7c6f1bf91b20", "value": "bbfb5819a60842d0e7f4a3dc81a561d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770342391, "uuid": "a3198f82-8798-4486-978c-2613690a918e", "value": "49152:jHpJTCoSmmY5sfaAOf5Vv1qctkEmuwf8tBdtzZ1f2:oI0/Emuwf8tBdtzZ1f2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770342391, "uuid": "bc0d276e-fc81-4857-b942-9ad1121d40b8", "value": 2856960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770342391, "uuid": "184131e2-1f31-4a23-8c08-d0d20245abe6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770342391, "uuid": "bb6348ee-2679-40fa-ac25-290de4fc12d6", "value": "edit.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc671de-0307-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770346826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770346826, "uuid": "59c8c6ef-5a23-4fc3-83cf-03e1527ff989", "comment": "Malware payload", "value": "c1b11b385dc592bef056a355096c4bf5", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper:Win32/Malgent!MSR", "colour": "#5C9944", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770346826, "uuid": "e0a3fc42-8cb8-4851-b6d6-a0c0608f0bde", "comment": "Malware payload", "value": "6373afd213310e56556cb1c4c274aab36b34f638964f5cde822416ba2cc5468b", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper:Win32/Malgent!MSR", "colour": "#5C9944", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770346826, "uuid": "8d907a28-c69b-498f-b3df-aa02e78ef29b", "comment": "Malware payload", "value": "46dd6f4d48b92d0ac40f096d3e8fbcee412047f1", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper:Win32/Malgent!MSR", "colour": "#5C9944", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770346826, "uuid": "fb5d9dd4-775a-4c55-a08f-8fcd0edfca3b", "comment": "Malware payload", "value": "234a2ca7e6f2e5cbdf7bf601c4893f8c838fd26592acad506242cadd7034cde5e012785bb0a66f40a9b52b66d4e0d000", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper:Win32/Malgent!MSR", "colour": "#5C9944", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770346826, "uuid": "dd07d01a-dc25-48fa-8d0b-09f167279d59", "value": "T1A918338432D72AFDDD0F11304DED5829A7E4E759B360F56B4960E2FECAE634886624C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770346826, "uuid": "8c1f9bd5-5fbf-4fc6-a720-cf23e61d3ef2", "value": "d39d6dafbef4879a992721cbbb5497f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770346826, "uuid": "57a1bcc8-c38a-4c08-b514-19a9ac1f98ba", "value": "1572864:256LiacclMqcxikp7vs43LPicqktxJQ4M1wFQvhF29Cl:k6LiatMFxikVR3DYAJwaQvh4Cl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770346826, "uuid": "602e54f1-ae0c-43c7-a3fb-560c4f7123e0", "value": 86499874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770346826, "uuid": "9c0bc783-6e1e-447a-9088-efc9f863d5ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770346826, "uuid": "9ab04087-76e9-4c61-8031-bd30941d611a", "value": "7zip_PC_setup_X64.8.1.5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f0bb4b2-0364-11f1-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1770386558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386558, "uuid": "b08b2b70-cda1-4996-970b-ca3ff0205f97", "comment": "Malware payload (VIPKeylogger)", "value": "d38c31aee603791605f687eb0314f0e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386558, "uuid": "b48e779a-ffab-409b-99c1-780c4a84219e", "comment": "Malware payload (VIPKeylogger)", "value": "64864ac10f2be65fe3a7c632f629c20187fe9ca2181f97919d5c46f017a9e31c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386558, "uuid": "4a6347a3-7787-4355-91de-a20e1f4eda3e", "comment": "Malware payload (VIPKeylogger)", "value": "1eae0a57c48f5febbdbad6d197452d54e36a77de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386558, "uuid": "7b11d729-817b-4db4-accd-814482daf968", "comment": "Malware payload (VIPKeylogger)", "value": "7f7af2f412506711902aa22b16f71d876d49320db1b8d59b22af5ba7e99a83c40e3a6311c0f8de9932e15550ff03d431", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386558, "uuid": "93edfdea-fb84-490c-873b-a14286fd60d3", "value": "T1464501E6E4548682F47E463192775E86911E7E238CD4474F2F84B2D29BF728A40BFD83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386558, "uuid": "9d1932c9-8138-4da4-9536-858a0d2c2a75", "value": "4f67aeda01a0484282e8c59006b0b352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386558, "uuid": "d8cad38f-5d50-42d5-87e1-f0ab4ae8bb45", "value": "24576:8EuzpM/MrPdnQtf9XiUGR/RKJSscUGf6YjsysoY:8EQpM/MrZQtfdiUeRKJCfAyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386558, "uuid": "acdb846d-4d7a-4fa4-a4c7-a940b8c21bb9", "value": 1186856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386558, "uuid": "be4cf1ec-08b7-46b0-b3d0-14457db7f7cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386558, "uuid": "f1316a86-d62a-4edd-b6b1-90c4353bbaef", "value": "Factura Honorarios.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "623b6de4-0335-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770366324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366324, "uuid": "ab8930fc-5f4f-487e-a958-71dfaa0b40fb", "comment": "Malware payload (Mirai)", "value": "d303ce306051be499ee53858baef6757", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366324, "uuid": "4a73dd67-6a93-4c3b-8656-dd16d7f84dd1", "comment": "Malware payload (Mirai)", "value": "649086752a8eed466d31e5941c0a7b1fb2755482ab95f8c162781793a1400d3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366324, "uuid": "b68f22b3-2cd4-42bf-8ba7-54a4215478e8", "comment": "Malware payload (Mirai)", "value": "98033afe5e26d5bd3c6e1524c4d93c20394aef4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366324, "uuid": "ce2dfa01-3708-44f6-a149-69893b5989e4", "comment": "Malware payload (Mirai)", "value": "d2c8e5c186757dc3ebec5e0b3bbfa48c805acbbe7738018b6b03ace66bb0c1b7c4e150cff9dcab2697843eddaa7ea1b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366324, "uuid": "07bcf770-e6d9-4010-8963-cc286c23e8c6", "value": "T163F45C02EF940FDBC8AFCD30456E824716EDD9D706D1A33461BC8D9CBA8D66A4AE345C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366324, "uuid": "2c4b5217-6fe2-4e01-92e7-54d6c4afe40c", "value": "12288:WHVr9s8SbF9kmK4CAlxpD+wZxX0aPBlcobQ1WnT3rtH/Q3A8Ln0IAIMcircf488s:TcR0vE9I45tzmG3shY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770366324, "uuid": "a8f074e3-5c88-40d1-b17f-059ac6d4637d", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770366324, "uuid": "1738f760-bc3d-48b3-ad44-217b668a2a05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366324, "uuid": "b554856c-c7cc-473d-bb29-89a7318a33c4", "value": "data.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f54cca5f-0327-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770360557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770360557, "uuid": "81cb4bca-1893-4b48-af48-362524bd8efa", "comment": "Malware payload", "value": "444ffc896b35bd5484b898de7e518a60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770360557, "uuid": "edde4e4b-47b1-4ef2-8d57-3d07e9a29193", "comment": "Malware payload", "value": "64d48c24194a5c6b9f40bc9806751d26fa5a679d9dd37f99b388c0d27a6bd869", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770360557, "uuid": "c53266d7-440d-4c7c-b159-77ed6a88e3bc", "comment": "Malware payload", "value": "95af5462ea833e8628ab2794ab4ac77a53242482", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770360557, "uuid": "74cf0e5c-81e8-49ab-ba29-d58f0ec1050a", "comment": "Malware payload", "value": "be30b853466615c6bdbc5c907f08ca05b1eca2c65fb024d4a2d2ec55a3808cc68a9316e59cda72e9ae1a921558a85de9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770360557, "uuid": "0f6c5ffc-3d16-4189-9324-98fe2ccf0263", "value": "T1D0935C02B70C0E43E1675DF03A3F27D1D3EFA6E121F4F688691E9A4591B2E325586EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770360557, "uuid": "6b7531fa-0b09-4cc8-9df0-35a8c60aada0", "value": "1536:OPzE4Soc0Tgbr2/DHSiRQJpla3/3pxShmOLyIyrWCLpADKo8aR6TZMeXyCr70QUE:ogrv0T7xWzrUADStMFCR8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770360557, "uuid": "1d568531-da44-4d83-b27b-964f71f438f1", "value": 92048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770360557, "uuid": "7e27b3b8-461c-47f4-a508-254c8894953c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770360557, "uuid": "6b19911b-9260-4021-b991-f4178ea137cf", "value": "titanjr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87c92b8-0373-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1770393070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770393070, "uuid": "c6acdee9-5edd-40de-bb88-3bdb82a58739", "comment": "Malware payload (XWorm)", "value": "58ddd8aa1c507e880e69ae46d32e3bb2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770393070, "uuid": "a5a1bd8d-e941-4845-9ca1-1c9bfd25fa70", "comment": "Malware payload (XWorm)", "value": "64f193f69282ed474748c58916fb2f9f1cec2f0c9ba244f75f1a169d7b232a11", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770393070, "uuid": "372bb0c0-454b-4fd2-9c9f-895852c00978", "comment": "Malware payload (XWorm)", "value": "5bbb6d78bb980b1dd8a4c01d9015ce42f5e752c3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770393070, "uuid": "feaaeae2-bbff-48f4-9220-eff6a22b07dc", "comment": "Malware payload (XWorm)", "value": "aaa591f3e792b171ede25e03205edc2faf95880c666c81766ee7084666e666e2b0704b82fc178e8705eb6d6e21cbf359", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770393070, "uuid": "7c9cee41-fe7c-44ef-b55c-7e98a049c8d3", "value": "T13FE501DB1D2186F3DA9EF47022B3377D432F997D6BC3AE5CA60B6E98537804D46A5400", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770393070, "uuid": "dfc63a48-76a5-473b-9ac1-2477bf531311", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770393070, "uuid": "014be721-4434-49b1-b2e6-7545b5686251", "value": "49152:+4JWnSop68aZlF2yk5mDPlUXbs1UCeiPb3BMM9aqGGA0oMhcMh1eCQfJEYTJh:+kWnJrAH2yk5mDPgbsBj3BhIgNThcQ03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770393070, "uuid": "44ce8e15-c4ba-4195-af97-6a662718f096", "value": 3052032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770393070, "uuid": "c488efb3-112b-47ef-b7d6-6ada2298a9ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770393070, "uuid": "1e319c54-bcbd-41a3-9c21-6f4936eae387", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091f9e4f-0364-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770386360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386360, "uuid": "6d462768-5116-4036-9696-4971d8bff7a4", "comment": "Malware payload (Mirai)", "value": "f6258ca4aa9d9f4009c72b7670612e67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386360, "uuid": "cc24a1dc-c770-41a3-bc31-55436d9809bb", "comment": "Malware payload (Mirai)", "value": "651badbc0b0fb921ba265a0b2e45d85c545e84176d561b015a7b4f69e6485597", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386360, "uuid": "782dfd4d-a301-4593-9e58-5dd05fd8e363", "comment": "Malware payload (Mirai)", "value": "df724aad441aeb56dd1cbb96a510a914413a8362", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386360, "uuid": "53e62180-c5c3-4168-ba53-c1a6ae14f3ca", "comment": "Malware payload (Mirai)", "value": "cefd8bbc2e6a071bc46740feef79b24d46f5bde9da2832b1bf5306eb480a4ba3634dfc56a0674f4719ed9ced4df3d6c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386360, "uuid": "aad74199-0652-4bc4-87ad-d4243d478b8c", "value": "T1186302F836EB8034E0DDB531264F22303371DB9A942B93ED3E85B5D8F6565640917BA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386360, "uuid": "5488e80e-e8f0-4e18-a94d-e53144ff34bb", "value": "1536:hltrI7mDmde7Lletk8cghgLFPjihgulh6DoIHA+rPd:hl+YmdkLMk8c5PdulIHXrPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386360, "uuid": "fe536316-f9ea-43aa-8342-f3bc49fe3968", "value": 70848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386360, "uuid": "f5695862-4734-4160-88e0-11db7b76055a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386360, "uuid": "d7e0506d-ca97-4679-86e0-f3fd110cb725", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "675c49db-032d-11f1-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1770362896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362896, "uuid": "6c9f6af9-cd8b-4b3c-a871-d63bda719adc", "comment": "Malware payload (MassLogger)", "value": "48bc89b7e6f0e424a4693bde6e4da5d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362896, "uuid": "444d0816-2510-4a5a-ba80-a868719c28db", "comment": "Malware payload (MassLogger)", "value": "65386f7569aa2948f2f15e780c8cff3cd01fee3865bb92a1fd54a02b8a8c1175", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362896, "uuid": "ef094eab-2f8a-4942-9af5-03b1d29e4789", "comment": "Malware payload (MassLogger)", "value": "03ae495f0639180ad540e21168775509000d9ad8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362896, "uuid": "8dcbddd7-bf7a-4db2-994c-aab4cc9ad8a7", "comment": "Malware payload (MassLogger)", "value": "7cc04432f3f07c44212aa06fb689837e64602a79dd1e57cd63822c61ddbe346074af3de3249aa0f9713b0b065fe793e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362896, "uuid": "d7624332-a444-41dc-8651-5dac91de1656", "value": "T18826332D5F2B5923DFE8A5FF1F191ACAED0C974B2806F2B92A37D01C5D5887C820651E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362896, "uuid": "1a7782f5-a764-4147-91a9-545a05a21c71", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362896, "uuid": "d2367b2b-81a2-4a6b-a005-08b5b9781ab7", "value": "98304:0xMD1ocr32z9FB0JVWhpqSwl3R1Bf8OyWIKeKNnOeFaDJfyoa8rIX:0xMDDr3PJVW3qSwhh8OyBsnOaaDJra8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770362896, "uuid": "95bd8925-1297-4e4d-932d-cf1a890fe869", "value": 4742662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770362896, "uuid": "30ab8f98-4e86-4715-a87b-58082ee979af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362896, "uuid": "55ccdef7-72f6-477b-b3f2-2167e7f531b0", "value": "SecuriteInfo.com.Trojan.Siggen32.22788.22851.16708", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e22fd51b-0359-11f1-a129-42010a9c0007", "comment": "Malware payload (MillenuimRAT)", "timestamp": 1770382000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770382000, "uuid": "35b3401a-3419-40e3-ba8c-c7d98dcf8faf", "comment": "Malware payload (MillenuimRAT)", "value": "83cc7dc0b212e8f5ae5f21f66e527e49", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MillenuimRAT", "colour": "#1F3A5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770382000, "uuid": "a0562fae-d634-41cf-a13e-fd9d67a92d12", "comment": "Malware payload (MillenuimRAT)", "value": "66bf111030a2e22db575c0b7b7b677208745eef8b44265bb4259f41f126f1bf8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MillenuimRAT", "colour": "#1F3A5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770382000, "uuid": "8f588079-aef3-4ace-8ead-8da7d551cc57", "comment": "Malware payload (MillenuimRAT)", "value": "3b1c9ed95e3fcf2439f5ba4527a68cddf4d580e7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MillenuimRAT", "colour": "#1F3A5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770382000, "uuid": "d8a751ff-210a-407d-b766-55a34a278d6d", "comment": "Malware payload (MillenuimRAT)", "value": "600064c7159c8537534551bcc0c64c355cbc6a455b22998ed46565026e7be7c13eb631f556171e8b934c1452074ee1af", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MillenuimRAT", "colour": "#1F3A5A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770382000, "uuid": "65f6bb8c-83df-437f-b59e-64759a3c3501", "value": "T1AAC59D61F782D0B2F5E301B056BFABF64D387631572594CBF2C01E6959206C27A3AB1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770382000, "uuid": "064d92c5-e5c3-4150-97d9-c8df3e1e4bd1", "value": "0131b5b473cafe75a5bb1e8916187db2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770382000, "uuid": "d749e566-d933-4639-b19b-65b39a1c96b6", "value": "49152:RVYiIY9XX0FByqrRcmGWJn6RvGfgEkXA5JDh1O1jok0UmSg9MY:BtXX0a2RZGEn6RvGfT1I1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770382000, "uuid": "67d88c57-dd7e-4d28-96dc-025b3907e26b", "value": 2743296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770382000, "uuid": "f3f1b250-8f10-4225-9133-2a529041023b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770382000, "uuid": "d154d957-3ccb-48fa-bfc2-c0c3a2c44e29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "687b7cbf-03af-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770418733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770418733, "uuid": "a7708418-e32c-427a-b843-df53fff87a16", "comment": "Malware payload", "value": "7333a243a53f0b29bc7325bb2450b881", "object_relation": "md5", "Tag": [ { "name": "TGR-STA-1030", "colour": "#BFB2E4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770418733, "uuid": "ea0a4da5-de6f-482e-ba26-a3a4ce0a036e", "comment": "Malware payload", "value": "66ec547b97072828534d43022d766e06c17fc1cafe47fbd9d1ffc22e2d52a9c0", "object_relation": "sha256", "Tag": [ { "name": "TGR-STA-1030", "colour": "#BFB2E4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770418733, "uuid": "a77e5dbb-972a-4e84-82bc-9cf0564e1490", "comment": "Malware payload", "value": "683a4c997079c6f0d0c363096075cee2c7e4e843", "object_relation": "sha1", "Tag": [ { "name": "TGR-STA-1030", "colour": "#BFB2E4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770418733, "uuid": "e5191587-97f2-4b5f-915b-91fc389800e4", "comment": "Malware payload", "value": "d3d1c2a649f8de742c8d115ca7c7a00ffef6864ca80fcf8170084737829ac2589f638a8af0fa38aea04de2db48ae6734", "object_relation": "sha3-384", "Tag": [ { "name": "TGR-STA-1030", "colour": "#BFB2E4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770418733, "uuid": "65d72731-ec00-4892-8e94-ab512c9d2abc", "value": "T15E730218B941A527C778A5331B59327427D4D29EA7A6EE0E2D534C3ECB4F49E2C8AF10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770418733, "uuid": "8627b9d7-c99e-4add-adff-5f3bc9fb915f", "value": "1536:HTnw7ayuWg3DvYRm1kNM5sjd578O7HNzhJx0k/FRQV:zkuWCYRdNM5grIYNrTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770418733, "uuid": "f6058304-a539-4582-a978-68cf18b9433a", "value": 76091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770418733, "uuid": "1939b828-0cf1-41e8-8d7a-82308d409612", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770418733, "uuid": "a121eaeb-c426-4537-8f22-a4167fd72f93", "value": "Politsei- ja Piirivalveameti organisatsiooni struktuuri muudatused.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cde0771-0364-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770386367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386367, "uuid": "9ea07df5-f365-42e9-a74e-ed59d44b35be", "comment": "Malware payload (Mirai)", "value": "8fede7179a592377a68de836d7a62adf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386367, "uuid": "5a79eefd-c5d7-4f65-8dbc-7f38030399e6", "comment": "Malware payload (Mirai)", "value": "676f96d7917701659be60980f72229ef13468fb8d252ca440fb3cb32351a8cb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386367, "uuid": "015c9171-bb1d-466b-8224-414a7f11573e", "comment": "Malware payload (Mirai)", "value": "8c20bedf564d238336dd75bd945adadb1a9cd1d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386367, "uuid": "d3177d01-a616-452f-af74-16eb4ac831cf", "comment": "Malware payload (Mirai)", "value": "18e342791e35855235da3ed5e8bc2a72578d33abf08e096f69f78c0a330de89c184bce356722442224bd852167ce0256", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386367, "uuid": "33a9c758-097d-4696-bf34-f12f3294c0da", "value": "T18604392F258192F0F6411B746BCFD3976C390BBF51A9909F6B416329B6E0B7BA02C447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386367, "uuid": "37ced5f4-2d71-4752-bf45-448d36e8a93d", "value": "3072:7mflblbBDfvNUZem/LVA7bGQU66gOVNLddnNgRdgJi55wTUX9:7IJ5k1DVA2nDXNgEJi5agN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386367, "uuid": "796505bc-d919-4d82-9724-1bf8c5b76612", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386367, "uuid": "49e7409e-e072-4695-b43e-5d0421eb7eee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386367, "uuid": "09ec505d-f967-492f-b516-32cd00a06f84", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fbafb99-0364-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770386372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386372, "uuid": "6d562821-e3d7-486c-a6ff-303679cea219", "comment": "Malware payload (Mirai)", "value": "14b3f59c6b644dd83a1618ab5be92dbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386372, "uuid": "4a3e2b03-b249-4182-92c1-3a2bb0306a9c", "comment": "Malware payload (Mirai)", "value": "68adace32b0c58038f40b6e1e5944b45d538b9235267eaf784fc59154e05e0b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386372, "uuid": "1c5d4904-5c9d-47ba-9ca6-4335f75d7d56", "comment": "Malware payload (Mirai)", "value": "32dd6993981211de4c2f6c914b0da090768ac542", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386372, "uuid": "2ac9fd6f-b275-4adb-b3c9-7c3b4bd63cc3", "comment": "Malware payload (Mirai)", "value": "66656efbb7f5dc5bd9dff3ebe035952e1773f90f2e9eb313f472ff311c222320c21999017f6a5fa3ccfd5c8a81787cf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386372, "uuid": "1e73c6d8-ff02-4c7e-ac69-ea959afc7541", "value": "T1F0D3C021E4006DD1EC2129F578BA96BC0350EE700BDE1582EFFDE95E747BD94386E2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386372, "uuid": "25e2f49b-30a0-4e8f-9fc1-a0867594898a", "value": "3072:PHiBTNkAgcly+hoVpE6AKUjq+8biA7JBd/xL:PCdny+hovsmzbisJfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386372, "uuid": "6366511d-3b19-44e3-9e80-ccd0252d58ac", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386372, "uuid": "022782b5-0dc4-4b65-a8d8-00629aa93234", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386372, "uuid": "55e3e802-5ed7-43be-a824-8d8715580355", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d801bbd-0356-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770380596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770380596, "uuid": "50ed0e98-9495-47d9-9bec-e9c258a1aba7", "comment": "Malware payload (Mirai)", "value": "b155c6f884e97af62b758b93c5d99f3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770380596, "uuid": "59589a99-76bf-40be-ab7d-6bb991f7952d", "comment": "Malware payload (Mirai)", "value": "691e4005eb87ca2b17d7d631f9d273dd3cb2f1d7b8040630de6e64d7265560ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770380596, "uuid": "4d5609d1-108a-4c03-8ff9-6afbc4b18e5e", "comment": "Malware payload (Mirai)", "value": "38c2e9972a7a9380b89241baf8dab1c24b90a5ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770380596, "uuid": "d99f496a-115f-4065-9817-578e6f4e8e0a", "comment": "Malware payload (Mirai)", "value": "cc7c61a36e8c902266b219edead32a7f4529f74a0a4457b5a61b077c0c36e4bd1854e5e2a3086322834fb48264086d7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770380596, "uuid": "99712b81-5f88-4fc9-8e57-469ff87f19a3", "value": "T10CD30945FB414F12C4D721B5FA9F42593353ABE8E3FA710299206FA037C66DB0F62A16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770380596, "uuid": "e52a0040-c2af-4d2a-ace6-45eb57e8ede5", "value": "3072:7IeEn1EQ9nhgDxDCS0aeAdSc87RlgWfLoU3rJnowM/R6:0eEnWQfgDlf0aeAdSc8FhLoU31owM/R6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770380596, "uuid": "f54ef5b4-b6b4-4058-8e6b-8f1e3cb3bf3b", "value": 135768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770380596, "uuid": "d29d283e-c476-4ee6-ae5c-ebba63ccfba3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770380596, "uuid": "acf0f403-c7c6-4c2e-97d9-30ee731cf1cd", "value": "odin.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea9163d-037f-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770398074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398074, "uuid": "2dcc465b-56ad-477c-ab09-0c3d7c14261a", "comment": "Malware payload (Gafgyt)", "value": "32cee28bb850c17b5c23649551a76bb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398074, "uuid": "9778d026-ee9c-4e0e-bae4-cb46c7a2a7c1", "comment": "Malware payload (Gafgyt)", "value": "6a4b22342dddff57c33c173e61a8494bcbc069b8d436f02093f310ca64f91537", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398074, "uuid": "f5ae2d58-85b5-4bb4-a7aa-22b5b778677a", "comment": "Malware payload (Gafgyt)", "value": "ddf5a77a6004fcdc0b7a206f572533f564ba31b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398074, "uuid": "2269f90d-ee1c-411b-917c-25dc784dd7db", "comment": "Malware payload (Gafgyt)", "value": "09a9fec112ac7a2a740da725b2e3743f72de46c10e156caaae3f4472ec3724e9a3f4a6ab90861013f109210ce27592b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770398074, "uuid": "0ccb1b44-1211-4c70-88e7-2a53abf765dd", "value": "T1B5A32B05F9114763C1C327BAF68F474D3B2267A957DB3302AA357EB02FC27991E25A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770398074, "uuid": "8252204e-d039-4463-aacd-a711094896dd", "value": "3072:IG8es2aOtL5haG4uKtvmCyrQ0Knm4XnTe:oeKOtL5h6uKBmCyrQ0Knm4XnTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770398074, "uuid": "dd1f278d-56e6-4d68-ae7c-dc83f7ba0182", "value": 103742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770398074, "uuid": "e011b84e-371f-40af-8fa7-40508727637f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770398074, "uuid": "5125798d-c984-4f02-add9-175e9d105db7", "value": "skid.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a64be7-0387-11f1-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1770401791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401791, "uuid": "2a581c3d-b19c-478b-ae2f-ec092ae312e6", "comment": "Malware payload (njrat)", "value": "428d854c24864d805aefb8dbfdda5cf7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401791, "uuid": "ea502e8e-bae6-4db6-a0a0-05c2dd437861", "comment": "Malware payload (njrat)", "value": "6b29410940b87a62217e9bcfec205f23b054053be4c035e43c5a9ca05fe6f241", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401791, "uuid": "fc275171-236b-4a67-82d9-5ad22e654a8b", "comment": "Malware payload (njrat)", "value": "b31412f3d4dc390604746b9eb639551e32914d84", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401791, "uuid": "37ae2f67-b53f-48b6-9b15-f5b737ff8cae", "comment": "Malware payload (njrat)", "value": "5d5acf83a4698ac657fcf3901cef7ad769a930d42ab5b4160c2e2d12b60b1eddbef6fc380428ec04758ba03acf580f30", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401791, "uuid": "6e7ec50a-acf9-4d3c-920a-751f9751f292", "value": "T1663533326FDB1FDCF07432F42A4170614B7DF6574721A82A39D721F28A766BC2A0B619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401791, "uuid": "97406674-fe91-4cb8-9f59-061c7f57af90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401791, "uuid": "cd8415f0-b6a7-4717-a063-e45518f6033f", "value": "24576:QLqUiAgjqpoqIPewpKJJNT6ZsaGs6BVY0eSjV/D4/pjilEf8eV//SxLDV9:QWDm+emyT6Zv+BMSZ70jMeV3Sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770401791, "uuid": "8a0b35d6-4ccf-49d6-88d6-1b0334398035", "value": 1084416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770401791, "uuid": "098f81c9-e438-4be6-bce5-ad161b2e6032", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401791, "uuid": "fb106ac0-438f-4a09-982e-db081b5ae3d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda4b57a-037e-11f1-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1770397911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770397911, "uuid": "c4742ad7-fc67-4c6c-b22a-4aecea211e2c", "comment": "Malware payload (MaskGramStealer)", "value": "5cb1de8ad8cded1f663ef4abff1bcb0b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770397911, "uuid": "19520182-5cb3-4cf0-bda5-a41dda067e3d", "comment": "Malware payload (MaskGramStealer)", "value": "6b89b739b52e5fd5a612512bc8631f8a514aa3d94300fffd0a437483a8299c0e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770397911, "uuid": "39900bd9-23ef-4adb-ad35-d7e62faea41b", "comment": "Malware payload (MaskGramStealer)", "value": "74643455459db064e5a18608f0bfa3915b519aa8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770397911, "uuid": "8647fb1d-4b25-45f9-8ac5-8f0f7e832295", "comment": "Malware payload (MaskGramStealer)", "value": "6a2c9bdcbb3534cbfff1aef31ce87f6aaf9335b8f7a06ceb331abed76e03a4be47a9b0835b5c2b66d47351a3fae1b793", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770397911, "uuid": "8442d3c1-6335-4b9e-b481-5bfd59e3519b", "value": "T12CD533B88EF4C766EC4F20352261C51D2A2650B4EC667786E2C637BE3CFA1D21DB4275", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770397911, "uuid": "ce61ee52-c9b3-4613-900d-4899ba89e318", "value": "3a8632a6ba7f7c06aaa289e4406ae495", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770397911, "uuid": "187a508e-f2ea-41bb-af44-da4d2fbd7883", "value": "49152:prrexc3olU0trWT2GUGx3sA+SDRyU5QuRnsHYSu8k0d8bRyIYraLi4cX:mcACzUK3s3StQunknl/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770397911, "uuid": "27fc4f5a-7aaa-47ac-9ee8-40fdd94d0dff", "value": 2816000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770397911, "uuid": "78c0db9a-9755-4a97-8fac-1c1b9a008980", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770397911, "uuid": "bdca97e2-3027-4e22-bd51-5b6b3821af17", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1288f2e8-0364-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770386376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386376, "uuid": "bca6566a-7eb6-4dc0-85c8-4d6f3b913ba4", "comment": "Malware payload (Mirai)", "value": "37d60b1c92d66ee65e2d5af2e3557087", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386376, "uuid": "8059fa4a-bbc2-413b-9f46-af7f4642d2a7", "comment": "Malware payload (Mirai)", "value": "6c3084719885b74ddc4df94315b1e69b8437932c97cf1285991714e07b24a1dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386376, "uuid": "8babd6a9-ac3b-4d22-a70a-0f48b8c73555", "comment": "Malware payload (Mirai)", "value": "92adb2865eb237247c51d06552c4acc8fee5d656", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386376, "uuid": "8e2a0a0d-90c4-4298-aff1-5ace8a1f6f32", "comment": "Malware payload (Mirai)", "value": "65a6a3e6d337cdffe72b3163747ce040ed2cd40bd76b56f1436e700f4b52b1499bb9fae0079257e82d14205b509164b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386376, "uuid": "3311e2db-cdf4-4f17-9444-e45adcc36443", "value": "T148B3BF87B2907ABEF0A45E3FC4135E26E6259F705583273D71BDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386376, "uuid": "89a2d570-d408-4f5c-b46f-0724100af03d", "value": "1536:toOxCg+uUGWkCqYUqwaJ1XqfXg5AcS5blaZeCtjHXNLdCS2T15OvhSkzV8rSx:t1xKlGWnqTUcXgZS5gZ7CSXhSMUSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386376, "uuid": "5ce45182-4851-46e3-8598-4b3e5aa766a5", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386376, "uuid": "8c23c6ca-ef3a-411a-84d7-ce67d83f8de6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386376, "uuid": "e1684264-c3d0-4af2-a6e5-de820f332cba", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c548e719-0363-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770386247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386247, "uuid": "d2d2cda5-6b54-4b98-a9e0-e135c2116f49", "comment": "Malware payload (Mirai)", "value": "8bbd5b08a89445a18f4940b782c0f9d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386247, "uuid": "ffcdce37-2dbf-404f-a50d-cb6c6fde2008", "comment": "Malware payload (Mirai)", "value": "6cb7870aae63066b377daeb290a0b423b3506af433b042925299146eb6c0af9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386247, "uuid": "53316020-0f7b-44cf-adc3-2fd10c49b54c", "comment": "Malware payload (Mirai)", "value": "089111758729cc7d53366d752935a25259cf0c2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386247, "uuid": "903a1843-9374-4612-a2e1-f339e6f44606", "comment": "Malware payload (Mirai)", "value": "4c83ac9509c2fa061364621c1299c485c542b2fa4d0af9948bb00dcdf58a9c7aa582a9bdb96f8e48e8a4cca624b00ccb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386247, "uuid": "b0d5a59c-fc9f-4df4-acbf-f5d1d4c2a7e3", "value": "T1C553023A2A60806DC474CA375F5CCDA187BA01589B68815FF96EF5BF2E41D00F560E2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386247, "uuid": "4c145921-f405-4a74-a1d5-009f32e42cdd", "value": "1536:zoZ/Yzn9l6maZh7RybbM6EwryUxNW78z77SsheN2zcAQR:cSn9jaBybw6E4yUu707bheNkvQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386247, "uuid": "2b36e01f-ca52-4b07-9625-9424e97a65c2", "value": 63912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386247, "uuid": "00223138-ea02-4f47-9969-f6f93ad4dfc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386247, "uuid": "52f649fe-f8e3-4bb8-8da2-a44a6bdee54f", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d0f871-0335-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770366330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366330, "uuid": "710d2671-af84-46b8-a41b-a0541a08c133", "comment": "Malware payload (Mirai)", "value": "ddf04059a0d57759f9fe98030b571856", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366330, "uuid": "46b70386-90a4-4278-bad3-215128c25d68", "comment": "Malware payload (Mirai)", "value": "6dcd74c104a19098a14fdb872588fe9c7e88dd3e4877179f3fcddd6a7b97b3e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366330, "uuid": "dc262bf0-c924-4325-a319-fdd807768b49", "comment": "Malware payload (Mirai)", "value": "15f389c54b2286d87a7f3cb7e43701914202419c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366330, "uuid": "36385c8d-f427-4093-81a0-68da8ce58871", "comment": "Malware payload (Mirai)", "value": "e08a1806ded66a2f78962a1bf57a0b1af8a8be30552686b613f97b9a5b980f14bf5fefee69a3ed3cce00ea7ac927ea58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366330, "uuid": "84c949c0-14a2-4c76-bab8-0ccb8d349d8c", "value": "T142056C4BB2B374BDC057D53443ABCAB2A935B43902226E7B65C4D6303E27E701B19B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366330, "uuid": "8932c07a-8e6c-4ad8-b869-2ea8ba87e2a8", "value": "12288:uImy0d8D8L24R4sBND/2kNkQuC/BvoDvBcxtdUkiXherQv5UAdzuFh/Jykts/Bcd:uIAAK4sGkNkj8QDZcxtdamQtP/P8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770366330, "uuid": "32dd4d05-04c4-4250-bc32-c20b3d1b06d8", "value": 866824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770366330, "uuid": "8a478a21-1b82-4b66-9e18-f0c1bc74ae0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366330, "uuid": "90fb3b7a-1bec-435e-9f26-0c4bfb79372d", "value": "data.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "776261ba-0346-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770373661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373661, "uuid": "e2b728ed-5cca-4408-a149-586a1d7fc725", "comment": "Malware payload (Gafgyt)", "value": "88001c6b7c389a06da829f4ccf5a467e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373661, "uuid": "bbc43c55-b1d2-430d-866b-b6a12f4778e2", "comment": "Malware payload (Gafgyt)", "value": "7032c0c5757ec11ade97b14fa59169f9593afb49d6f6f1469c388c3642a5f165", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373661, "uuid": "a6151fb7-37a4-47e9-9e65-720d40e76ce0", "comment": "Malware payload (Gafgyt)", "value": "e080c5e15b61158f1bf3ffb75b78a7bb0468cac3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373661, "uuid": "da314fef-89fb-45a6-8303-58ee7807e0d9", "comment": "Malware payload (Gafgyt)", "value": "a822f2fe6beede1649b8d0b708914f52b7c3d3fcab3f7278c7142d1380092d8f697fb6fd1677ccbd3d0e6cbd73a8b1ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770373661, "uuid": "856fd530-edc2-4793-8ea2-26ac70b1ee6f", "value": "T1FAE30286DE52D2F2E54341360086A76FDB78DD254448CAF6EB8CBF30F9E0782556B0AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770373661, "uuid": "19f1c95f-b86d-4842-9b5c-684caca15da4", "value": "3072:qa3z5a9yc6DpEBcsAG1K5MLIIBl7k2Pp2/KTeCaI1Rl6:qqm10gAGs50Nkn/KTxl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770373661, "uuid": "49f9d429-7baa-4170-8ba8-53fc1a263a37", "value": 149030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770373661, "uuid": "2d9c5f97-ab01-44d5-8cfc-b66dffea0195", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770373661, "uuid": "42e228bc-0802-47eb-9fc5-70c11f698ae6", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "672c3592-03a1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770412718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770412718, "uuid": "bc04c17c-7107-426e-82d2-ba2f79196a09", "comment": "Malware payload", "value": "ea937575f73581512e0a286caf437570", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770412718, "uuid": "7dad9925-edb5-468e-9205-5e5e39731052", "comment": "Malware payload", "value": "707dadaa840fc2eba2909470de1e6788c5564e0f09d90d66f6cd478b2d8ae306", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770412718, "uuid": "4c497db8-97a9-4267-82fa-a75544d6f636", "comment": "Malware payload", "value": "15b5b8acb53fd029b4b84ed470092ea2bfb46e73", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770412718, "uuid": "e12bfefb-d26f-495c-a653-a816402bb8b1", "comment": "Malware payload", "value": "593443d0ab3d4d38c4654c3c953e6d195f9a212de97d17b292b6f0a52c21ba961161711e6874cd40b0af73ab8f906b8f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770412718, "uuid": "f836f080-dfd0-4a6f-a759-bfddceec9272", "value": "T1C5049621A3FD5108FAF73F80ADB462645E36BCA2AD79D2AC1261104E4AB1F40DDB1737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770412718, "uuid": "9d49cdbd-704a-4f17-a7b9-f37bf7a872ee", "value": "1536:Ly5o7io75o5kmXqIP8ps67D4yJV+y3MRz2wgr5feDErRNIXKaSqIP8ps67D4yJVH:Ly5o715o5kmaOc/aRz2wgr0DEr2POc/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770412718, "uuid": "25047faa-b45d-4947-837d-b5a90e7ebacc", "value": 182612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770412718, "uuid": "e2254f21-5f85-41b1-a74d-79c3518ed58f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770412718, "uuid": "50a908a6-3309-445f-b4a7-c1fa1bb2abe1", "value": "Rate_Confirmation757389.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6edf8632-0346-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770373646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373646, "uuid": "cb578f49-4ffd-482e-ab31-6e153cc72434", "comment": "Malware payload (Mirai)", "value": "43792e9d0b36c5c7a0b611a8e9442c9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373646, "uuid": "8b0b623d-93d5-4577-a32a-0b799cb7be7a", "comment": "Malware payload (Mirai)", "value": "7245fe97e40a8f4284923a4d9234b08d4bc80fee38d453499f1070d517e1ddf4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373646, "uuid": "8f1783b3-c0e8-4080-91e6-aca44fe53d93", "comment": "Malware payload (Mirai)", "value": "849070a0a3d299126e97750fbdb1d7a5a7a4a540", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373646, "uuid": "16de4767-4c06-437d-b329-2f17c75c49c4", "comment": "Malware payload (Mirai)", "value": "3cfaff28c729adc5371dd63d37ceeffc64d1a5bb082c4c1958f1dc33d70c5ce7dc5befdb22b20c288da0d85e648c8a80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770373646, "uuid": "acff2314-2cb9-4080-b143-59842ddb0b33", "value": "T1FFD30182E6D140AED0ABC2F8429B93277433F941336AB71BA354AD622F17F531B5D390", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770373646, "uuid": "3290c1f6-944c-4f75-b77d-83673cc574ae", "value": "3072:Nov4QV8UG0iM9Qd0Rl0HsxyiPO3kL2XXG/TJLUFg2UZk0PASJKRmM/x8:Nov3OUG0plgYlG3kL2oT5KUZVlgRmMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770373646, "uuid": "b15994d4-ce7b-4059-a46b-1f2d05fd96ec", "value": 137632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770373646, "uuid": "40fa0584-c3d0-4f0f-bcc2-31a1a49ae545", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770373646, "uuid": "1e56bbda-2362-429a-a27a-7fbf919bb075", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53c1e42-03a3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770413815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770413815, "uuid": "c6f929be-e313-427d-b8f5-568dad871d17", "comment": "Malware payload", "value": "8ef17ec60114c968e22ea715a259a197", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770413815, "uuid": "9bdc76ea-a0b3-4bae-99df-616b18fc0f2f", "comment": "Malware payload", "value": "7316f1d4e4fcba5ae38ae97f51eedf94cc2dd165899a256a6bf5f11708f96d4c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770413815, "uuid": "9e34f3f0-7a0d-46ca-b165-10cb29176a9e", "comment": "Malware payload", "value": "7f183aaf645d8bef9c37e58390be7a91dde15f4e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770413815, "uuid": "6e4835e0-7713-4fc3-b237-e6e2bef4c164", "comment": "Malware payload", "value": "52add013cd3c396acc346cd9a798c230a27ba69d4e1c4e46721d5f680074f47db7223888cd8117b51d26bf2591e4f8df", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770413815, "uuid": "2ccd55e5-b35b-4918-a258-074306ad90e0", "value": "T1CA14128D9E308708C8A741BCE6446D0E125496EB3FE8264D49E6C73FD8E8716FA31672", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770413815, "uuid": "96a89e89-f06f-43e1-b93c-6ffe868e5fe8", "value": "ee53c10aff1d01eafea53328179e33a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770413815, "uuid": "cf2af9e3-bd7a-4d4c-83c2-a8b204909a5e", "value": "3072:ydX1Hb253+sb07306+qH1sdOVqheVwXoaA7+HtW3uH1UeN51GbbAOs+B40dHwg:ydX1728bZVs8VB7q1xgw+B/dHwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770413815, "uuid": "fb608a01-dad9-4676-a4f3-2987cf98306c", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770413815, "uuid": "5d314c94-11aa-440e-86f2-29c936a610eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770413815, "uuid": "1db2736e-b492-4aa4-9c56-e06953094428", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733e68ca-0346-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770373654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373654, "uuid": "fe892caa-bad6-4e06-b130-729394c766c0", "comment": "Malware payload (Mirai)", "value": "58aa2e96aecb16366aba3e3561361c36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373654, "uuid": "e82fef0a-0d49-4978-abe8-fc0f008a8d64", "comment": "Malware payload (Mirai)", "value": "7417492e007180d0cdecc350f7c32b6ef89b8365d0a90f35b3b73c18801e5d42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373654, "uuid": "76c9f1e5-62bd-43ca-80e2-cb31df2f5b96", "comment": "Malware payload (Mirai)", "value": "b6e97ed8fec6dded141a27dc4784879dedc72251", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373654, "uuid": "09a252be-1a6c-4744-85a5-a4c322f56dc6", "comment": "Malware payload (Mirai)", "value": "7626c7b96128211320479cc965d357e3c8155e4d4711dc7b2895e7bd55bb8f9c2d4926eccfbf2028496d276ce40a9f8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770373654, "uuid": "d24c7774-a2b7-4ad6-896e-6b2c0755982d", "value": "T106240210FF0D0417D992AFB41A7B37B29B6A0DA210B6C23C160DAA4B1D73E3596C7F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770373654, "uuid": "941ddf1f-8e91-400e-bee9-10b9fa9dc8c5", "value": "6144:ozdurafekcMwRFPj5bHWadyE7sGI9Km+lMKObzv:2wR/HWaknGNPObzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770373654, "uuid": "d8b891ca-e608-4bf3-9444-9863b1a2b138", "value": 211996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770373654, "uuid": "4b1071bb-e4c5-4d9d-9571-2ddf21a2f1e5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770373654, "uuid": "0e5593a8-143f-468c-91a0-824a6323e025", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5780743a-02f5-11f1-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1770338818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770338818, "uuid": "564629e4-fc92-4c17-8850-9a1d2e5d68ff", "comment": "Malware payload (SantaStealer)", "value": "4e1f55fa63e23f4c2201e355e3d82bd1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770338818, "uuid": "f5528bce-a5f2-4af5-94e4-0961e749deee", "comment": "Malware payload (SantaStealer)", "value": "74c331730686e50aa5c656e3369d7c2c0c953b6131c2f856191002e54d2c1ece", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770338818, "uuid": "e34e595e-cf96-4cd2-89f3-b3de6e215535", "comment": "Malware payload (SantaStealer)", "value": "6ea0d2b302485b3e2daefcece31284caca1747e4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770338818, "uuid": "73ae40f6-815f-42e9-afd4-55fe7c009c83", "comment": "Malware payload (SantaStealer)", "value": "3cbcd69aed62ed7c412b178f8ebcd733209b5e9f14b7662ad708e80052fd3aa3af2bf0466fed423c2b8134d911380f10", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770338818, "uuid": "39544967-b391-4f00-9532-15252ffca6d8", "value": "T132A6CFCAD16E44D2DC053FF9A8141AC78B2547728A740028366FBD898F775FEC05EEA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770338818, "uuid": "9fcc539f-73f1-4657-9276-7b7403c1d2dd", "value": "fcc736760ffc18b2096bf8dc1a972ac5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770338818, "uuid": "7cafba10-721b-4208-9997-8b0eff8d96b5", "value": "24576:ao8xwd5uuGX9p/iSZkrarCa2ZkQFwmpTsQPeGdKE41OQsrXEyGAjgq9xtrCGIS5N:ao8xwjuPDS5u2F1Ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770338818, "uuid": "bea56bf8-0636-4cd8-a7d0-2954806d1d7b", "value": 9920813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770338818, "uuid": "6013290c-1b56-4af4-8a8b-3e7b6feac71f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770338818, "uuid": "71a77aea-951d-48ca-a3e9-3a5b14af960a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea6d532-02ff-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770343125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770343125, "uuid": "63093d3a-ca8c-4540-9112-6fe946c340a4", "comment": "Malware payload", "value": "6300ebe9cf7c6519f60a6f1d03d00a28", "object_relation": "md5", "Tag": [ { "name": "Electryon", "colour": "#A8FC96", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770343125, "uuid": "7500cd0e-d74c-42ea-884a-4920b53c35da", "comment": "Malware payload", "value": "74cd17648bda2d4fa232623703c1fa7eaddcb9d2d5ecd3554fe024732584e86c", "object_relation": "sha256", "Tag": [ { "name": "Electryon", "colour": "#A8FC96", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770343125, "uuid": "afdbd849-5a1b-411b-8498-9919e60583fb", "comment": "Malware payload", "value": "a2121eb7b21b1c32490c761b976aa4b03958be47", "object_relation": "sha1", "Tag": [ { "name": "Electryon", "colour": "#A8FC96", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770343125, "uuid": "87af2ca3-eb97-4299-8da7-2e39d610728e", "comment": "Malware payload", "value": "952e8fe806f5b091cfd3fc4de36db3a56fbc84adfa5586e9eb0cfa70441db851bc6c289f8267b35d590e4eb6776bf854", "object_relation": "sha3-384", "Tag": [ { "name": "Electryon", "colour": "#A8FC96", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770343125, "uuid": "a2fd3717-c094-4f5b-b063-f084eca35610", "value": "T15091AAF96EAA747E531062E83FCD201C9E11F0A4126E2C00CD0AB3BD15BB66995F7757", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770343125, "uuid": "1467e62c-d669-4272-b774-4ec500b9330b", "value": "96:EA5hZJnjhd1SAkSd9bzuIWDEpfHKF1Nr5PzN9DC9z9gK:tTXuIWDmY1NrZJ9wZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770343125, "uuid": "d9b700c9-3e75-4c97-8099-d200cae1ef09", "value": 4413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770343125, "uuid": "ea013b99-9b87-4c07-b437-bc9c7d8191ae", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770343125, "uuid": "135e2e47-2c95-4230-a324-7b02b07ebbfe", "value": "ZH1-29188692.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30bd15d8-0386-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770401030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401030, "uuid": "89c10f15-e1dd-43d8-8fda-cf5571df73d9", "comment": "Malware payload (Gafgyt)", "value": "26379a1de98c8a439806b675fecc60c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401030, "uuid": "f2d4e122-c07d-471e-b848-ad9ac4768f2e", "comment": "Malware payload (Gafgyt)", "value": "757e8a38ec8a9a619903b22a193b8077a6d2f2af71e28648d7640c35a990da84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401030, "uuid": "f20dfbdb-8e47-4d98-923c-d5a78d5b92da", "comment": "Malware payload (Gafgyt)", "value": "e66c8b28d28d49e353e00c939fcda677ec163c4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401030, "uuid": "7001e762-84b5-4898-806f-dc195e18e745", "comment": "Malware payload (Gafgyt)", "value": "b213d1409b8cff4342eec30ea99ce547ce9f60b28cfad9253ac6519f70b6b495ffc0573df79c2ea0790edd5b5c678221", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401030, "uuid": "5128fb3d-3896-44b0-bca6-72634f58e432", "value": "T1D6932A03771D0F83C1CB59B129FB27F19769B9E502A36181A91BBE905B33A782523FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401030, "uuid": "2bcc1b96-3ee9-45f8-929e-1552686a45b5", "value": "1536:a347i0UzozNrQ35XeaaV8x6IfoSIhKh+w45hiWXTL9mQmV6qDjjoflee:aom0GozKuDe6IAS9I5hiWXTL9mQmV6qA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770401030, "uuid": "309662c0-0d8c-4ad9-9340-790331f55f6f", "value": 89920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770401030, "uuid": "8151f8ea-25de-4d33-883b-8f6f42bfa1be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401030, "uuid": "8e1469fa-da15-4336-b74c-f7adcdc0eec0", "value": "skid.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a40d74-0386-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770401038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401038, "uuid": "a9886a4e-23e4-410d-a02d-4ad646f3a20d", "comment": "Malware payload (Mirai)", "value": "ba5abc7a2b87141ae2854d81a41d80ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401038, "uuid": "336139c8-3516-4e5e-b6c8-c0f85bc262fd", "comment": "Malware payload (Mirai)", "value": "76635f4d402449c8efdd24f8d43cde176c79cf73ed7e7c6b27c6f39ade0a0522", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401038, "uuid": "bc0fef8b-eee4-4541-9cd6-93a4c842811d", "comment": "Malware payload (Mirai)", "value": "40fb7512492ff248d4271f5150a8a14bcc687cbe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401038, "uuid": "d08153a4-65fd-465e-9f5a-e86723be413e", "comment": "Malware payload (Mirai)", "value": "87bed9a59c0e0fad8e4279e6c3768c18e30591a80c0d15f0e98596d2b4de3972d589da35e121ab4250fadf41a741d1b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401038, "uuid": "4368148b-7e3a-48ff-8551-ded560f8b017", "value": "T10FE32A45FC504A26C6D212BBFB5E42CD372A17A8D3DF71039D216F21378A96B0E7B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401038, "uuid": "4a723a13-f8c6-4f58-8430-c2f1018a3a91", "value": "3072:gKqteZW1/pdEuzVtnMRzOGf4KP+ujqzPcnqTNw:gKk/pWWZMRiGf4KmumzPKqTNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770401038, "uuid": "b1c7ad4b-b754-4c16-a240-0800cd3cf2ae", "value": 150400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770401038, "uuid": "71c958ac-d434-4190-9743-73c904db903e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401038, "uuid": "f5bbdfb4-c67c-4d5d-a3ce-40dbaeedb54c", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb477c7f-0363-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770386310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386310, "uuid": "bc645d53-44ff-4e87-a711-8d7a7b1cd870", "comment": "Malware payload (Mirai)", "value": "9d001f2f28dd4aacce256a83544c3836", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386310, "uuid": "9db049e0-89ce-4d36-a1b7-5401a8645947", "comment": "Malware payload (Mirai)", "value": "7788d4d9d763b575ae0b5f8a476a9580c16e6bbdce01502b46afe210550d2766", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386310, "uuid": "cdd1a97b-11c8-4ca2-b514-19cbe5667f0a", "comment": "Malware payload (Mirai)", "value": "d70b05969e990ed96f350199a87e3e9634965848", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386310, "uuid": "ba08f908-4d26-410b-af2e-88a46f012b3c", "comment": "Malware payload (Mirai)", "value": "b988886323f7508c5a63d00029c110a5644fd4acff1e4bde0c944b14957577d991c4821eaae22cf7838a6790efe3fa9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386310, "uuid": "a549f6f4-81cb-46ea-916a-4886e5e2ef32", "value": "T18ED35C0A79D270FCC687D170926E9F61EA3A745C02183DBBA3C2AE711937DE05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386310, "uuid": "8cc8d621-e334-471d-b85b-f24a558d126e", "value": "3072:lAFWsh8fkY6i3iP+9gK8JYYvk9d5dAl8tFEU84YTL:yssqf/3iPcgrerAl8fEtHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386310, "uuid": "c0ea303d-992a-4019-8788-d4e5d4e9c988", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386310, "uuid": "46bd1fcc-a512-438a-8ea2-fec437080f48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386310, "uuid": "ca33f1f3-84a8-4c0a-a25c-db97e1bee5f5", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1bbc14-032b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770361909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770361909, "uuid": "0299a432-410a-4604-a391-b1b42c6b8bb4", "comment": "Malware payload (Mirai)", "value": "eb48c44552e781c1e080c40aaff2e941", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770361909, "uuid": "2ed8b0f2-9110-4296-9c2b-201519c1bac0", "comment": "Malware payload (Mirai)", "value": "785f25a0a7f303eb5bd979b85fbcd1196fa6dd66279aab6f8ade6673c8d1e162", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770361909, "uuid": "eb1f4944-29b6-48b8-9695-7f56e4348eaa", "comment": "Malware payload (Mirai)", "value": "83db840ef92e704b5d8a018ff096a4fad0a77d47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770361909, "uuid": "75314a2e-b521-42a9-9fe0-1d704298f1ab", "comment": "Malware payload (Mirai)", "value": "51c59fe06afc6c792551c06e55120bbdc53477de674164ff8db766a249b1bfc18a14336e7fa547141e7837bf2991946e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770361909, "uuid": "d02574b9-5071-4151-9e6e-359bff1115df", "value": "T14F130981B8809613C6E4237AF66E01CD332567A8E2DF731BDD226F50778682F0D77A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770361909, "uuid": "5463ad4d-8f0e-4a3f-97fa-4503d003ef4e", "value": "768:y8Hw5vwKEHbut8Lbdf338ArMm9U4/t9gdNO/NMx1bW3MLX:ZQ5vwKabuad19z/DONOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770361909, "uuid": "2ea84aca-16eb-4b69-b339-48dfc1d3be0d", "value": 41852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770361909, "uuid": "952f6ca9-48f4-40d5-87ee-a66ae43861bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770361909, "uuid": "a18d0c50-c1aa-4bca-84fd-cda0935c0d24", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd52c5dd-0346-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770373805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373805, "uuid": "62f26f6f-15b6-43b8-80ba-6bcbbacf2b5f", "comment": "Malware payload", "value": "d568a1436f68bee36387f885f6b3eb52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373805, "uuid": "c305a88c-84e6-449a-986a-ed3d781d01c7", "comment": "Malware payload", "value": "7a9ac6374dd22114516c69be3eeb30b1576d3a5e6b33943ccd1e0c0732720103", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373805, "uuid": "0d349560-fda5-4fe4-aa4c-f89369b654ba", "comment": "Malware payload", "value": "e4890dc5a835870c284140cb2780c273966072c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373805, "uuid": "f7d6c220-15da-49a2-ac77-614495f1f46b", "comment": "Malware payload", "value": "9c0dc5ec7fa0a7bacd3f483a5f054d2a00e47dbca0dc605a15e74ede3bb802a94be7da46cea2a4775a5770e9b29311a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770373805, "uuid": "d2b0260d-0af3-419f-9192-779323b0de26", "value": "T1F014F189BE614FDBC83FCE70065F135715ED46D856F2732A62BC8818B689295C6E3D0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770373805, "uuid": "c6671830-491a-4349-9fd1-0fc63c05c639", "value": "6144:rzR63rDUqBMNEFkYNlMo7BccvSjyq/2Tj:naocMNokYNlMo7FSr/Gj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770373805, "uuid": "0ab41ad9-945b-41a1-8cdb-6b531bca7c3c", "value": 208438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770373805, "uuid": "65eea5e1-9ec7-4d49-acee-2161f1c5c9ea", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770373805, "uuid": "48dfa52e-a78e-455c-82a2-b210807cbbf4", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f81b5e2c-0327-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770360562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770360562, "uuid": "7022db3e-35c2-43a3-ad4d-dbf6edcd2768", "comment": "Malware payload (Mirai)", "value": "7d8e900ba7f1065e27ad7c25137a42ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770360562, "uuid": "6d870bd7-3066-4769-b672-803f437987e0", "comment": "Malware payload (Mirai)", "value": "7abfc05460903c34c8db9d73eb0c67a2314566adc5b5e15fac4e32d6824091ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770360562, "uuid": "a4b50670-0072-4442-a8c6-5b7214e14dc5", "comment": "Malware payload (Mirai)", "value": "9e01784b39fb4173add307e7445b6cb1827804f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770360562, "uuid": "7521ad36-9aea-4a06-8a26-4550f3cd1ab5", "comment": "Malware payload (Mirai)", "value": "da9242af639ace1698d13bf1281fb084cee628225a9e89a9648bdd7bf6d50724bc0f7ba1ee989ab6c9ba66ba2f4c95a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770360562, "uuid": "cb1a52c5-d500-45d7-82fb-b4b84ac3ecde", "value": "T19BC3AE83F68714A1C46206F013C71BAD2F93A122CE5FE4E7AD1DB63B5A7A0DB19167C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770360562, "uuid": "3130e6b1-dd8d-4099-acdc-36867fb975a1", "value": "1536:hLNz/Tkc+siE6J9fabbbAb5WOoP/9U7/m0rl4saVfVcTxs5Rpg9iEr/LWe:RtT1+sir0bAln+/9U7m0rRatVc2g9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770360562, "uuid": "eefe2243-608b-4f44-8866-89aba958738f", "value": 124676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770360562, "uuid": "c4b1f5b0-3a14-4c42-b364-ea038be3a65f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770360562, "uuid": "e19cfef4-fff0-44e4-ad5a-02a65c89cb80", "value": "titanjr.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee65d4c6-0322-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770358398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770358398, "uuid": "b5365bb6-1f4f-4759-9d90-a0b1f8d49a8e", "comment": "Malware payload (AsyncRAT)", "value": "7da8775afaa7952ff95fa12e042b4f16", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770358398, "uuid": "a2d43d4e-7809-4a01-a880-b39e70d673ce", "comment": "Malware payload (AsyncRAT)", "value": "7bf46a141c13dffa7f8f1d5069ad7043403e02a90538e91c3a7c05dc16393f0a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770358398, "uuid": "98dc5530-0cb8-4348-ae14-038ba300569f", "comment": "Malware payload (AsyncRAT)", "value": "c2aa05e9a62f43fbc09b7fdce3848b20b4d399ed", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770358398, "uuid": "5bf65a31-30f3-48e4-875a-915a223c9b10", "comment": "Malware payload (AsyncRAT)", "value": "93e35e0ce31fa9d03cbd238e19542f39e8f0b02b27351c6297b74a1cd56ee164dd29ffcf3cb7c1d70e3ae96017f1d543", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770358398, "uuid": "f870c53d-4eea-417d-959f-37dec248ca04", "value": "T1B1534A002798C965E2AD8AB4FDF2950106B5D9772001DA5E7CC404DBAB9FFCA4A123FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770358398, "uuid": "4cc0522f-12ce-4251-ba6a-d7310ae646a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770358398, "uuid": "09e60dae-549b-43d0-a496-6b0e500a5892", "value": "1536:V23U8UkiGuSud7sDKGbbl3R2FgTG2IVclN:VXkqSM7suGbbloFySY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770358398, "uuid": "ac29237f-35dc-4bc9-a856-c4bc662c881a", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770358398, "uuid": "7910b6c8-4974-4a38-9a6c-076f2efc31b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770358398, "uuid": "74da2b83-70cf-456f-83b4-cd386045710e", "value": "KryonixEndpointSentinel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be36f4e6-039c-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770410716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770410716, "uuid": "f4768a8e-124e-4321-92b8-f1f974d635ed", "comment": "Malware payload (AsyncRAT)", "value": "735a7df8128b5fe7253a9e1f06e2fad6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770410716, "uuid": "59e6f1ca-4c7c-4670-b0f6-9ba5f4e5649f", "comment": "Malware payload (AsyncRAT)", "value": "7ca4c19291f2b3cb70238f96ecb8b8ac23f41e48309e1cdbf10c2d83b2ca5fbf", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770410716, "uuid": "5ab6c5fa-1dc6-43bb-bbef-3699a55957e4", "comment": "Malware payload (AsyncRAT)", "value": "35b87f5f79a42052fd91d71df2ff0b195f6251a3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770410716, "uuid": "cfae5452-e8a0-4084-8d1e-854d21df4189", "comment": "Malware payload (AsyncRAT)", "value": "acf5634678d834af0cb121e2101308197b62ed09ce373da55d0c0bbe90eb061a64e3ff7be4462b63457f218656a71167", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770410716, "uuid": "1de430e3-eab7-45a5-87a0-cb8394f96d07", "value": "T188536A002798C966E1AD4EB4ECF2514146B5D5732102EA5EBCC414DBAB9FFCA46223FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770410716, "uuid": "72151116-7da9-4dee-ab1a-7f059a387981", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770410716, "uuid": "dfbe65e3-2718-4408-8914-c7f4518a4be1", "value": "1536:G/x2braxsBQPv5Ml1/bbLwK0ekG/6DVclN:GEraxsBQ3Y/bbLH0q6pY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770410716, "uuid": "3beb7e3b-e2d5-48ae-9f41-16aa2d0ffba3", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770410716, "uuid": "0e885722-5f70-412a-b82c-00a17a9c8e45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770410716, "uuid": "12d1be2a-1db5-425f-9c71-fe815684edf4", "value": "OddsCascade Lab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d8d1fd-0386-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770401037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401037, "uuid": "4f0f19e1-e391-424e-a52f-55e1ca7252ab", "comment": "Malware payload (Mirai)", "value": "830331241ebcd0de29a781d8870fcb00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401037, "uuid": "4775165c-ad30-4240-b8da-e0430736c29b", "comment": "Malware payload (Mirai)", "value": "7d7e14ffe814dae7aee3da258efd486905483bf4d8796ad2a0e54278f3d84da8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401037, "uuid": "69c7552c-28b5-4874-adce-bca3b5d535a8", "comment": "Malware payload (Mirai)", "value": "2e6277bba65e59575b40ee4b34be2f46f1660bc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401037, "uuid": "c06f463f-6177-49b3-9798-362c89c84b39", "comment": "Malware payload (Mirai)", "value": "435d09d9d268a04f3a86facedb45424119cde27ba6229beba2eb4b87c6a4d47e5e109b7800a846dcc3459357d94e4510", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401037, "uuid": "5c658b52-5d60-45bc-a6ff-7ddf82b481e1", "value": "T1D6F31946F8818B15D5D112BAFE1E128E33231B7CE2DE72029D246F657B8AD6F0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401037, "uuid": "9409bbeb-1073-4bb7-a937-221fa52f6b72", "value": "3072:d1skGQb52RGuNmFXYBI6BbFajq83c0QG9T2M:dF8RGumXEBJa2OV9T2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770401037, "uuid": "498af1e9-8f60-4151-ad35-02043807844d", "value": 163388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770401037, "uuid": "0b6ae3be-b4d7-419f-abb9-1be2634be0ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401037, "uuid": "7867d53a-a981-43c6-bd89-211a01a42dbf", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d185384-0356-11f1-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1770380354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770380354, "uuid": "4d283b11-f049-4da0-9c8a-12023bbefd5f", "comment": "Malware payload (CobaltStrike)", "value": "7ab39ede4268a615c04ef39b1b30cee3", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770380354, "uuid": "afceca82-ab0b-4890-a691-a8d55bcea739", "comment": "Malware payload (CobaltStrike)", "value": "7de52b73d0f039d4b64a436e285086cf828821d602016bcb2ac06299296e1f64", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770380354, "uuid": "2ab99424-ba10-4016-a459-bdb4d25d6409", "comment": "Malware payload (CobaltStrike)", "value": "994593b36a2175d9194e50e91b43b3c9b41179ed", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770380354, "uuid": "fe72f816-2c94-44e0-8a38-d9fc596b9304", "comment": "Malware payload (CobaltStrike)", "value": "4f72bfe7f93931caa5d9ce74ef6b214bd9867c839d537890829e4dbeb88105aa842bc32809f3da5480251e00efb1cd63", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770380354, "uuid": "5ebf3330-c56b-49ff-a25c-5680aeb4ed64", "value": "T154E4D05542A40070DF811AFDE9513908F959F89C868BC7AA2DF7C2017CE7BD1EB26B6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770380354, "uuid": "22aaaa1a-1ed2-408b-9bc5-c05c0d3a325d", "value": "14b4bf96893ebd84439f0801a0c27e7d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770380354, "uuid": "8f23e179-d177-459b-860a-42b1f081ee4a", "value": "12288:Dd9vGSydKZdBpLnQU+hPx/a/5QR8xwFV8d5z4E38dKT7qtL34bc/eMvo:h9v7yEZWUig/5QCxw3Q5z4EMde+13wqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770380354, "uuid": "641c7d6d-116c-437c-9792-003ed5d0489a", "value": 706792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770380354, "uuid": "ada56dd8-c872-41d1-ac02-2307f9384347", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770380354, "uuid": "de7aba00-1852-4d3b-b7e0-869feb48ba6a", "value": "Zabbix", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab2f679-0363-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770386229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386229, "uuid": "08bc1b7a-ce3e-4ffd-be59-d77cfc1fa8af", "comment": "Malware payload (Mirai)", "value": "0676eac660c47908111ac41b963b0c3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386229, "uuid": "3238866b-1004-41fc-9f3b-a706c5fe489c", "comment": "Malware payload (Mirai)", "value": "7e8e8b30c50a6e9cfa4de1c9fd59a3a2c0854440e52dd15dff7c8de4a75d580e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386229, "uuid": "78a1eaa6-d396-46f8-b783-2274be5d0415", "comment": "Malware payload (Mirai)", "value": "c30f1d5384a11274271f0293bdce46b66fef4b42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386229, "uuid": "0c1f71ea-4431-4d86-b60e-290188de7553", "comment": "Malware payload (Mirai)", "value": "3b7f9edeab9e744c01faa448f415ca54c4b6362559859fbaf25a67bf1b4e9967300cbf2c25cb29e8edfc155718875e14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386229, "uuid": "b3a1d20c-28c5-498b-96c7-303aa9c345ec", "value": "T1AAF34D56EB414A13C4D6177AB6EF42453323A764D3DB330699286FF43F86B9E0E63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386229, "uuid": "6dcaac81-9527-4290-b1cc-95ad2aa77d77", "value": "3072:sJp+Q9dJqLjbDvh1aRr1lbTOWmeRCKGoitFfM/943ikU3uEj:sdd4LjvZ1aRr1lbTJmKGoitJM/946j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386229, "uuid": "8b64e9c6-8244-4a1b-b341-0d58c3d19853", "value": 167001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386229, "uuid": "3df9978a-77d2-4e52-b553-d2f8ae2eb5a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386229, "uuid": "70f83b66-9628-4870-82b0-8a171cc7981f", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "688f13a0-0378-11f1-a129-42010a9c0007", "comment": "Malware payload (DCRat)", "timestamp": 1770395111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770395111, "uuid": "fd893257-070c-4f0e-8ff3-c6aa6d5638a3", "comment": "Malware payload (DCRat)", "value": "12ba7fcd9f76f5e4ff8b21d831d2b05c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770395111, "uuid": "9cdf5458-c5a8-4bfd-bbfb-b87ce2deed1e", "comment": "Malware payload (DCRat)", "value": "7f03083ac6ac12edf7ea609f0fd333fa4cdb4270e72ea469e2c40cd5e19ab29e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770395111, "uuid": "ea55592e-7be4-4e56-b73b-4f19a3d4ea11", "comment": "Malware payload (DCRat)", "value": "19435c71a7114ec1ab5b0423e667f7251acd6f9f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770395111, "uuid": "eee83fc4-45c5-48ab-9bd9-2a674ede7f08", "comment": "Malware payload (DCRat)", "value": "1a92f5e78f6360357d8734a1e802a78740c21a8ebcf244644b2339c45e61c830ff73d9b12443b82645685d3ea0d205c8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770395111, "uuid": "61462bf1-bfa2-4cdb-b834-c69611ae3238", "value": "T15605F7027E84CE12F0091633C6EF45484BB499516AB6E72B7DBA37AE15133A77C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770395111, "uuid": "fa2c96c3-c80d-4ccf-95da-a269cf2171fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770395111, "uuid": "5880f22b-7800-4ed6-9365-a4ee69422bca", "value": "24576:QUxtLkDCn5CG5tY+kZHReiP4rkUGkxyOACA4:QUx9kyI7prmE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770395111, "uuid": "daecfca1-49f3-41c1-9663-14401d1651fa", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770395111, "uuid": "b89607e8-5092-4791-975c-dab3461a06be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770395111, "uuid": "5f437543-7b1c-4106-b5f1-d572cc5928c2", "value": "12BA7FCD9F76F5E4FF8B21D831D2B05C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdca916a-038f-11f1-a129-42010a9c0007", "comment": "Malware payload (MeshAgent)", "timestamp": 1770405159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770405159, "uuid": "80f17c26-44b9-4048-8d03-51cab6aae1e6", "comment": "Malware payload (MeshAgent)", "value": "fa6e718b17e9a77203bed1457b125f67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770405159, "uuid": "dea69abc-2106-4b03-a1fd-baa892f60378", "comment": "Malware payload (MeshAgent)", "value": "832c2f38f951aaba4319ed07856bb4d2ee8633ee0fd07e6bd581556e2ba5071f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770405159, "uuid": "dd270110-4948-406b-87dc-d4e7b2aa3810", "comment": "Malware payload (MeshAgent)", "value": "9da7d200d4ede305431c4f334088b766d5e8f858", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770405159, "uuid": "492eb7e7-8cad-4d2b-9648-72da54ad2c9a", "comment": "Malware payload (MeshAgent)", "value": "12912bbc23ffe12d55390787a61fa91b5ab6633ebb66d8e7c418f428833dc31a74256d5cce2e7a64387b6116ae209856", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770405159, "uuid": "c90641b5-3f7d-4a34-8a52-2babc2618408", "value": "T1F6F58DD2A3A600E8E9B7F23C85568517E7F1B81753709BCF16A44A760F236D12B3E742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770405159, "uuid": "726dc878-42eb-450c-b5ec-c265fb58ae21", "value": "fb0a8b4a81655f744a37af985e009476", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770405159, "uuid": "52c4f2a3-12d2-4430-8cd1-178196eafd86", "value": "49152:AdZEy2B6vflQf6X8uZQoy3vR6QVQy5Z+bm4M/HMFvfGW0/7Z7Ib3jx658Z:0HvfGfZvZj1/N/z/o6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770405159, "uuid": "622b8eb6-6ed2-474e-a0da-df9a9fb782a1", "value": 3558496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770405159, "uuid": "d11bd424-90cc-4879-88a5-6785c8dd8fad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770405159, "uuid": "de649b46-e3a0-4d86-b0ab-cd4be3319936", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d3eda6-0349-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770375059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375059, "uuid": "00cd57e7-a95d-4720-91ed-be7ec64a0681", "comment": "Malware payload (Mirai)", "value": "6073ab80f4cca5e8f1441e184c899552", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375059, "uuid": "d2188451-9973-428c-a069-c08197c304a0", "comment": "Malware payload (Mirai)", "value": "838344c4f5a9b9f527629d19c5e24abe8eae0025dd8fe7c10ceb0896309a1309", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375059, "uuid": "10e0412e-69ab-4d5c-9881-70925d206581", "comment": "Malware payload (Mirai)", "value": "15d175c816a79d16fbd3aa90ab07a8b8e0d50b17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375059, "uuid": "0507085e-96f5-40e6-aaa1-816ca5c45f3a", "comment": "Malware payload (Mirai)", "value": "623e2be5edc9beb0214f2545523babf54ee2caf5ed9dd92f8a789e6c3724229c3fa258f13ee9fea98b1c02a6396bdcb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375059, "uuid": "9f18066f-8f3d-437a-bbad-2da75c0321b7", "value": "T1E6331A9EB8029D3CF90BE6BE54164E0DB93167C152830B2767BBFD937C721A45E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375059, "uuid": "601def37-3962-45ec-b261-91e85877c0de", "value": "768:BVmPZdPfoQyRcqOCnGkw1ZuJ+Ti806MsG7zcPgXOVPuFuCVGY:yfBqWkiZuJqi806MNcPgXAPupAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770375059, "uuid": "45b07f7f-6186-498f-8ed1-363e21b9db7f", "value": 54924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770375059, "uuid": "3f353310-94ff-4a38-92e5-d455ef12bbe9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375059, "uuid": "035575d4-d98c-4347-bf9d-03b9cc096ae2", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ebd890-03a2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770413222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770413222, "uuid": "baa91ba9-d54c-43da-9fe3-7dde32fab317", "comment": "Malware payload", "value": "9a8e2c76f38a59bf7a8509a15f005a76", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770413222, "uuid": "7b18691a-ce7d-45a6-ba86-efc3343668d3", "comment": "Malware payload", "value": "84abe3e14bda7f2c87e93f82a40eb25d6ea38699c7e3752b1ac87bfd8602594c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770413222, "uuid": "303e6fac-8146-4eba-8d12-6d590e79227e", "comment": "Malware payload", "value": "41c66350d531c398f53c516c2e9d8cb5378ff256", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770413222, "uuid": "7ec88b64-1a52-405e-9392-98d1f43d510c", "comment": "Malware payload", "value": "0de473138e14f9f4895182823e3ff13c05dcc75b957f0605a3d3ede91d43101cfcf1b5ccf9821e28208144296d814ada", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770413222, "uuid": "0d1a841a-0c6b-420b-bce9-cbff948c419c", "value": "T1C8C5021589C46FB9CFAC5A1890FE171EA3B04A9E4426758AFB33BD4ABFE750002171D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770413222, "uuid": "899602a8-761e-4571-9dd6-6796ffd499e0", "value": "24576:q3EsXYA73RLaEs/KbEvEngfVjAXMcvY2EE3EsXYA73RLaEs/KbEvEngfVjAXMcvq:q3EFAFmzibBnEr63EFAFmzibBnEr9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770413222, "uuid": "bfb3b306-8414-4a97-9678-3a1516a9d8fc", "value": 2695423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770413222, "uuid": "86626ae1-d029-401c-bf76-f8c55026257a", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770413222, "uuid": "8c721cf6-ed50-423d-8617-817d88829a37", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7dbb331-038a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770403001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770403001, "uuid": "ade04d8b-3d26-40fb-8579-d80b95c2e564", "comment": "Malware payload", "value": "e725714a55d35a7f9cd93f2358f535b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770403001, "uuid": "9e95e2c6-daa8-454b-9e7f-1216453f399a", "comment": "Malware payload", "value": "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770403001, "uuid": "e88d6f79-d3f5-45e0-94bd-f51a1b7c0e67", "comment": "Malware payload", "value": "02856b070b6875226ba08c05169f99d05be5cf94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770403001, "uuid": "5341218a-1445-4ba2-99d7-559cc73573e9", "comment": "Malware payload", "value": "ba92cac51ef269f52c41d2ef80475e22422a35ea78ecf63ca0b8846e70aa14c27ae821634d3276be05aa754191e9074a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770403001, "uuid": "e9b627e9-d53e-4db4-a2cb-5e6885a19fc5", "value": "T182871256E2FD00E8D5BBC0B8C6575517E7B1341913309BEB66A48A692F37BE0AE3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770403001, "uuid": "cb0be3ba-2b9b-471f-aef0-40f018de5b5c", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770403001, "uuid": "3162caf4-d657-4b09-bda9-b6ee97c77d83", "value": "393216:nKxapWfkeIqr4SvhZ6sRvI9cR8vq/mQFgeyh0LfHPQu2jYvnUwEbc/81c:b4FHr/vbpvuY7Key+7PJsYPUlbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770403001, "uuid": "cea36e57-dd87-4b7a-9618-8bcfaeed43e9", "value": 36333296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770403001, "uuid": "bc16aba2-5777-4d8b-8569-f393ec16acd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770403001, "uuid": "ba582ba1-8813-4fe9-b8ff-cf47d3a1c2a7", "value": "Adobe_Reader_Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394dfd58-0386-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770401044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401044, "uuid": "cf1cc9ba-4b72-48eb-88d5-2152e6b63ac4", "comment": "Malware payload (Gafgyt)", "value": "f4c0b6617c63b37339849db6bc746805", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401044, "uuid": "70a1e743-5082-487b-b8cb-b87de2bf6546", "comment": "Malware payload (Gafgyt)", "value": "86f51064bfc12132f7e10d7e5e3cfa895086d32249d71d2bb8b7ac747949203e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401044, "uuid": "90d12915-7f5b-4709-a540-07e246afce9f", "comment": "Malware payload (Gafgyt)", "value": "fba4e8ae8d9dc938c1cfa6d114b253db59ab6a8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401044, "uuid": "991a69e2-2f93-4f73-b530-e692ceafdec5", "comment": "Malware payload (Gafgyt)", "value": "70885b9b4a2fa24ba97547c3f1388dffbcf8f5efcfd7bf18ff3fd6bd789b9eff3ccad9c319dda7dc05ec4b952952d58f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401044, "uuid": "9a51e7e4-42ff-4475-b2a9-73987acc03e4", "value": "T1BED3C8176B508EB3D81FDD37069A460120CDE55A16E87B6FB6B4C92CE78B84F09E3D84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401044, "uuid": "456b426e-78a4-4ebf-a5ec-a8396e8665af", "value": "1536:oVQ4LeT9nQcNp17OIkysZW1IX0FbsbmoMS+XaU5hWLLQ0U0CPF3xuhmqY1fqjBme:oV2QQkF9C5eU5hWL2PF3xemqY1fuBmvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770401044, "uuid": "0ab29f0a-40e9-4fcd-98be-e61c0ca8a5c5", "value": 137917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770401044, "uuid": "e07602f2-7d1c-4ebc-bc43-21d0a9fff558", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401044, "uuid": "09f692a2-36d1-4dec-950e-ecc543c32e6f", "value": "yakuza.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7100018b-0346-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770373650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373650, "uuid": "52914721-b814-4951-8c3f-7ab76f4ce2f2", "comment": "Malware payload (Mirai)", "value": "65235989722b15cc455d386b1fb07113", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373650, "uuid": "7630c193-310b-4e7a-bf5c-5fc28fff1b4c", "comment": "Malware payload (Mirai)", "value": "872b5add4e7a6dae6adfbe4183ce136192a9be664d344803fc6f2910d6432ac9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373650, "uuid": "8b91a819-7eb8-49d9-9520-5a42d8da2031", "comment": "Malware payload (Mirai)", "value": "29c6656b916bafc2de085883bbab1e86c806455b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373650, "uuid": "4fd17ada-fca0-40f9-ad15-b54be75f8186", "comment": "Malware payload (Mirai)", "value": "0943816747ffa17eb043c08b2e389bf4d67759192dccd23e297fa7cb9c9af05db0ef45cf6fa08146bbc574ce9ac5d7de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770373650, "uuid": "7ff5e81f-2135-45c4-9be3-08a2c87fc1cc", "value": "T1E3F3E19DF841AA23CAD225BFF25E01083367577CD3DA3351CD209F2563A699B0E3AE45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770373650, "uuid": "c1fb5837-ae83-4052-a23a-fc61d0c70f4c", "value": "3072:foTTImvmBwsvHXc4OS0xlbR02MNM1SaZmB4aoKXIT6mS:fgIwWwmOS8b+2K1MmB4aZ067", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770373650, "uuid": "c38ad9eb-24f6-4c00-bdf1-4fa56586a1f3", "value": 164183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770373650, "uuid": "abd004fd-ef98-4960-99e8-08ac6c9596a3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770373650, "uuid": "6d72b82a-eebf-4b2a-8ce1-5d4e9dcb1b4b", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15d1fb2-038e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770404708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770404708, "uuid": "0f435992-9c31-451d-913a-7fb9c23f86cd", "comment": "Malware payload", "value": "70d8a8c294eac85adbb7f2f5cf6fc448", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770404708, "uuid": "d82fe0b0-1e16-4ed0-8479-4cfc2f948004", "comment": "Malware payload", "value": "87a4a22b371e585071402317901e4eac1e1a02674efac239df239c05384211a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770404708, "uuid": "b35005bd-0a1a-423d-8f11-6f4e90e65dbd", "comment": "Malware payload", "value": "6bb3a1b8654bb6da623f603ff970e0bb63f463c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770404708, "uuid": "1f862ba4-82af-4109-8873-e0832c76a763", "comment": "Malware payload", "value": "d275abc218cf1850c4de3597894e1255425d1178e0e638824665634948b3ac67092c796ee1cdf1eacb7fddf27bee2a31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770404708, "uuid": "32954e06-e0f4-49ca-9aff-881fa55568a8", "value": "T1B7A4F90BB3A14F21D3842773D1D7441053E6A9C567A7EB0F398923D53D4A3EADE12A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770404708, "uuid": "fc025629-6ab6-444f-b586-6eaeef78dee6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770404708, "uuid": "4f255fab-332b-4279-9388-09ac719caa3e", "value": "6144:Cx8NN+FoXw0qEuUSdqQQVPAkfy31+RlpCrfRxI5nxTn+IXYhFIzen:7N+lK8Ayl+PYrfIxT1YT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770404708, "uuid": "702b946b-dd08-4817-8fd3-fd841fed814b", "value": 474960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770404708, "uuid": "d25d3396-2f53-4806-a5f3-e242dfdb5e29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770404708, "uuid": "1d3c9d63-77ed-479c-85c2-79d79c61fff6", "value": "fst5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e7ceb3d-039b-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770410072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770410072, "uuid": "89c98810-5b68-4f45-ba41-b7f419d36338", "comment": "Malware payload (AsyncRAT)", "value": "7d4c3ce36e7d3ff947106ae96c6a5e79", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770410072, "uuid": "373f5131-be79-4def-b0ac-6600d1a72019", "comment": "Malware payload (AsyncRAT)", "value": "87dea51d43b985bfd8db69797a61ef8ca8f5229aec70092de8f1da27875e2a67", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770410072, "uuid": "86e8b479-8feb-4460-8940-f5571b7d7f69", "comment": "Malware payload (AsyncRAT)", "value": "a59ce18dd2bfad901bf6e5457575ceb79641a449", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770410072, "uuid": "e40acee8-8d40-499d-9365-0bc9e3052a3c", "comment": "Malware payload (AsyncRAT)", "value": "d3f10197d43425d26f535b1291895975820a358f13d9c644bfdc220ffd1d13f93f96a97f075ca264273cd8b91c939a90", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770410072, "uuid": "2cc43e1d-9a88-4e39-a3a3-7627d9c899f5", "value": "T11E535B002799C961F1BE4AB4ADF2454046B5D5732102DA5FBCC404CBABAFFCA4A167FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770410072, "uuid": "4328035f-7bf9-4574-8a9c-4709af50ad4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770410072, "uuid": "1f21ae2e-8148-44b3-9082-f03397872e5a", "value": "1536:oeTivvo7KD/FNDDegRXGtbbXwjQH0oH9GYs2VclN:oeOvo7Y/FNDDeglGtbbXj0MY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770410072, "uuid": "0d051e80-6f9b-4626-84a0-e4abce9924d9", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770410072, "uuid": "6aa4309d-8b32-4f67-badf-e4becb18207c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770410072, "uuid": "7eb06918-6187-45bf-8c7c-d527fc56038e", "value": "BetAegis Guard.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68382c5d-032d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770362898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362898, "uuid": "f8b34081-db1d-498e-ac4f-32ee1ccb6919", "comment": "Malware payload", "value": "1d36a00212dec902b2378cd6226b0365", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362898, "uuid": "29d12203-510d-406a-8ba4-be365a6b7fb5", "comment": "Malware payload", "value": "88bd48b2eedce3183071d42d746c3c6ac7248fb5c1c82e9f02fa86e8b229d069", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362898, "uuid": "2547e80c-1db0-4f11-b2dd-27f3bd972c54", "comment": "Malware payload", "value": "0c59a9da35a23079dc46b029d91901993a6d14b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362898, "uuid": "e2dcd9a3-7c5f-4718-bc20-1d6a8591c64a", "comment": "Malware payload", "value": "cc79310a2ee73dd1ea37f985fbe4e1358bf68130172fc8bdc4867a4a569e0f98cae9b9a3113e7430b2b7ec40983f7041", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362898, "uuid": "18488a56-e995-472d-9a3b-b83fcdc70226", "value": "T17EF533A976B14EC7DDBD05F7BF2CDA4BE2631B14877C0B63A46622E922C6190F51E340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362898, "uuid": "781ae1be-84e8-47b6-8fdb-87ba178d588d", "value": "287b8c0e6c199ea2caf49c079c4563f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362898, "uuid": "c3661213-bd71-4f7d-955f-46caa733ac04", "value": "49152:qcYJOrt5P7YY7GFX77Qp/TqgLvp8xfLLrTlqGejdfC0IFrMXxbfzwGcH4vtf:7Yc7P7PGFrcBnv83DeUF4fsL+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770362898, "uuid": "9d26fedc-b60e-41c0-8857-89013a1e71ec", "value": 3621069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770362898, "uuid": "64ec4036-ac7a-4faf-a4dd-7a472c833918", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362898, "uuid": "c0f4f685-ca89-4071-ba38-265376b969a5", "value": "SecuriteInfo.com.Win64.MalwareX-gen.42951765", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde16700-0325-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770359713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770359713, "uuid": "49e9bdd9-789e-47b6-9d80-c85a0e7ef8ce", "comment": "Malware payload", "value": "d0ee746b6f318368cc51e898cb6cb893", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770359713, "uuid": "e1ea500c-82ab-4036-9d3c-6c11e56be789", "comment": "Malware payload", "value": "8b87dd755de641e2c3f4e5e2db19e2df1e9d120f226e168bd4ed6d2212f45be1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770359713, "uuid": "7d9f0ea7-cecf-4044-b581-b120c5953c0a", "comment": "Malware payload", "value": "5dab1f30b70ef022326886e8c7b69452c8f0dd9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770359713, "uuid": "c6a96df2-541d-49e5-b0e9-dac1c0f23fd3", "comment": "Malware payload", "value": "5ac6c03e3e9492a04ac9f53d2e89ad40499af82bef6a132edd0aac2da38f5c7ca579088bd01baabad2dab417e15a1570", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770359713, "uuid": "739b8d52-d45d-4a0e-85a4-bf3e84400132", "value": "T108145A5B72E520FAE0778239C8630A09D776F8650621DF6F03A4425A1F277D18E3AF72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770359713, "uuid": "56016337-698b-4aab-96ef-445cb9c4df9f", "value": "66788d0370a49f8c166910af7e22c513", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770359713, "uuid": "80f8e486-21b7-4205-b617-411b2e54be6e", "value": "3072:BMLHcmBju1nOZ3deemHS5ONAM6jVRvMHQSayWKQA7poduBdRF+QM86v106PO:Cc40O3dedxwRKQi+du/+u41FO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770359713, "uuid": "11d1a057-5ab4-4af7-87bf-3bd7e30fd734", "value": 194048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770359713, "uuid": "2413f798-39cb-48aa-9d0a-79cdfd504d6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770359713, "uuid": "7379c898-dd14-463e-a46a-e9a461a6b701", "value": "150.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b308352-0354-11f1-a129-42010a9c0007", "comment": "Malware payload (HijackLoader)", "timestamp": 1770379519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770379519, "uuid": "09118b32-c516-4692-b4a1-c6c90488efcf", "comment": "Malware payload (HijackLoader)", "value": "b552f5c14a03a6dab1d1227958ea1126", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770379519, "uuid": "896ed3d1-e76a-4540-90b4-273da415f6d3", "comment": "Malware payload (HijackLoader)", "value": "8ca17f8770bf57d63512f5689c3cfaa0ea286cb553365595cf4ede21411324bf", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770379519, "uuid": "8fcbbf39-6193-43ed-8108-67e6cb2eb3f2", "comment": "Malware payload (HijackLoader)", "value": "9b46ab9885768e8fe101db9545ee88e733058465", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770379519, "uuid": "3dca15e7-ee68-4fc7-8ea4-45f13e243fcb", "comment": "Malware payload (HijackLoader)", "value": "508fccb57ee7b1020c24897b0a32bfa7b05dc43ef336df233d72edcc7a3f5f65fe36809e2047f4551b57aa1ebaf3b17d", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770379519, "uuid": "0510574e-55e1-435d-8c62-4159a2bdc8d5", "value": "T15A36334B27CA9562EF830B78A4C0D0F24BA44CAFD770C0569609B5EE3637B2BC76D155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770379519, "uuid": "d03ffc97-3ce8-4e5f-8f48-9c7dc11908a7", "value": "98304:rwLz1Vy7mA4dWVqejlXJalaeCs9ARYR/7dYeEPi1DEWj5bAoZoEG:rwtVzAbBlZaz7xptEQwi1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770379519, "uuid": "62b023a2-4c66-4d15-8a59-c6f1376587a8", "value": 5120000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770379519, "uuid": "8e62b036-ce03-42f9-bbac-720f86504ceb", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770379519, "uuid": "f1a1085f-834b-4416-aa36-a8945910d7b7", "value": "fusser_setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49961ba0-0321-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770357692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770357692, "uuid": "0cb29bee-f40e-4cd1-9b36-fcc1f38f5ed7", "comment": "Malware payload (Mirai)", "value": "c8a753000c275780d60b4095115ae1a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770357692, "uuid": "a6def80b-752b-4796-b9f9-ad8638288dd2", "comment": "Malware payload (Mirai)", "value": "8e4cac4431fb48b367f2deca061dd190368e0ddb448abd132a6a27c96c2a3eb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770357692, "uuid": "7b83870e-dd37-4bd4-911a-43baf1122a60", "comment": "Malware payload (Mirai)", "value": "a03d49ab8ef015a161d618c20c4ff4c6326954d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770357692, "uuid": "389df53d-c3fb-4d21-82da-86a767a9b286", "comment": "Malware payload (Mirai)", "value": "7032547556846d05268b6314805cf16f93aa5b60e750943efcb28595aa2ef3bd97b872a249ab2fba7fa972ba7cad85e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770357692, "uuid": "98d5cca8-8288-4bf6-92b4-c8c1ac501fcb", "value": "T188F229C0A983ECF4EC2606751237F3769776F0362129EAA3D7A9D933F841611E60729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770357692, "uuid": "756d8768-a41a-4826-aa71-94f07bcc727e", "value": "768:ex8ifmCuPOAOctERNaN3QWHsUAH/8m10nCgeBJSYTB:umCuPOAOctERNaN3Z2HEs0nCgevSYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770357692, "uuid": "7a237d63-9a91-40b1-90e4-af926e19a461", "value": 37476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770357692, "uuid": "c84dae73-f39c-4b8f-ba9d-5202e347b39c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770357692, "uuid": "93447173-9bdc-4f24-b2ab-96bd9bc047ff", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d5abac-0349-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770375104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375104, "uuid": "ad036557-a2df-44db-8189-513179a6006c", "comment": "Malware payload (Mirai)", "value": "8e3eda4339e6d450c52c6b96fea924a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375104, "uuid": "f8bbbca9-e919-4d58-9a7b-7820d38919b5", "comment": "Malware payload (Mirai)", "value": "9068105e8c060721a0637a746cf8eba9d8b150729805cb5fc9cea4639c3c86a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375104, "uuid": "83bff6bf-8995-4412-be94-99c72719f045", "comment": "Malware payload (Mirai)", "value": "7f24930c6ece2ae55059b88252c5ed13d9efd5ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375104, "uuid": "d0731862-a6a1-497d-af45-6dc9994c5b1e", "comment": "Malware payload (Mirai)", "value": "87159f0d9373ec53331aad96f088ec6edd33018184f5c7691a39e3c7f192ca44e075d7d8d96a8f56ccad572b5a966e72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375104, "uuid": "f1053c85-a3d3-4ede-98c6-fb76545701d0", "value": "T17673A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375104, "uuid": "16024e17-9597-40c5-8a31-f6913e3a3004", "value": "1536:zJPEBmW5iNWqcGTkwn0HZ84OqdZerEStU:zJPEB8NWq9hXqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770375104, "uuid": "c96eb95b-ae64-48bb-a5af-b13cf5b4672c", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770375104, "uuid": "2e38732f-bd6f-412e-b559-e9983d971d6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375104, "uuid": "d28ff4cc-7375-40bb-b255-9a27e1259a8a", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59e5fb0b-03ae-11f1-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1770418279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770418279, "uuid": "00b1f82c-6916-40a6-b42b-5d2e72717330", "comment": "Malware payload (SantaStealer)", "value": "cd17dc577c6ae79c55853d92329400cc", "object_relation": "md5", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770418279, "uuid": "ab27adb1-fed9-4cb8-98a4-c9382d70fd0a", "comment": "Malware payload (SantaStealer)", "value": "906d22b29f821807ce4ce6a3c9383ef57a71c4432ea729f0146878e12e3315fd", "object_relation": "sha256", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770418279, "uuid": "59bdec78-ff6f-4797-b02a-c8cbafabfd41", "comment": "Malware payload (SantaStealer)", "value": "2a207002915e35dd4eef90211ac2ac6cf02016cb", "object_relation": "sha1", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770418279, "uuid": "26c00047-02e9-43d7-942a-af1a443d27d0", "comment": "Malware payload (SantaStealer)", "value": "0e5dd868245c3971fdbb8171f7ebb564d94b48aef20b2935e0634e4498ac5f7243362fc7b75dcf01d0f3ad9abdd71ba8", "object_relation": "sha3-384", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770418279, "uuid": "0d6137f5-f063-4a44-b7c3-7bfdd6e2429e", "value": "T1ECD59D0AE65349D5CC6BC0BC838B7131EB357C69CB282EDB17D18B613E55B806729F86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770418279, "uuid": "671de7e8-ac64-49cb-aa90-0325df2bb5be", "value": "bdcf6640dd39be2f9b3b5476d898a6dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770418279, "uuid": "0cfdbf60-8b05-4dcb-8f51-791b64600569", "value": "49152:kFV6NwLgW0B2MXHReGLzCnx7Rt80JjIGr2yXEJmgS/DcEIuuZ:VpW0jReGLzkx9KAjcyTxA+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770418279, "uuid": "b8bca9aa-2d4d-4f03-a4b7-9987c410337d", "value": 2984448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770418279, "uuid": "81a1cc0c-c1a2-497e-b65c-a50869152764", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770418279, "uuid": "97e10845-bbae-4944-92c0-52c4b925133e", "value": "906d22b29f821807ce4ce6a3c9383ef57a71c4432ea729f0146878e12e3315fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3adc44d-0363-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770386244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386244, "uuid": "49413e28-c40d-489b-a924-543c96584be0", "comment": "Malware payload (Gafgyt)", "value": "0445aabb4891ffdf6739661922544618", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386244, "uuid": "28e9ad27-4048-4341-978b-8c65b98cfeaf", "comment": "Malware payload (Gafgyt)", "value": "90c1005ce769790abd349210202e4909dae7f0ffaa9d5acfc28d8f8d74495768", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386244, "uuid": "2a2bbe8d-18ee-47e4-b0ca-96d3ff4a1cc5", "comment": "Malware payload (Gafgyt)", "value": "cc99d169c5abc4d2c64c36a4d74695c53ba40b12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386244, "uuid": "727d1597-f53e-4026-90e7-2d1ab9dbb8d9", "comment": "Malware payload (Gafgyt)", "value": "ef7c04690439d92bf78d0542c4e408730032ff46ef39c2c5cdcc857a3cfdb0a711c8a628e21896d78e4da432256b53d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386244, "uuid": "b7267781-6968-48d7-8393-7dc07e2220ff", "value": "T1A0C3093B7B270A23C0D9507102E31332B9B9DE5938BA43D7A9D07D9C6F3A58834567E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386244, "uuid": "34687332-0205-4d92-a62b-9184bfe9283a", "value": "1536:ctrv5GE2dFg8aI0DN95P8tf7PJtA0Rdc0sfm7ypwYujl3IdnuW:ZP0DNPA55sfm2pwYux3I5uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386244, "uuid": "0cdf5de6-7b87-43b6-9eec-c4eabe9ab7fe", "value": 126446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386244, "uuid": "b234ae96-bae1-4cf3-9ffe-d680e1e5f232", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386244, "uuid": "43b990ab-4626-4970-b951-635766f157e6", "value": "dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91eb8a68-03ac-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770417514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770417514, "uuid": "42f63cc5-e6a6-48f1-9e54-33315386fcb5", "comment": "Malware payload (Mirai)", "value": "28e0b8da779ccfa76e0ae74629deed61", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770417514, "uuid": "f25184b0-4b29-41e9-ae33-997ec7b7de4c", "comment": "Malware payload (Mirai)", "value": "91c1dd355f037ff339fd362b64403e4447c1bb989d1a37de78c8d546b648d914", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770417514, "uuid": "531c7b73-5cc1-4209-b928-6ca6b7a427d9", "comment": "Malware payload (Mirai)", "value": "912ada1f41fa626d25fc201123627270aae3b6a3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770417514, "uuid": "6596696a-62ee-4c90-bcd6-b10aa2fe13bc", "comment": "Malware payload (Mirai)", "value": "99567331cf5789075c45f0eec11f41d4b6e362925c94a305b4413f9553df986d397df50e80030ba3d3618c24fb73ce9f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770417514, "uuid": "e77a1e24-d135-4b64-b8f7-0c00d4297461", "value": "T1456143FC42E17FE3C943AE4CBA24CB50A30B95F4AC33B13CAC5846664550756749BBAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770417514, "uuid": "007ada17-7bde-4fa4-9cd6-d68a1b2a0ea0", "value": "96:bJHXZAQgcxvjNBfNz5/ZBz1zblrh/Td/hlrJSQ:LBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770417514, "uuid": "5ddaa9e5-4ea4-4cf1-b095-afb89933bed8", "value": 3241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770417514, "uuid": "6962ed7f-7dab-4eef-843a-21710a449c71", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770417514, "uuid": "6280fd51-6e80-41f4-a3bb-b17e74d1469c", "value": "mao_http.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2b0896-0363-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770386236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386236, "uuid": "a025084a-ac2e-4144-b409-a2415a78df02", "comment": "Malware payload (Gafgyt)", "value": "2981df1fc5ec43ab7e1aecdc15eb1783", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386236, "uuid": "6ca6ba6d-a66e-4bdd-9132-e805da599ad1", "comment": "Malware payload (Gafgyt)", "value": "91d6da06b5d9ae41f7d730777dbc98f9a06967cc8df9ca857ad280fb9ffc409c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386236, "uuid": "fe6eb0de-cd55-4a1a-b664-26cdb9cd07d4", "comment": "Malware payload (Gafgyt)", "value": "b94e5f78ec8689f65f1906c30e889d8439244264", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386236, "uuid": "d3a21dcd-fbab-4bee-9401-1b8dda3b2aa6", "comment": "Malware payload (Gafgyt)", "value": "567e1c9fcbc61cdc7a4912dba3891c6e852991d4038d45a0c9161a12bf9078f2614972c8c40a3566b65767c168c67504", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386236, "uuid": "09810801-1021-4a83-aa72-0de1280f411f", "value": "T1F0A36C1B6241C5FBC08756B62BDFA6615823F83A0B33710673D9BCA83F219C95D6E781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386236, "uuid": "a2081a20-d929-4c75-abcc-3280547024b9", "value": "3072:4N2nTlqWoerOuqoYyhADXr5SrcphaijsTmHyVQX5A+u+cm:dcyhQrphaijQmHyVQX5A+u+cm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386236, "uuid": "74f3f663-01f6-4b3a-9e17-41821e5fab19", "value": 102934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386236, "uuid": "27a57759-d430-4e2b-a055-40df02d48b21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386236, "uuid": "d0c8aac5-0a78-490a-85de-464050202282", "value": "yakuza.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec3eda0-0360-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770384732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770384732, "uuid": "b225c345-c0fa-47cb-91e0-aa51de6b5047", "comment": "Malware payload (Mirai)", "value": "426d4a12185eb97c0d636f40f8a943eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770384732, "uuid": "7f1e6261-3255-4e2b-b754-d8b0ad19874c", "comment": "Malware payload (Mirai)", "value": "932af3e6eb55d609d259e06ea7a8ae307652ba615e3ec6e6cb34d4fd11ba2ff9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770384732, "uuid": "ebe4008a-1d39-47ed-801d-d2135bcbf637", "comment": "Malware payload (Mirai)", "value": "236a4f3cfc6cb1552601abe83ab82c12c97fe420", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770384732, "uuid": "1ac3d928-2507-425a-bd5e-16d55c2ce846", "comment": "Malware payload (Mirai)", "value": "95c00ddc72aed94317c88b5ca43010a13eefba4977ad0fa14adc7f6ecb5b252f27668f2355a7041293176664125d4364", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770384732, "uuid": "c66d680c-ed9c-4023-8ea6-97945814630a", "value": "T144335DC5E643E8F6D8574131217EF7339E71E1F82234EA53C368AA31BD52A81A507E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770384732, "uuid": "3e137d47-c0a5-4815-8551-1075c8ab01eb", "value": "1536:0BillLDUzYvdm+bv3OCvSk9pOvRLD8LCSM:AildDgYvdjbv3lvSAp8GLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770384732, "uuid": "c63d5c06-8880-4fa3-8d3b-3f4bc95ee020", "value": 51792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770384732, "uuid": "606197f5-6aed-4fe1-bc48-222cb4ea577e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770384732, "uuid": "cf19e089-f8e7-4301-ac7c-1c8359f022ef", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "021b00fd-0315-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770352418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352418, "uuid": "e7dd630b-65f4-408b-8ffe-86fcaf31c416", "comment": "Malware payload (Mirai)", "value": "bab8a272edcc4dcc69bd5dfe73bc8154", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352418, "uuid": "155d0b4a-e0a7-4be9-a6b0-ad5c50598ece", "comment": "Malware payload (Mirai)", "value": "938c7065352bda52e152da4c5367a100dcff68347e40fcc724b525e42e41f4dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352418, "uuid": "61c3a37d-158e-4a34-9b3c-330fcb86b0d1", "comment": "Malware payload (Mirai)", "value": "fbd49c7d82b32fcae2f868018b1ea449509cd53a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352418, "uuid": "41351ccc-bc4d-4c3c-bc9e-160fe5b195aa", "comment": "Malware payload (Mirai)", "value": "9276a9341c66123ef8446eae7a05266275c99af9f6fd401e9da7ca5bb2e62e16c67ccbf5c5d6a324a6905f0bc17ff20d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770352418, "uuid": "7eb45a75-9628-475d-8427-bd2d1d199e34", "value": "T149A38DCBF74B4490C8654BF10BDB4BDD3E2362225E6B88E76C1D663A1D351CF5A0A392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770352418, "uuid": "9f97e4e1-9fce-481c-83d0-0cfd5ebae27d", "value": "1536:mSCNnETRHkTMxrSvCm3iSyrWwloggh/LWeREd:mxNnETNIMpqCQiSyrWwlogghqeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770352418, "uuid": "206692bd-9ed5-470c-b9e7-91717bbf024b", "value": 99444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770352418, "uuid": "96c1dc18-7273-45f3-8768-8da5ff5b75e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770352418, "uuid": "eb63714c-cca1-4cc6-a859-9090973179e9", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3358d3-037f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770398069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398069, "uuid": "a9716dea-2025-4a65-99e9-1256a920d582", "comment": "Malware payload (Mirai)", "value": "e3a83a64aa437ecc4dac6df4ec1eb95c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398069, "uuid": "6a1c4556-de98-413e-aab2-b07fd472dd7a", "comment": "Malware payload (Mirai)", "value": "941ae9e1c7ef343db21c0d5f6217bc868f5be9844c887c7230f9cac7ffa5a28b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398069, "uuid": "01d7ece1-69fc-4b6a-a576-6dda07a4b586", "comment": "Malware payload (Mirai)", "value": "12295cac9f9ffb00b6140de39b38a5f8c5543610", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398069, "uuid": "814fcd11-6e7e-4b0a-85e8-e8a72be9cf49", "comment": "Malware payload (Mirai)", "value": "525897b7050cd2f5a3a6b66247e9f2a85b859d798547871058c8fb97a972e96ad1cab0fc279ecd0a1c365ca23c1edfdd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770398069, "uuid": "b8fcd83d-abe4-489e-ae2f-9d38af174036", "value": "T1BF14D806AB910FFBDCAFDD3746E9070129CC641B22A53B363674D528F54BA4B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770398069, "uuid": "959a6ba1-000b-4aee-a182-1701e2cf8d82", "value": "3072:82s9HpL6la8fCP5zI2SFalOQDX8VqpRa+ZQWjKoGIxHuSX:8rpL6la8fCBMdal/8VqqyQWmIxHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770398069, "uuid": "2dc05323-3b97-4983-ade6-8378217a3d29", "value": 202476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770398069, "uuid": "21078966-57d2-47c6-be07-66659f318322", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770398069, "uuid": "7291be35-5cf0-4803-9668-241503cb8f55", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ee6e90-034f-11f1-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1770377525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770377525, "uuid": "cec5cbb7-d092-48b1-b275-aa897c1679de", "comment": "Malware payload (Gh0stRAT)", "value": "3ff8b7ba46b6445a026cadf2a5fe91d2", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770377525, "uuid": "dd4a3633-37ea-4572-8a25-8b4cf4709cfa", "comment": "Malware payload (Gh0stRAT)", "value": "94620117e0c4878da2fa57362058aadd437f1639d3c6d1337b27b8c3070357cf", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770377525, "uuid": "86474a69-8917-494b-98a6-9c086ee21d4e", "comment": "Malware payload (Gh0stRAT)", "value": "dc4105a653f0d08930ddd0879c3c1a090a3e1fde", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770377525, "uuid": "45dfedd3-76b7-4783-9496-d60fa6562379", "comment": "Malware payload (Gh0stRAT)", "value": "b5a01528212e3d472f25731c367a91dcb501b1412099dfed952476fc0327c6fe0a22b958d1e83c36e00f56b0259d2cfc", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770377525, "uuid": "c5a2182d-5264-4625-8f79-f25f3e710a34", "value": "T1E2573322A6CBC432C66E417AD925FE0D1579BEB3073045D7F3E87DAE88B58C19274B42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770377525, "uuid": "037a72df-d4f2-4036-88f6-db094c3d27b1", "value": "393216:04x+LqVJEIJ5X2CpKRiiqMmk4WDOuIr7wiwF/y2GAudvVNPhQ0v2ZtRLU5:0VgJrUCfLNICrsiw1uxV1hQt1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770377525, "uuid": "f7920299-11a9-463f-959f-e734e0b6264f", "value": 27302400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770377525, "uuid": "90f69dbf-2c0a-4ffa-9652-8b2f52015556", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770377525, "uuid": "4f46fbdb-19fa-4e90-a378-8a044ae0e5d7", "value": "meSetup13.2A-8579.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1adba8d4-03a6-11f1-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1770414737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770414737, "uuid": "8594ea3c-d553-4ddc-bb3d-7f6e0a503264", "comment": "Malware payload (BlackMatter)", "value": "a0126911f1b054ef93e18870c7f038dc", "object_relation": "md5", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770414737, "uuid": "d937c2a0-4799-44c8-aeb3-822f68f7cce1", "comment": "Malware payload (BlackMatter)", "value": "946410c4b8d333a3b8fb34b76e684eee539cf063aa268720e9e60b04aae70059", "object_relation": "sha256", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770414737, "uuid": "e4a6cdf4-38ac-44e4-8f2d-37b012391aa6", "comment": "Malware payload (BlackMatter)", "value": "de817dc61302ec256d78d63d1b602c0f857c0c25", "object_relation": "sha1", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770414737, "uuid": "f0f5e7a5-9f65-488f-84a8-ad8a8811f7fe", "comment": "Malware payload (BlackMatter)", "value": "f1e079cd8fa50e3a53279525e41f7e1c9ae41e85409c04d37100927a1e2915ca1be4be4e133e9f0a09820de13b120971", "object_relation": "sha3-384", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770414737, "uuid": "4653f0f5-9bf4-4501-8dc7-35fd289f9323", "value": "T135E36B21B25ED0B3D87718F22726B17DB3EA4D2C0A657803E6D50F887CA49632F4695F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770414737, "uuid": "443da12a-1989-42c8-945d-b4bed313a451", "value": "914685b69f2ac2ff61b6b0f1883a054d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770414737, "uuid": "a33efd42-67fa-4856-b74b-5ca95ebaf8ec", "value": "1536:LzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDDvcDf3Cb8QTGpzlTTmUofEg0kd:0qJogYkcSNm9V7D4DKA2WofEgT5jT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770414737, "uuid": "658eb1e6-5067-4b11-b190-27143df63496", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770414737, "uuid": "175130d2-6ca4-4c4c-aaa2-240eee715a4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770414737, "uuid": "43d1b6cf-6aea-476b-975c-e40b1f26016b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc9a562b-0365-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770387091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770387091, "uuid": "8c77ce83-c7c0-4432-9d28-850a190994b9", "comment": "Malware payload", "value": "bb30b4a53476f8200df369dfcb043b5e", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770387091, "uuid": "00e97ffb-b4d4-47a9-b54c-12a03c700681", "comment": "Malware payload", "value": "94a99ec6423e03f30661c0a83f9b1856f7708e99412456b8f83055484e9ecb3a", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770387091, "uuid": "ad37ba12-f6c4-439a-bf92-7623b0b673b3", "comment": "Malware payload", "value": "64a06f98c9a1fed6258a75ec48562fa4a4425b5d", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770387091, "uuid": "ffaec2cf-1d10-4012-9604-8d396a9e5506", "comment": "Malware payload", "value": "28347f5b5727c455ffb9be73c334729c4df7ded89bec9760c736924a3ccf9b54b7c6e63ba15d282f699ced0876b18de2", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770387091, "uuid": "e8f34761-cb6d-47f7-b5a0-d6a73e9d7649", "value": "T10606070CDEE5AF5BDA12B6BD8DAB5681B1BE99C0AB03E3538304B11718517B585CF0F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770387091, "uuid": "04c746be-a745-4f7a-914d-66f8251fdb4b", "value": "12288:UtJvFrN20gtpbrw1aTERChCVcgWi+skco49xyQNfwDErGLQSL9lFW/oEk67/c3J6:UzvO04EqEk670vO04EqEk67E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770387091, "uuid": "5c38574c-d7fe-4ff3-b004-903dcd4a2bf5", "value": 3736536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770387091, "uuid": "16a744b4-2a4f-43c2-946e-1c5857d6c009", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770387091, "uuid": "14b3a7cf-f993-4433-83a6-f2539a54b23b", "value": "update", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adaadc10-0367-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770387925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770387925, "uuid": "c4b72a1c-a402-40af-a115-4e0a0298c2d2", "comment": "Malware payload", "value": "1da969d273433277c572a93d7d4b7542", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770387925, "uuid": "05a99c35-45fb-4993-a1ec-01c56dd2a054", "comment": "Malware payload", "value": "992b2bce1907b26fcf61cdb14ebebc1e1a381d35ac8352ad17e0ad711b9eac6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770387925, "uuid": "35b7bbe3-231a-4999-8d5f-32ae0c2e705b", "comment": "Malware payload", "value": "2a004490996981bd19b1c19b552b850fe10f0ea5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770387925, "uuid": "9a2a810a-8d15-4be3-8276-8567f9d2363c", "comment": "Malware payload", "value": "3e5e7df68b4c995a71ec7851353f8847e8376470f107412adb5ad6d92c85691820d98998dd3bc867de54f5381228a799", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770387925, "uuid": "12f12801-91d9-468d-ac2c-fb8ba8ab06f2", "value": "T17C766C43FC9161A9C1EAD230C6769252BB717C891B3023D32B50B7B82F76BD86E79354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770387925, "uuid": "4a617434-319d-42f9-a8a0-870c55b9c856", "value": "98304:/m2nawVJcVEKKNJzQ17yZUeXZGGE6kJ6EUGzbrFCgYE7m:BTVMAZUhzIFGEgYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770387925, "uuid": "7ff5d6f4-b1cf-443b-afaa-fb2a7ba50587", "value": 7265311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770387925, "uuid": "c78f0ea0-4cfb-4be7-8410-fe2393231745", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770387925, "uuid": "8cfcddb5-9b63-4dea-bbde-cb0a11f73260", "value": "HSBC_job_offer", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f2bc78-0386-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770401114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401114, "uuid": "750e1920-1cf1-4088-aa2d-cf0f7126a318", "comment": "Malware payload (PureLogsStealer)", "value": "0d74b38bc5d791c4f3fe2bde70dd028d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401114, "uuid": "d74fa410-3447-4168-b76f-8cfa54d8a605", "comment": "Malware payload (PureLogsStealer)", "value": "9b7eb55b9f9e70b5477d13e0cde47b2e13c9e6e6fcdf606142ddf39f16fec92c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401114, "uuid": "7326a2f3-8001-43d3-ad7e-ed2aa26cd496", "comment": "Malware payload (PureLogsStealer)", "value": "8f912e21528c613e672064c5458dd7a3f9de2ecb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401114, "uuid": "c524ef87-5936-4d07-bb8a-9b665cf91584", "comment": "Malware payload (PureLogsStealer)", "value": "c67fc7db8d3bbbe32a6e845e3618e0e5b3f0c77e52484366c2b43f1982053b2e6c8786176102289e11ec1363805b64b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401114, "uuid": "3c4e2733-6709-4437-a848-a2c58c0cca8b", "value": "T1BE6423876B4FC974F2D45A7EC8CBEA42173187785392DECBB39A2740640474BF365A82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401114, "uuid": "63154480-b59b-4732-89e7-4ab2ccfc8060", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401114, "uuid": "f8e092d3-bcaa-4c78-b4ee-17c9f3180863", "value": "6144:tF5y4UQUm6fa129eTF9Zm1sMxZShHoDux8VvSxUUgaTskj0badn+1Mtiot:rXBT6y129eTvZIsiZeIDNvSvTsky1Mo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770401114, "uuid": "cc493a99-c707-411f-821c-1c22c4012f9b", "value": 318464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770401114, "uuid": "ffe1d3fa-8482-4a87-986e-006c032ee767", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401114, "uuid": "2d4bcc25-1442-4ae1-95eb-f178d3c252d6", "value": "0D74B38BC5D791C4F3FE2BDE70DD028D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42102ec1-0364-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770386456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386456, "uuid": "01e54eee-2a10-4d57-8e9d-ea2d64113817", "comment": "Malware payload (Mirai)", "value": "1901145185343ac7ba173318837eaf67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386456, "uuid": "667bd0d9-4dce-4992-bfc4-c0ab2ede93cc", "comment": "Malware payload (Mirai)", "value": "9c71a75985d0ecc016307d8182053106050f097431e5a88e8d4e1c8a16432a98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386456, "uuid": "d7b8fce3-9fa9-4d43-95d5-f1b8c7bc5d2a", "comment": "Malware payload (Mirai)", "value": "466b448b5dd4121fd7e6f9240ca6b4b5b7b3c6fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386456, "uuid": "3ba69b19-3a81-4539-887f-5b321e088add", "comment": "Malware payload (Mirai)", "value": "27114d034709d44db9124a395191e64d66f403bdacdb2d6d3ea2ffc81c473ad48a919fee436459abe155d165c9af4fd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386456, "uuid": "ea61dc03-b533-4f1f-8197-2eda019939a0", "value": "T15B144911FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386456, "uuid": "f3d4ef2b-e0be-49f2-9bec-258772c53f8c", "value": "3072:ty5+GoCEggi4NerYqltSwJpH6+cYstkoUat:o5H5BT48rYq1wjY2SY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386456, "uuid": "eacea7c6-5cf5-49b3-87ad-1b173180f49d", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386456, "uuid": "6b650477-060d-4ea9-b47b-08594826e146", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386456, "uuid": "a626fcac-00ec-41c6-9af7-78825e729b02", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1128c326-0364-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770386374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386374, "uuid": "fd0f36fe-af25-4abe-bacc-e2a7f9a92900", "comment": "Malware payload (Mirai)", "value": "688292ed38130e1cdc892a17f9e55ca6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386374, "uuid": "342ad509-a4e0-46e4-8c97-906c76d5217f", "comment": "Malware payload (Mirai)", "value": "9ee46d975a62257aae4f89e54567ddc9741fad772edb841945b9b9b1e2eb4ef4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386374, "uuid": "549ea889-5330-47eb-b4dc-d053ae70e5c6", "comment": "Malware payload (Mirai)", "value": "9cb3ac7237ef3bfc376c88f624eec9d63e831548", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386374, "uuid": "d70211bf-6a15-4479-944c-f7ec9a25e7da", "comment": "Malware payload (Mirai)", "value": "8c7b3bd9f90f7684ff415cfd2cbe28ef9f7598777ebdde923220f8443888df9f5d81a4a57e8be267bc30606c5966721b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386374, "uuid": "59c0a582-5836-4057-9b27-7a47d4535eb1", "value": "T1E4146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A99772256246CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386374, "uuid": "982affba-321b-4a0e-8f22-dabd7cd8b806", "value": "6144:zNROm5155gL6mTX7zRR1Lwt8Al7IKTtX:XgLnLzt0ll7IC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386374, "uuid": "4409fcc3-99a6-41ec-815a-6f7eeae3af30", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386374, "uuid": "c9dffc4a-6022-4cd6-a910-2bd0c160111a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386374, "uuid": "8c20d06b-5be6-4101-af19-043cf8c58fd4", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9eb64b4-0349-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770375061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375061, "uuid": "21fafa55-62c2-4916-85be-cb592b853c3f", "comment": "Malware payload (Mirai)", "value": "c4f992e90c3db4b3a37b9dcc23dc9645", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375061, "uuid": "f7313de5-8743-4ce4-a866-9d3bf6e35e2c", "comment": "Malware payload (Mirai)", "value": "9ef77eb016ce406ca7dba90322b60cad6c1986abb9ed572e2da8ab354276515e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375061, "uuid": "923a58c7-9391-4350-90f2-774565b6df74", "comment": "Malware payload (Mirai)", "value": "ff909c9a04453ede53919d05a60fea3d5ef94558", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375061, "uuid": "f942f7bd-a030-4dfb-a7d3-397da830b511", "comment": "Malware payload (Mirai)", "value": "a05de2fdf5a5cbe00f6428ebf2cbc0ebecb95158d2e3d2fff1f3c5e9450df8f7e96e2571397a00a6ff66a1381c948592", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375061, "uuid": "a6aa9860-a365-42f5-850e-f049130b8016", "value": "T107B39CDBF2470260C8624AF007CB4BED3E2723815F27C5E76C6A657968791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375061, "uuid": "8092232c-88cb-4fba-b87a-5d689f6f38f3", "value": "1536:Nu27gBY2vSSpnHl5IZw6rqhWAg1v/LWC:E9RSyHlX6rqhWAg1vq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770375061, "uuid": "99f37a8b-cc43-4837-9988-7a0030842c34", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770375061, "uuid": "189a97ff-cb17-48c4-97a6-9a15c1ad66f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375061, "uuid": "0d36b2f4-e363-4afa-bea2-19dd57e74101", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8298ef6-0306-11f1-a129-42010a9c0007", "comment": "Malware payload (Egairtigado)", "timestamp": 1770346389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770346389, "uuid": "19b1c15e-544a-4ca8-8923-bec2ec943aa1", "comment": "Malware payload (Egairtigado)", "value": "684875d50b94a6cfa2af91198800e0d5", "object_relation": "md5", "Tag": [ { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Egairtigado!rfn", "colour": "#A24468", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770346389, "uuid": "29177a08-82f2-4ecd-89aa-0fac24ef09e1", "comment": "Malware payload (Egairtigado)", "value": "9f56f791d572e709207170057f565473a470d0837addda77e9ac06d07b38d468", "object_relation": "sha256", "Tag": [ { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Egairtigado!rfn", "colour": "#A24468", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770346389, "uuid": "7be7c1aa-c34f-4584-8b2a-a7e31de44cef", "comment": "Malware payload (Egairtigado)", "value": "37c4915f17fca5bbbf327dc724d8782708349be7", "object_relation": "sha1", "Tag": [ { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Egairtigado!rfn", "colour": "#A24468", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770346389, "uuid": "cf40b4ed-ce74-4953-a2b4-558d92a1116a", "comment": "Malware payload (Egairtigado)", "value": "35c8a11b0ca0980d6e4780126bfd32446523300bafa6b6df56af55e129730dd6bf890e803b573a43d63deaa3fe7bbfd5", "object_relation": "sha3-384", "Tag": [ { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Egairtigado!rfn", "colour": "#A24468", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770346389, "uuid": "0c1b0b14-5b08-4d31-a0f3-b0d312540d6c", "value": "T126A6335613D100E3E9EBA23D4A62D4E6C273B8116B22D99F1BE4466F3F172F25D36B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770346389, "uuid": "6755eb89-5ae9-4f43-aa3a-1f25c0c01f82", "value": "351592d5ead6df0859b0cc0056827c95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770346389, "uuid": "43bb2ccd-432e-4e71-8e2c-2f78fe327758", "value": "196608:uIhsqlGN6LouctbW897G+x7eovq5XMP6PzFcs6zZHsoqBbRjMFY:Yqlc1Fdq1B7LSZHsoqBbpiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770346389, "uuid": "85fe372d-6651-4993-9c2f-b3c7ef97133b", "value": 9908223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770346389, "uuid": "950eb1a9-be3a-42d1-a776-65f40965488f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770346389, "uuid": "030497dc-3411-4ad2-acdb-3c9e1151085f", "value": "secure_tool.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fd3ca2d-036a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770389083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770389083, "uuid": "05d75d61-72b2-4458-82e3-b7b604e9528f", "comment": "Malware payload", "value": "648a31b54b3bde2c8d7aa9674a4a1a97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770389083, "uuid": "688300e3-2cfe-42d3-93ac-1448ffbb9e3c", "comment": "Malware payload", "value": "a13657727d2e17d9512bbe22165402036be3c13e419121b1726e250c90c01b18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770389083, "uuid": "29ced96c-28dd-44b0-8b16-9ebcedc36128", "comment": "Malware payload", "value": "3210da12c9f91b412218d372999b19f22f4f493a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770389083, "uuid": "e17f0c42-2410-4ad3-9ef6-45849d4e00d1", "comment": "Malware payload", "value": "93225bdbbb5726f87a8ce0e40527217c2592f8e6dc3784167db6442294d3857b3997700eb3015c9a87764c3aa3919681", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770389083, "uuid": "013a55c4-f987-4f55-82ef-9a52aa3f3462", "value": "T132F76B4267EA05D5F9F79A349AE65213D673BC066F3081CF324C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770389083, "uuid": "a9cd8168-ffec-492f-97d2-5e191e95f231", "value": "c26e33877abaa94e37e0b8ae3c8d27f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770389083, "uuid": "379676c3-3bc7-4056-88e6-4a40221d0cc9", "value": "393216:FfUJsRJDQVZpWWWrGc/d0ULRRQcKPxeUSp3LJpbRQSI8wxSvDazn1N5VRoEY7SmF:FfvTRQtRe5+asRv/UpgPVlcmTMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770389083, "uuid": "879fcbe4-01ec-4dab-af64-7f1b0e306d78", "value": 72882688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770389083, "uuid": "5eeca1f6-bad9-401f-9e22-41a2a709cfcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770389083, "uuid": "109ad6ee-cc4c-4c69-9a79-57c5ff1e09e9", "value": "Updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3a0b67a-0349-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770375050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375050, "uuid": "70af64ae-a82d-45e3-b0f3-07a8cc36bdc0", "comment": "Malware payload (Mirai)", "value": "6c029dfef4b6f953e59df03eddcc6e2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375050, "uuid": "78798a44-6697-4d20-9dcf-cf3104522157", "comment": "Malware payload (Mirai)", "value": "a5318581ba6b71c49dfaf71c0ec469e9d0ff95ba80cfc6eac5bc7f326e42c356", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375050, "uuid": "9f7d06fc-63a9-4675-bf42-0e730860c998", "comment": "Malware payload (Mirai)", "value": "798dfeb8fa4da72cbd1c6accbfe3cb45db51a113", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375050, "uuid": "f843715c-8b2e-46bf-bda3-81ad7bf1a7a2", "comment": "Malware payload (Mirai)", "value": "e50243b8ddc696f94a11069021af1f5a247fbe16870d91e17004c51ba4b170371d6a3b66849f6b9cace3fb08b5c9c2ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375050, "uuid": "ed6f965d-6ae1-4322-851a-ad47224134a3", "value": "T1CFA2CF2C51A6BCF0E3309C35E679CF265BCD5EB496EA707E297402662D6544E41F03CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375050, "uuid": "8a92c097-2be4-4272-abbf-5ae3b2619ca1", "value": "384:FFSMaycA9Ijh6HITCLO849S3alekwaV3c0kyKJahymdGUop5he:LSMaycA9I9qITCapI3alZVQyKws3Uozc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770375050, "uuid": "3ea59579-8338-4b6e-a62d-3fb20c63f461", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770375050, "uuid": "8967156b-e670-4fdf-9b08-545ce72a46d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375050, "uuid": "62a81a48-6959-47ce-9e3e-b1cd1bee6996", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700a84fa-0346-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770373648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373648, "uuid": "2018388e-bd11-4589-9cad-af5b9c7834a3", "comment": "Malware payload (Gafgyt)", "value": "9d864a76a4f6dc1d26febd34856c0509", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373648, "uuid": "127299b7-7e0a-43d1-a222-d972a43041f1", "comment": "Malware payload (Gafgyt)", "value": "a5d1b65b1055677156cd87b357ef488704115a2cbf52044dbb041072efed2f9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373648, "uuid": "666985b5-cdb5-4a11-8c45-4ae3a31d00dd", "comment": "Malware payload (Gafgyt)", "value": "8315f650e9e4f67c00277b076ab304eed23db47d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373648, "uuid": "3dc42f5b-5665-4de1-b81f-0d7b71a5c973", "comment": "Malware payload (Gafgyt)", "value": "dc93020e112fec2dfc56eb4121919da98bd875dc7618aa777f9c44615e51f70f3a544298d0d0603a388630f24a7a95bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770373648, "uuid": "a4227962-fc47-4169-ae63-d285750d0edd", "value": "T159E30248EE9266B4F0C3467B0077EB979339CE131001E6A4E3887FF5EAC1A57186B56D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770373648, "uuid": "70fa5358-10a0-4268-9f7b-fa9c0bc78a65", "value": "3072:qa3z5a9yc6D6IZiNjux/7BXZlydm1+e/4/jcc4giiZU1q:qqm109Zihk/tlr4L7DimU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770373648, "uuid": "5d7e45b0-ed91-42d4-b2ba-36e5234e68b4", "value": 149030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770373648, "uuid": "0c6fe0fb-e908-4439-84b4-a0b76205118c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770373648, "uuid": "9a0333a7-b9da-43a7-977f-25ba6c06f9d4", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf4340d-032d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770362906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362906, "uuid": "7feaa7e5-998f-4072-8726-90a5ba205ede", "comment": "Malware payload", "value": "e6695877891f72f04f60e328d985606e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362906, "uuid": "9d24015b-b3b9-48e5-8e40-0dedf97e43ac", "comment": "Malware payload", "value": "a6f54a9f803996d850e3821a468254920c76c7ec570058a65db2953eb7b3e3b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362906, "uuid": "95480c45-60bc-436f-a50a-20bc7a69054c", "comment": "Malware payload", "value": "1bef56710e18becb7090063314110aa889330359", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362906, "uuid": "a64aaab3-24f2-457e-a478-f68c835d650e", "comment": "Malware payload", "value": "22902d2b31961fe58d1d83c0e96133e3f4d086b781492e12e8399bf1599b0a1e91c4708eda4a5f34c1953c01a277ea56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362906, "uuid": "cbeeea98-4b93-4deb-8a38-cfc27e928c1a", "value": "T12806330E1CC3BBA0CD1F6DB1EAD4C46EE3A8853D6E50E0C67667BE38419EC9E62015D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362906, "uuid": "3287c494-9369-45c9-ac44-4851951119b2", "value": "287b8c0e6c199ea2caf49c079c4563f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362906, "uuid": "e4fa30b6-f7ff-48a5-9603-40a85031ff3d", "value": "98304:jwDtW6JgTcX3heWxkz94pKHV2NR/Na1FUh9i29/mi7F:jwDtcoX3hlkz94pK12NRkevr0iZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770362906, "uuid": "f9788040-ee0a-4365-837c-f65e98be26ae", "value": 3660716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770362906, "uuid": "ad9c13dd-dac4-4240-a646-62d7c13c8584", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362906, "uuid": "690a79a7-958d-459c-9947-d55a488ad2f1", "value": "SecuriteInfo.com.Win64.MalwareX-gen.83461688", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a627ba4-032d-11f1-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1770362901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362901, "uuid": "2cae4345-26e1-47e6-83c9-21bf19e0bc87", "comment": "Malware payload (SantaStealer)", "value": "99f1bce93c9830ad83e39e9d72033169", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362901, "uuid": "c26018d2-5330-4ba6-a483-c73e5f395bf9", "comment": "Malware payload (SantaStealer)", "value": "a716aca56a2d4e5a7214f4b37f38dd77ca3afe1b5c82d76a374ef19514af6db6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362901, "uuid": "d9a4203a-6e9a-42ef-9fe2-65ddaa0b93e1", "comment": "Malware payload (SantaStealer)", "value": "ab2ea8d335b5da13e850c8d63e48afac4e55a418", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362901, "uuid": "267d24d9-2fa5-4008-b505-dbc93d61de95", "comment": "Malware payload (SantaStealer)", "value": "8ead797faf6d060775a6e2dc8b04c6d48ede84fb6d372cacaae1febac4fb821433aab35a5e987e20c6f406fc0cfd15ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362901, "uuid": "5a9de09c-2b64-4dbf-84f3-acbee578c8ab", "value": "T10516F143E2A320ECC167C274476B6AB3B931B85551347EBFD5A0DB312E61F502B2AB35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362901, "uuid": "e4d912f1-a541-42c0-aabe-6bfbb2871607", "value": "86decc6ebb11144606632964f65c138b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362901, "uuid": "b69c3c7c-0fba-4b97-8a9e-b2c26f691ad7", "value": "98304:Z1GGNHpsu8Wrq8xwhcdnicDADZh6qiJdENz6Ta9Gw1Cv:tNHJrq5hQiOAVSDE4OTCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770362901, "uuid": "7bb9fdc2-4526-421e-9d90-390a3770ff06", "value": 4213096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770362901, "uuid": "867db31b-83f1-40e2-84c4-8cf3665457e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362901, "uuid": "b127c6d3-db59-4a77-bdd6-841a5c6bdb0a", "value": "SecuriteInfo.com.Win64.Evo-gen.58774821", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1426e55-0365-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770387153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770387153, "uuid": "eb78f48f-f4ca-4ca6-b53d-9af6e751daca", "comment": "Malware payload (AgentTesla)", "value": "e65f24d83e6776b088240a9621ea7ff1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770387153, "uuid": "75d992af-5ff5-4fa6-906b-496a3896cd4a", "comment": "Malware payload (AgentTesla)", "value": "a72181561540f1c1d48dd8f33fe4b502fe8b1fdf27a908b035296276638af564", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770387153, "uuid": "d5ff5de0-7652-4096-97c4-d5e8f612e550", "comment": "Malware payload (AgentTesla)", "value": "ae89b4e1c4c1c80e4e7bb3d0eaad11f9953a5894", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770387153, "uuid": "ddce8240-f74e-4bb3-8125-88cde66f7866", "comment": "Malware payload (AgentTesla)", "value": "d05ec156bb31c6f1e98cef9a418208bd3704b3658c5c1d7a4dcd71626ca55202d5bb845cb9ec48697630bc92ea1d9927", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770387153, "uuid": "958e334e-752d-491a-b2ee-e00a7dd79805", "value": "T10D45C00223E85FA9F8BF9779193440254BF8F906D722DB9E7D8984ED1972F40CA51B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770387153, "uuid": "12b03cfc-1dbc-4a02-a2dd-7f743641839b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770387153, "uuid": "953c4c4d-8e70-469c-be5f-a3b6ab3d85f0", "value": "24576:gVzetQbOVebkLKuxjBQcvT8C28EOyO9ToGj4h/VllaqMi1wjPbdLoR:gV+AbkLTxjBQcvASEOpTv/poR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770387153, "uuid": "51d855d7-6bea-4072-9235-5ee8ee9a394d", "value": 1186304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770387153, "uuid": "7854d102-72f0-45bc-8743-3a928def5f2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770387153, "uuid": "d5ec4eb9-0ea2-4701-8934-b24f99d96663", "value": "SOLICITUD DE COTIZACION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be55c821-0363-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770386235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386235, "uuid": "7537842a-6c70-4160-8467-5430a585fe74", "comment": "Malware payload (Gafgyt)", "value": "d25f44a6605f7f748aa216f47df3df5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386235, "uuid": "cf64e7f4-8aad-42de-b2a5-037a609f5dd4", "comment": "Malware payload (Gafgyt)", "value": "a762b97dacec6d92e94272e1cddd7ae843315dab2469cb3d766ea968c046a4d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386235, "uuid": "60793fb5-8e0b-4973-8e87-6bccd85c0fd6", "comment": "Malware payload (Gafgyt)", "value": "618b738451d16060d3ce4684aca83ba86e709382", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386235, "uuid": "667e4f76-e070-4a9e-8118-955ecfa44449", "comment": "Malware payload (Gafgyt)", "value": "414cb911f8967edb7dab66c7688a7e903113b79aaaad40199aa0ce0dede303dea7ab652dbf6dcaffefd59ff44cababe0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386235, "uuid": "2838c335-a5b7-4a0f-9712-8a529fa37314", "value": "T177C30A44F901475BC3E327BAE78E038C77355E6857DB33156A38BDB42BE1B982D29260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386235, "uuid": "a019dfc4-7e1c-42ff-b07c-f0acf14522d0", "value": "3072:H63VpNeuWDGeQf8sRCdt3DxkS2YmyVUQuiXfQd6W:OSuWQEcCdt3ZmyVUQuiXfQd6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386235, "uuid": "85776594-a64c-4148-ac89-6459de022a72", "value": 127723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386235, "uuid": "54f0ff2e-034d-457a-a3db-55925b1d28d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386235, "uuid": "18c476c3-7aa4-4841-be55-ea0dcbe1df09", "value": "dss", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4441803-0327-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770360556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770360556, "uuid": "b7772180-6aa0-433c-b696-f6db54671380", "comment": "Malware payload (Mirai)", "value": "48f55e71eaa61abf754a416702029708", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770360556, "uuid": "0a77ec23-516d-4f4a-a520-f45d9b0a6711", "comment": "Malware payload (Mirai)", "value": "a8251cc61edfd024026b288f46357427aa893b2c0518d3b33b1c460d249cc932", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770360556, "uuid": "59baac5a-0271-4ee9-9671-f3e4fbda4c81", "comment": "Malware payload (Mirai)", "value": "39d7c27e6b8033fcd17f8630ab6fd39c88c54bbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770360556, "uuid": "36496d8c-4560-4aab-9299-9171b1685e03", "comment": "Malware payload (Mirai)", "value": "fff94354285a387f6daf13ff3911f78481038d08abbe0a43828a73b7964619ac05f5b12e02029eac2b92c63ba634440b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770360556, "uuid": "d358ac42-8cb1-4a6e-a300-e743aa34ab3d", "value": "T151933955FC824622C6C116B7FB6E428E372713A9E2EF72039C155F21378B91B0EBB641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770360556, "uuid": "113eab92-de3e-4683-bba0-858b1c0e8b47", "value": "1536:xfbZtAvd1CVvhNuUissqw1hx9nBeZ30wKS/r1oHD7vj+2PJ:xf1tAvd1YNsqwppcZ3XpIRPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770360556, "uuid": "16d070e0-f21e-41d9-9397-f5ca0a932be3", "value": 93280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770360556, "uuid": "cfd849e7-ab4f-4abc-8d4e-71d0f87fca46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770360556, "uuid": "66e3336e-f284-4d5a-84ec-a6c6bea40c02", "value": "titanjr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d746e9-0387-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770401657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401657, "uuid": "9d767c1b-8f6d-468c-b4c1-e479a2db1ccd", "comment": "Malware payload (Mirai)", "value": "31e7d8ccbeaebbc80687efb097d6b7c0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401657, "uuid": "ba42043c-6b1a-4ad6-bde4-d04810155f9f", "comment": "Malware payload (Mirai)", "value": "a89363a9770a74252a80ba69d225812e638e290a77ee2901975ed0f4f7f0dc8a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401657, "uuid": "bf737452-0dea-4732-8415-9d891a5eb991", "comment": "Malware payload (Mirai)", "value": "7b659068d177668172cebfde00852d309bb4086a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401657, "uuid": "dbb484d7-5852-43a2-b012-706d4c031f82", "comment": "Malware payload (Mirai)", "value": "31cee9e0073f39b9d5fb6ad10612839c72d5d69df37e37464187938e3e70e6c2c7b5b2352e51c94119f86783fa7fe9ce", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401657, "uuid": "416ea25a-1697-447d-b758-b015a50ba7e8", "value": "T13371A391F812407C1D2A9B62ADFB51BAF049B3C7B4E77A0FB99828F5618CF005589DD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401657, "uuid": "811a0641-6d93-42f7-a9b0-39a06ffcadea", "value": "96:iv3N3Wx3k3O3CB3yE3530353G3c3o3T3Ywz:09mx0+SBjpkp2sYDoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770401657, "uuid": "e395fa0c-8c70-4811-84ee-7eb5a787c2b2", "value": 3724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770401657, "uuid": "e7d7dff4-868c-45e5-92f0-849734a9f8e9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401657, "uuid": "c1ebd39a-cca6-4d02-8f23-fa08bca2c64b", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f20150-038e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770404696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770404696, "uuid": "62f22f1e-68d4-40ec-bad8-83c30ae5e1ef", "comment": "Malware payload", "value": "9e745eb88f0a827e4bfd1ad9bb325b9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770404696, "uuid": "ff45480a-7b8c-47fb-bcf4-ec125ec938d2", "comment": "Malware payload", "value": "a92db74f7b849182f271ff2d19a637d49d1629aadc75371928bb8c66452c1d66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770404696, "uuid": "a5afbec4-a28e-474c-8050-04a0a0dfcdba", "comment": "Malware payload", "value": "c63df3509666b0ef5331cc8d056e26ac94d4905c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770404696, "uuid": "d8baf02f-2b0c-43f7-b6df-167c9aa8e02f", "comment": "Malware payload", "value": "297c2c268ad9f5a410cb516ada539263dbbad63251a970710b3d2d34c2d5de3491a66046f6022e1f87732133b3c92bfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770404696, "uuid": "b60e3c9c-8361-4dca-bf9a-99ec4619f518", "value": "T16DA4E907B2918E62D2441733C1EF081053E5A98627A7E70F3A8523D53D867FEDE52B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770404696, "uuid": "dddc2d39-4907-4c18-b03e-e9f45e083302", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770404696, "uuid": "1b207378-1b04-438a-aeb3-69168a726a4e", "value": "6144:EWKWyJQB6X9YI9R0mKMTwmTO48Ms9KTYWGT92eNOOmtl2YVl+bAlJh5:EnJQB6CIHr+4Lswg2eNTmtw4/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770404696, "uuid": "6a47c5a4-fd78-4827-bb7a-80cacecb0b81", "value": 489808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770404696, "uuid": "9380a895-c175-4ac7-aa35-d94376899fb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770404696, "uuid": "6d2f814b-b6a7-401f-b834-b0f603e4b919", "value": "fst1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf6fe9c-035c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770383280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770383280, "uuid": "295bfb9b-77e7-4813-b549-1ceb1ac2b415", "comment": "Malware payload (Mirai)", "value": "9b38e2f49177385b349e83f0562b8caf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770383280, "uuid": "ea7fed76-7156-4654-9e61-a453bf29b976", "comment": "Malware payload (Mirai)", "value": "a98fc17acb6a3a274eb728bc4d87d627eb3d41f37ebefd67b57ac9e896bff1fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770383280, "uuid": "61d1ca3d-4ffb-43c1-919a-65d4adc8d67d", "comment": "Malware payload (Mirai)", "value": "b8be4cf409bf5adb83c5091d344faf9b1078b782", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770383280, "uuid": "cab451d3-5732-47d5-b28a-9ff5aaa5a53d", "comment": "Malware payload (Mirai)", "value": "5fde27577b17e6d12b7a33e4bc40e1bad654cf071138f84cef9a77164a81909477d916fde814146c2046be512f56fb85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770383280, "uuid": "1aad0bb1-f2c7-4030-820a-c12651b47f5a", "value": "T10C530782FC819A07DBD01336BA6E61CE33257399E1DE7247ED126F613ACA91F0D6B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770383280, "uuid": "ce7e0ebd-a3b4-4df3-8e38-ba562ebd5931", "value": "768:RShIy19IkyR5wmKNMil8KhoKUz6m/etTQ+Eg1cmKF4QPpo77HabBNu56upsTZGUq:AIy1WON6ilQOkETQ+FcRzPkXpswm8FL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770383280, "uuid": "1ee38010-4c0a-4041-a4d7-e250c87df3aa", "value": 63656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770383280, "uuid": "56261b42-8d04-41e2-94f4-43c80d5c6cc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770383280, "uuid": "fc7410f9-20a8-46d5-a387-67e663ea4783", "value": "mao.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "831faa8f-031b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770355212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770355212, "uuid": "3ebe73bd-00c6-4dda-962f-d4c8e176d3ea", "comment": "Malware payload", "value": "a873a9e36eb67dc394595fc34db9e30e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770355212, "uuid": "e8d151fb-6f51-4e23-8280-9fae0ec10d95", "comment": "Malware payload", "value": "ad9abbacc85360db2fce1f25a6978e02848a9b6588e30438a089ad8620a3e118", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770355212, "uuid": "b8dd4c26-3ee5-49c2-a106-956c6723fe67", "comment": "Malware payload", "value": "d20c5bc3ede538da060e0fa00cba85cea07236bc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770355212, "uuid": "78bc092c-9ad6-4167-a526-156543852ac5", "comment": "Malware payload", "value": "a90c9049da8ee914acf57ecf3531e102559de6c4a34a302217ddd152345ffaecc8b8ae305eb3635e5815a1cc7da4e549", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770355212, "uuid": "aba90718-49f9-4d43-a982-02421bfbe334", "value": "T169765AC7FCA404A9C0AEE33589629163BA717C485F2123D72B50FF682F36BD06A75794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770355212, "uuid": "d496e1c8-b3d4-4491-b6c4-47ff309ba164", "value": "49152:+gZDlTVfPP05lX3X9RQWCCRxvWH3amzYmL3wWIo3baPAHlUoxwZPPZRitGi+fGDt:+wzHbAR6YmjRiPAFyF1VcBqEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770355212, "uuid": "a460f8ec-457d-4da7-9ab9-61481d01b51e", "value": 7164052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770355212, "uuid": "6d00dbdf-70d5-4fec-a50e-d2b6682954db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770355212, "uuid": "53a38747-5070-4b58-804f-701f53d5ab58", "value": "linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bac3942-032d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770362904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362904, "uuid": "30bbcbe7-0b7e-41d3-8b6f-5a8c963f5236", "comment": "Malware payload", "value": "917a131f30087d6faf54d955411398f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362904, "uuid": "48f552ca-b3a9-4a8a-88c4-85d0f96b4483", "comment": "Malware payload", "value": "af9cab765f55ec11fc4d0960c041e4365132aa43c593a91ddae5d1f52281564e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362904, "uuid": "481a4839-defe-415b-8b30-18c6ef06db30", "comment": "Malware payload", "value": "460f7d22eb76a47af70a32f0bd01d190685baf42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362904, "uuid": "04c0b05b-35dc-4b61-a2ff-49a152cc7e1c", "comment": "Malware payload", "value": "6ed84db35af6929dc8802e80e43ff1b5053eb974a8d53a5c8b20a18dd3980ad234a51416a3e82d844ff2701ed6fbac1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362904, "uuid": "227cf848-357e-4fbb-b5ea-53170d547af2", "value": "T169F5336A0E31AA9EFCF50FB9224C2AD9274B22954F0FEB752C3FA7CB47655D85342404", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362904, "uuid": "fc4210b7-7c63-4781-a68a-12809a8ab84c", "value": "287b8c0e6c199ea2caf49c079c4563f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362904, "uuid": "2a6479cd-d1eb-4bb4-80c7-9c0c334976f8", "value": "98304:DYt4PSJ1vOcldo/334sWB9ybgoGZmWP8i:ct4PU1vOY2fp6Z53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770362904, "uuid": "1808bdc6-69ce-497a-a847-b938c8012183", "value": 3606656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770362904, "uuid": "b140f0ac-f001-45ec-8e9d-54ccc44ccded", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362904, "uuid": "785a9a94-fe1c-487f-a72d-3b99a56a8d4d", "value": "SecuriteInfo.com.Win64.MalwareX-gen.17344527", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d4bc61-0365-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770387179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770387179, "uuid": "018c81d8-b36f-4ee3-873c-553b3bebb9e5", "comment": "Malware payload (Mirai)", "value": "9e7e6b9959522cca64aecd0f166c330c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770387179, "uuid": "65dc44bb-9e81-4f74-8dec-c5087e3b8b4e", "comment": "Malware payload (Mirai)", "value": "b29a3423456bc9ae4b7c37b4a83805541a8b11d372d48574f18b96ce0d377517", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770387179, "uuid": "d968ffe8-5ba2-474b-bb19-b0fdf70690c3", "comment": "Malware payload (Mirai)", "value": "1f6252dc47ebe99dca7b4d5133a4c8361815c329", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770387179, "uuid": "6d151044-1c55-48aa-91dc-2e2bb503478f", "comment": "Malware payload (Mirai)", "value": "d8cdcbbfa2d1f495bda457c379d68326beefc08199ee4a376a85e95d35f534467587c0a4712f2ee07f8ec1ce5f10661b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770387179, "uuid": "140dcb0a-6410-4711-be5f-cd6f5a2f3019", "value": "T1C6A349D7B401CDBDF84ADB7B4453090AB531E3A20A831F36629BB967EC751981D37E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770387179, "uuid": "c7b65207-4bcf-436a-8b9e-52ae6903f5f3", "value": "1536:vL2to9Ty6bfiohveVOpoXhwrPDsIvCA8v32HaiOeJ354Vu6KrLU1KCsBwddEEF:iRo5ekbDDsIvCkb352uZWsBwddpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770387179, "uuid": "0e649d67-2b38-4bf7-8f66-5a3317990988", "value": 99748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770387179, "uuid": "dcd2c5b4-2c7b-40cc-bf85-4b0d08079f8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770387179, "uuid": "4bd04ed5-abae-4ac6-aae8-aa1d2f381e37", "value": "titanjr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdcbb631-038e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770404702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770404702, "uuid": "b8bf9929-01c4-422b-bbad-3f95c44f32cf", "comment": "Malware payload", "value": "24a0bf143cca59a5a75ea0a3d5bb43d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770404702, "uuid": "129215ad-10ab-4c0b-9601-ce8da54d41d9", "comment": "Malware payload", "value": "b34d9c72e8772f092893430dafe4eb6ce252f40fbf70d796c9679e5194b3fde3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770404702, "uuid": "29566264-c048-4da6-acc9-15724a7e73d1", "comment": "Malware payload", "value": "78434c070534d118b1b408a045b3e8a731db0aff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770404702, "uuid": "d7ee7dfe-416b-4e52-9bcf-eb39058b3fc7", "comment": "Malware payload", "value": "4989c97e9756528ae467d59439b135db242863447b5b2d972968e99a1391030762bcfb7137e4f11cb42103609c2d0c76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770404702, "uuid": "3c090072-7bf9-48a4-a9bb-5d48707fc709", "value": "T18FA4F817B7959A21E3462737C1EA080413E6B5C167A7E70F3A8A23D53C423FEDE16A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770404702, "uuid": "66a3c36f-bf95-4153-892d-ade0684af709", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770404702, "uuid": "7efb80bf-758e-4bd0-b908-5d7be1af77b3", "value": "6144:LeY2Eowrp7rdDdmyVYH1M31O1oqgJQxfVZO4Sh0s6nvd4nTxIRBcFrqaZ8Croclf:KadmprNVzvwqf+qa7ocJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770404702, "uuid": "b8fc64dd-e40a-41ae-871f-744e77cf0fcd", "value": 489808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770404702, "uuid": "7362b3b8-95b1-4038-afb6-75094eac9e76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770404702, "uuid": "8e78a847-f3bb-4926-9cb0-e1b2d14864b2", "value": "fst3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffb2caba-0314-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770352414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352414, "uuid": "86e884a0-14dd-461f-a744-3c114162bcc1", "comment": "Malware payload (Mirai)", "value": "e19a874d8a80286cd5f7a755980357e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352414, "uuid": "83a2b9c6-e111-4ec9-be48-97b5b7ff85f6", "comment": "Malware payload (Mirai)", "value": "b41271252a2b85fac0e845a8a56ade317731c9fff1a79a743c7490eba068e2d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352414, "uuid": "4c550c43-1303-433e-9344-86d7707ace43", "comment": "Malware payload (Mirai)", "value": "eda59d45add2dcb5cbc58c5bd7d856cb551c54dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352414, "uuid": "efc4b68f-0295-4004-bc08-03838f9feda4", "comment": "Malware payload (Mirai)", "value": "94e5ef2e3eadd925cae1f1e9bb72ae0f41bc10b1531d987680f2143f0a3b6dbf6eac92ae1785533f0aeacfbeda32c992", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770352414, "uuid": "6294cb1b-cea1-42f6-8d51-fede40fe20cd", "value": "T184038D7BD46E5E55C0490278A9208E781B13F518D36B1EFB4DCA82619017DFCFA283FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770352414, "uuid": "5a7647e5-0f99-4d16-87d9-6b55c6f1a18a", "value": "768:WaKgxeDYyYItggrHVrwkAcACxXAoIDECnrx:Wa5xK/RtB8cA0viECn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770352414, "uuid": "087f3941-6f7c-4ddb-a7a9-40b545700783", "value": 37708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770352414, "uuid": "76e42ffd-6a68-4136-ba80-8a299171f8a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770352414, "uuid": "a0cffe98-fd99-4f1e-94a1-435134c65192", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34948e1f-0372-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770392446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770392446, "uuid": "f9c8e1fb-79a5-471f-b842-675d58b13b74", "comment": "Malware payload (RemcosRAT)", "value": "bc85f7400786e0bf9d0eabed73fcdb14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770392446, "uuid": "eda51ba4-599c-4233-832e-ed7d3b350fc2", "comment": "Malware payload (RemcosRAT)", "value": "b4b272fca3ed76c4a6c31dd84e3d2805cf7b26f9e65234d8c22020b8e58779ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770392446, "uuid": "fdf5ae08-9238-413b-88a6-64d2ce313ff4", "comment": "Malware payload (RemcosRAT)", "value": "645b4e6eb9ccc6561ff8362a27362851620b1b0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770392446, "uuid": "789ef54d-fe3b-45ed-91fc-03df2a548f5d", "comment": "Malware payload (RemcosRAT)", "value": "54a51b774df334149399c94f70b0210e3b6c2fe1f1ee2c017d270b3cfe5946dc5fc38206c041aaf415e52b26ab4cafb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770392446, "uuid": "76dd90fd-cd7f-4264-9e7b-0ca610b5750d", "value": "T1CC66061973E3C15BD45236B0C94686EF09A5EF24AFF1D487368A3F4D7B70A826E1D206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770392446, "uuid": "740a866a-29cb-4084-8834-3120d9bcc7a1", "value": "54b94c55ca0500a1a89fd7d736b44969", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770392446, "uuid": "05937c19-476c-465e-8881-6dfac408bc45", "value": "196608:C3gT3roNzBeyhlBBBr2Eyw3zgrWkMsZkSKl5f8PuW6ThndFiMz:C3gTboNz4yLBBBr2EFkrtMsZkSKlt8PI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770392446, "uuid": "6104f8ca-a59e-44a2-8f21-87c6469bad20", "value": 7044608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770392446, "uuid": "3e9883c2-22ca-48aa-bab9-d7a356e54130", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770392446, "uuid": "cd213588-cf46-4d12-9b8d-bbc20cccd9ef", "value": "VoiceMail.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ce3c16-0364-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770386590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386590, "uuid": "d4a13b58-af40-4c30-b226-4dc15be7615e", "comment": "Malware payload", "value": "423e603da79500e36031c9aad3853c7f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386590, "uuid": "249e35cb-6295-4ae3-8c41-174f0b3624ba", "comment": "Malware payload", "value": "b567a038f132363d4ec441c8373881c55859c4aab2fae97d460d5cb40b4ab7fa", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386590, "uuid": "72781021-b85c-47c4-ba82-c2bf173aeed4", "comment": "Malware payload", "value": "4a46f863d493ac800a43862b5b93783773be2ee5", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386590, "uuid": "e250c6d6-5c3a-4dc9-8acf-cdccc2262b4a", "comment": "Malware payload", "value": "99b4cadcbc30b8dadf484042340e21b7283eca35ef726f4f546172867845b25844a28c061a8074ff749afa027e8842e8", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386590, "uuid": "d990b23f-3c98-42f2-9f5f-b455ef035967", "value": "T1C3F4234CE095F668B9E5A2364160798273CC54FB052207BAB75346EF49F8DE8C3EBD09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386590, "uuid": "e9a82bf7-9071-4e05-99dd-e91c9153e72c", "value": "3072:uwD31D3DxUSbIN2GczXb7KYeVj5tt4ehBhE/5ZjXEYWiwGpbEwPmJRSQj7fOa887:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386590, "uuid": "cb4d42b9-9d60-4a22-8e82-1dcf42eb6d63", "value": 792724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386590, "uuid": "d855dce9-0d4f-4a77-8a22-a15a92baec25", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386590, "uuid": "6db5de02-3aae-41ea-bf2e-3ef68bfea0c0", "value": "dekont.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c18e38-0335-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770366309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366309, "uuid": "cbee35c5-d91c-41be-a8d8-1f0d108f7122", "comment": "Malware payload (Mirai)", "value": "8d9894980103b95b7f69d0a9bc2039f7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366309, "uuid": "bd9f49e9-4fae-4a8b-9a7b-97e31acfef42", "comment": "Malware payload (Mirai)", "value": "b6123b0f20cf949dd9213f5614f1d5cf8e7e20ee8453fd4d552fd3173e5f7d21", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366309, "uuid": "b1af7105-c658-4508-be6e-db36e2273103", "comment": "Malware payload (Mirai)", "value": "e8f1d8f32391ac9cf5968f533cebd822195cf276", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366309, "uuid": "6e6e7594-c6f3-4ab5-aee2-8174d6536c64", "comment": "Malware payload (Mirai)", "value": "48d7fd1ff95f8db7c8baf887751e899cb6271f0c32c04930a8a449c03a984ce1f40fdecad4d40829984972c104e9aa47", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366309, "uuid": "01ca0aed-e639-4e48-9e2b-596bf9ce2220", "value": "T1B1512BC541144DFCBC636AB3E67E439C35869452A9EDABD5DBC4BAE0025EE303780793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366309, "uuid": "d76fd73e-a834-4560-ba49-1a673a49f999", "value": "48:vY797N7hYO6GYgmzPY+KWY8oUY787o7UYff3bYN9RYwcgYZpVYmSOYC+CYvfTYn+:vY797N7hYO6GYgmzPY+KWY8oUY787o7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770366309, "uuid": "4aee77c1-1773-4e28-a11e-604a77fddcee", "value": 2940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770366309, "uuid": "d26486d4-5931-4a80-9b35-76640e33d4e2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366309, "uuid": "edba9515-effe-475a-9556-5b2b3ee43904", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a99aa89-0364-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770386363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386363, "uuid": "29d73310-ce45-4d65-8645-e53c7427e6bd", "comment": "Malware payload (Mirai)", "value": "152ee98c714b6565a9fa06c3ca1fb859", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386363, "uuid": "7abe4d12-dca7-4a53-a02a-7c7ceafe2755", "comment": "Malware payload (Mirai)", "value": "b83fffea0b006e6fa2da6996d3def8c456748ac3d0e7c3b66b50dd4487517fe8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386363, "uuid": "2c1da551-3af7-4bab-921e-22074ead63ac", "comment": "Malware payload (Mirai)", "value": "5967043c80e0471e5f4c00d4c0f921fe7c4007da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386363, "uuid": "2828affc-4e72-4731-9bfa-8cef027418ea", "comment": "Malware payload (Mirai)", "value": "49d843b605a64e61619f0c3127c65068c253ba5e307a8baa99671e2297070a446b158a4f47171571e400a2c2df652f82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386363, "uuid": "db5e118c-9608-4457-ae02-cdacd1fd3db0", "value": "T12753029150E5F469C62293F223048F02378ACA92BF06DDDC34CA1657698FB5F4F999E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386363, "uuid": "0e529745-d646-4945-b22d-9ea9ab854b10", "value": "1536:LznwRRM10ac1B010ZtaS4SV/zQUjsPwttl6ozELkg4azH8:XrREB5taUVLQlwtt0zLGazH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386363, "uuid": "1e03b514-a0fa-4b27-973f-57ab9ad7374f", "value": 60788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386363, "uuid": "857afef3-73dd-442b-ba36-7f18943f7d78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386363, "uuid": "72cae652-5970-4ab0-8217-88df8862b548", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6357bb3f-0335-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770366326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366326, "uuid": "d60e1186-b665-455b-a466-f27dc66a9090", "comment": "Malware payload (Mirai)", "value": "802b8683effb8c0c1e8a842b3cc448fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366326, "uuid": "8e286e13-77b9-43e4-9eac-4e92d2dad670", "comment": "Malware payload (Mirai)", "value": "b8f70ac32832a9942054b28b5c4a96a072043a130a6cdfdc1a0a02fa3ca989cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366326, "uuid": "c4c5525b-9cf9-4f7f-b790-97ad777f916c", "comment": "Malware payload (Mirai)", "value": "1c62a207c3a2a1bd9dd58ac2c0a4d28d056b45ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366326, "uuid": "7b8d84ca-f6a0-492f-a7f5-4dd43a621b4b", "comment": "Malware payload (Mirai)", "value": "f41251dd3a3d786a2f8bbce64edb758fa100ee0a2017119fdb39f24ab712b04b8fd26de6e556f8faf361589d03c42b76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366326, "uuid": "61c976e9-ab4a-4905-81e5-9f8f91f8c820", "value": "T18AC44A55F8809F61CAC52976F79D829C33134B79C3EB720699145B383BDB8AB0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366326, "uuid": "c06f8185-1cb3-4aac-bd3a-e4d46327e2ab", "value": "12288:V3VNANg8ZrAeS0XyqrCjR0KGBL1gpEor6Po:fQrA/d2Mm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770366326, "uuid": "e81e04c0-ff8b-40fb-baca-9f9f8cb957db", "value": 587496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770366326, "uuid": "c76d27bb-acb7-4f97-912d-847e2e17c68b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366326, "uuid": "ed6008aa-97ec-4f7a-b518-495ec0a01e68", "value": "data.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e101e42d-038e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770404762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770404762, "uuid": "597e70ae-1a73-48aa-9fc3-804ebe3c56cd", "comment": "Malware payload", "value": "02b96fb20bccda3c01a438c4b0e4b905", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770404762, "uuid": "bcb8f2b9-5633-4f51-b7c8-f199a5e8cfae", "comment": "Malware payload", "value": "bb237983b1a15d4508e85908448f72bf1951ac136994df5f378d48f5ae74650c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770404762, "uuid": "86f16b5e-e9f6-45b0-8263-174bd304d73a", "comment": "Malware payload", "value": "67da606e7b765f81a80e3eca87080a07cca060e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770404762, "uuid": "7fcbc872-33ea-4513-852b-78ebfb4373e4", "comment": "Malware payload", "value": "cc92083ef0f26117a67cdb09e6b106c8cccf9ca71d8d7bd4b7704d03897589ff59f19bbeb62ae1df8199c80dce5aa168", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770404762, "uuid": "a53483d5-7e8c-4311-8455-9c0613dd4592", "value": "T198A40807B2918E71D3545733C0EA580053EA959667ABEB0F3A9A13D93C437FEDE06A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770404762, "uuid": "0e194cd1-1fd3-4f68-8324-058e00abb88e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770404762, "uuid": "3d2e9786-ab7f-4456-a03c-0b4be29a1b74", "value": "6144:IS9gfSqIwsy15GoTRKvD5TqDY/16MpYKt7PZ1+XqT0uYw7PucwSPiafo2:IS9gftsk5Rjk1t7h11YuYwTMSawT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770404762, "uuid": "8cc7e5ff-f05f-414c-b38d-c42f4e1d85cb", "value": 490320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770404762, "uuid": "44787f9f-ec62-453b-b5bd-38f8bd4735b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770404762, "uuid": "a2a87145-9c65-4d20-ad65-5136994141e9", "value": "fst4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae75d625-0349-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770375041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375041, "uuid": "69f59724-7047-4149-8d72-69f0581d05a2", "comment": "Malware payload (Mirai)", "value": "8a4c1c08933f29652265e206e8dfabf6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375041, "uuid": "0267f92e-7199-4845-b17a-a267425ddd78", "comment": "Malware payload (Mirai)", "value": "bbaf73d6a7b48fbfc2dffc4d121ccf71ef23b5b01368df4640ab6797270e6e5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375041, "uuid": "4ab75b00-f9f9-4c11-9a6d-0099a315c3e9", "comment": "Malware payload (Mirai)", "value": "1d6c9deb1cef68bb460a23769da9a3f3daf35b86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375041, "uuid": "64090061-718b-425b-9414-c84a60165843", "comment": "Malware payload (Mirai)", "value": "9f785680dd63b836fca0030c2ebf462609625efeb3782d433a48ec200da2978a0b16818c6bb9d41aef90d0f30294b894", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375041, "uuid": "5081466b-257c-46e8-ac41-ca6d9e2d1fc7", "value": "T1DA82D022D2A75590C6B04C36D7B8D946731B0FF8C367713548840E75A18BBC4AA7D7E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375041, "uuid": "6955de85-34e7-4d5b-8f5b-e038e7cf7f40", "value": "384:hhmj4YPjf55TwVEZGKz1MSpPr5WjR6lgA6hhymdGUop5h8y1:hhmHrWHfS5s+2s3Uoz+y1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770375041, "uuid": "866b212d-050d-43d3-ac4b-8bd4f11b6353", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770375041, "uuid": "76e1ac52-6a78-4004-8e6b-cdefab1e6d8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375041, "uuid": "187c042b-fc4e-4c50-9397-cc850c5d47a2", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e9fa0d-03a2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770413009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770413009, "uuid": "017a3bd2-806f-4760-ba76-c5dda7fb5d4b", "comment": "Malware payload", "value": "712553d10b335d12e661630e9c7041b0", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770413009, "uuid": "3c46e253-7f6a-41b6-8ebf-e4e439224e08", "comment": "Malware payload", "value": "bbd0b20f9a997947a82d7bc70a0b21e08b3e00e7da121aef814dff0efab1b23c", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770413009, "uuid": "6aeb45c9-a7d2-4b82-bdc8-1b205e7ab7e9", "comment": "Malware payload", "value": "069832104eb57e8f15d316796a274ee93d12ec6a", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770413009, "uuid": "988e51e6-ff2b-46dd-8c6e-c915acb796e5", "comment": "Malware payload", "value": "b0521013804308dad74ee40db3575392209b4da365fa82f9befcffa0bbabfabe95a0911dc2c10b447d34a6a80b8161dc", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770413009, "uuid": "6e777845-ad91-497c-b86c-3caecc197339", "value": "T1B8573354B09A07BFE122F24095EBD888EBFB7789F6196753440C4B158B01FDAE8193BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770413009, "uuid": "3026408a-a5e8-4a94-af9c-804504b01525", "value": "393216:6MYPI5INm67nD5HngwkZOUUuQLdg7mpxrIO9NJGvTC+c6oHcHbAJeqnrHsfdw2Ws:6vI52v9HnDkANp6Lvx6CAznrMfS2Ws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770413009, "uuid": "62c2ed31-de05-44a8-9026-72a700038764", "value": 27445677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770413009, "uuid": "9c02d9aa-64f8-47a9-a434-d703e2f1d8b1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770413009, "uuid": "2f17fd99-fa4f-452e-ab37-ff3cce899dde", "value": "\u8349\u8393\u64ad\u653e\u5668.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0a4e4b-0364-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770386365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386365, "uuid": "747339e5-704b-48e1-98c9-bf0d417ce08f", "comment": "Malware payload (Mirai)", "value": "8ebff38de804d496539479ad21b347d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386365, "uuid": "e790ab3b-f76a-4633-b856-94defe2810eb", "comment": "Malware payload (Mirai)", "value": "bbf16ef56ce5a7c0a18fe2417630207252ad958851022dcfb83d5d0fbcf80e01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386365, "uuid": "a5e7122d-633b-4e25-b196-736fb7e813c8", "comment": "Malware payload (Mirai)", "value": "813c8abca163b4589c7293804b1dcc251b67262a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386365, "uuid": "0d07d1da-dad4-4bbe-903f-273226d878b1", "comment": "Malware payload (Mirai)", "value": "5ed1de0e437429055d90414570897192d839500a2a19837118a66ae2e701ecdf11405ec8028ad9c398714970e1994a56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386365, "uuid": "d11b305b-2103-4f94-82b7-350c9bc2b533", "value": "T101148120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386365, "uuid": "4a26f81f-b2cc-467c-9cda-4c7ce492424d", "value": "3072:BcHZcggFy1tJmajThwnKBDMOzsjJjL1lCR0UKG:BcYFAJ9/hjzsdjynf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386365, "uuid": "5558ba70-4100-4979-b2d3-9196f4644298", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386365, "uuid": "d1094c5f-cd53-4193-875d-0fd3f93e07be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386365, "uuid": "bf931dcf-0b2e-4f4d-a2e8-a7a2ad5653a6", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95359a81-031b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770355242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770355242, "uuid": "bdb6662d-48bb-4973-b426-539ab6590778", "comment": "Malware payload (Mirai)", "value": "46ecc61416448c0ce6c93ccd335aff26", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770355242, "uuid": "a1509c40-dc5e-4e05-9a10-de09e677e126", "comment": "Malware payload (Mirai)", "value": "bc0d95c4c8dc9ceaff77b5c9c881ab4b6b97429ba7b9e7b50b4c4aadaa745683", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770355242, "uuid": "aee56e30-22e2-4dd7-8226-b805b740d633", "comment": "Malware payload (Mirai)", "value": "94b2ba4de42d001d185d11c0922a6058cbfcd817", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770355242, "uuid": "1d1585ee-07f3-41bc-a339-0c9157a31300", "comment": "Malware payload (Mirai)", "value": "0f5e83e9b577d7876b7971c836a0a89faa0cfd6139a0a0ebdfde4cfdfe8a7e67757abf23f9592a17d77c788635504c40", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770355242, "uuid": "84b581b9-449c-4056-9341-f71d9ddbfe4e", "value": "T126159DD9EBC6E4E1F26300F1025EDBF74674A1265013FAF6EF45266370327A16F1A21A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770355242, "uuid": "08bdf0a6-8dc6-4376-bc01-95daf5537833", "value": "12288:n9IFgDJAP7hDQh0dUx0K0I64Q1HzTpr9lxavmvrA4GPyI/IiMnYLPIsQLuH:9IFgFAzhDQhA80F4Wv9zxaus4+bMn+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770355242, "uuid": "09f525da-dfb7-4f51-afa4-90df30f96286", "value": 899096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770355242, "uuid": "c11563a7-4ccf-4754-be0a-e65d335ff15b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770355242, "uuid": "8b1840ee-9afb-489b-a848-0dbe87500922", "value": "data.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "695cd294-0335-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770366336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366336, "uuid": "e1adce95-e2c7-4820-a1b6-607bcd695d3e", "comment": "Malware payload (Mirai)", "value": "a000b5312d2e9e5222de183e58adb427", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366336, "uuid": "99122cdf-9019-4e7a-a23f-14a3f0e5d303", "comment": "Malware payload (Mirai)", "value": "bc3323cddbbcb8367c894f637dcd7251aa2208391f5ed44998eba0c2e62fb548", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366336, "uuid": "353a629f-2665-4151-b954-cfb50b55c536", "comment": "Malware payload (Mirai)", "value": "381fc11c67d6635ed102c20ad5bec9dd548ef27f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366336, "uuid": "81fe59d2-cf10-4c4b-9203-c301afff1c28", "comment": "Malware payload (Mirai)", "value": "d2af4e53654adc5175b8cebeb31066536a57effb01c54532f092c442255bc18ecacf03ad7db78915ea5f7e1c678271cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366336, "uuid": "5fac7df0-7ee0-4888-a539-3169ee2ebea8", "value": "T177F47D02FB0C4573D9631EF01E7F03E6C365595304F9E51A260EA7A61636E3E9AD338A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366336, "uuid": "99a707c1-8f94-47a3-bf43-96a304d9685f", "value": "12288:3hUOk3jospmjxp9WZTK0R1uUxg8NebSTaF4SJKj8ipUzIfKvnYhI1:xUPEUKyuOpR/jyWKvnYhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770366336, "uuid": "eaf59e4b-0458-4735-8dd5-b573f3cc829f", "value": 792576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770366336, "uuid": "34bc9e25-61b9-40f4-99a2-5774f8528ad7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366336, "uuid": "49bfe8a7-8a10-43a4-b41e-9a7a7ebca224", "value": "data.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69b1e376-031b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770355169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770355169, "uuid": "6a59161c-1b53-4501-bdf9-29248433b984", "comment": "Malware payload", "value": "f1b466aca602edee623b3d61f3f219ca", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770355169, "uuid": "5826775a-a853-45ba-8419-fcfab8db41a4", "comment": "Malware payload", "value": "bd4a889eb2c7307e7cab91fca793cf705534517591a80b125ec10612382b389f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770355169, "uuid": "dc7a1767-2f7f-43f6-9a75-5a1b59aa3951", "comment": "Malware payload", "value": "a54396efb446ee9ac89572e6d1230c904a930eed", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770355169, "uuid": "aa054f31-0f8a-4713-bae5-ad2aac5e9b59", "comment": "Malware payload", "value": "f0faeaa2f463d8d26778e899371256b4186c58b402ff50a11e6357f3ec4a59ddb7fedb0115037d52684adba0c87582ec", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770355169, "uuid": "8d712b18-4306-42cd-a484-83b3e663bb73", "value": "T1E66639D1FECB14F6E4031F3154ABA2AF63305D054F28DB97EA447F69E93B6A52832109", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770355169, "uuid": "30dacbf7-a35a-4b69-8a94-b1d09818df96", "value": "98304:x1+fKVjzzXdx6hD8cNGAzwzK2Ic/eVQ/WEa:xhlzR+YdK2neVQ/Ta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770355169, "uuid": "e197b3ae-17a0-4852-aaa7-8da07ff0e0da", "value": 6992020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770355169, "uuid": "394031fc-eb00-41ef-a5fd-b663b39165d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770355169, "uuid": "5bca0e46-bc68-4a87-91c5-112f37ef0b17", "value": "linux_i386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76491092-0346-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770373659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373659, "uuid": "9dd07fca-509f-44f2-b13d-5326a3763a80", "comment": "Malware payload", "value": "741b68476f43cf8b0ff3512deb03897d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373659, "uuid": "ddc56a2a-7a5a-4370-9849-a6233c9b7f3a", "comment": "Malware payload", "value": "bd5d84169863d9c1270693b7215aa0f2c68a85f3151900e0139b722d55b3bcb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373659, "uuid": "aae47f02-4493-4f0d-a2ff-555887409023", "comment": "Malware payload", "value": "99fe4b85efed6951cead66735b80a71465e3d331", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373659, "uuid": "ea14995d-41ad-418d-8193-f464eda63da2", "comment": "Malware payload", "value": "f7def8e22f45e6572b32cfa99d19e9e2ed1a475550da3f2637dac99c6f9fabd6ec1012058d8e9b70e03e48ce0fc00031", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770373659, "uuid": "f85a3c7d-38a0-480b-8580-bbf40cad631c", "value": "T1FD14F1837B500F65C266DA7108F78782BBF622D62FD69186A76CCD00EF15B58C41BED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770373659, "uuid": "5150a70f-d690-4b1e-b670-e5c3c90c5454", "value": "3072:kgfKVeEOH4lcgjTKgO2ASB/U67G08G1ulKqrluQHzpDk3gLWpVPcYlD:kbNR1Whu867183llBPFk3UkP/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770373659, "uuid": "515df34e-bb63-467a-9a77-16cc0d2bfcdb", "value": 208476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770373659, "uuid": "1961476c-c774-49c7-aedf-1cd0a9a397ed", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770373659, "uuid": "3364c0f3-5889-4e2b-aeef-ccf4ed7b42b8", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d22c2287-0349-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770375101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375101, "uuid": "1c7b1e00-29ad-4a8c-ab60-991b3764c292", "comment": "Malware payload (Mirai)", "value": "7a6f3d2926b35593f341c32ce0222ba7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375101, "uuid": "b118f383-ffff-477f-8ca2-e02f5273f250", "comment": "Malware payload (Mirai)", "value": "bfa32f464f4161f5d05d821776a7e1e17303a798f9e2de377966cc1bf9304624", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375101, "uuid": "5f1c1d0f-242c-430e-9507-232148845dd4", "comment": "Malware payload (Mirai)", "value": "5510b635f43575f1724b7be8bf9f2dcd0dc461e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375101, "uuid": "99054b74-7689-429b-8b41-cc2da4c93c72", "comment": "Malware payload (Mirai)", "value": "cb224966131e8ecb31a18d52de785f1600cf1be80454bd4bc65eabaf28a9cd974dcdc6820d29bd2443d9506988fbaa72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375101, "uuid": "242ab893-8aac-48bb-bd25-003d8daf38a7", "value": "T1892309C8F443D9F9DC5A09742036FB2BDBB2F6BA2329DE43D7A495236C51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375101, "uuid": "9dac85b8-7a6e-490c-a6cf-c2e0832ab45b", "value": "1536:6nJRT4QPfZfW5XTOeY3Dve3AGhrZS4QwLbn2ice:Gv4QPfZfW5XTOeoEzlZbQwv2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770375101, "uuid": "91ea9d6d-b503-4a6f-ab60-097171697bf8", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770375101, "uuid": "a2d9705d-f977-4b30-9db1-88f604682976", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375101, "uuid": "80e77509-8f35-4726-85c9-c0412907e2d4", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d54953-0364-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770386375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386375, "uuid": "6b7d41d1-180e-411c-9414-d78392ed3cef", "comment": "Malware payload (Gafgyt)", "value": "1b3d2c42f35b860df5cae4bfd1833e8e", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386375, "uuid": "00c50355-7023-4611-86ad-816f557480d7", "comment": "Malware payload (Gafgyt)", "value": "c108d3c038cdfa4d4ca6867af2314531bf5cef19a9dd81a582784aa9f82cfc8d", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386375, "uuid": "d280006d-1fbd-431d-b3a8-f37468089de0", "comment": "Malware payload (Gafgyt)", "value": "683a45fcd01ace2236ff7e441d0645486295c64c", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386375, "uuid": "956561b4-5dce-454b-9bd0-c69215432388", "comment": "Malware payload (Gafgyt)", "value": "ed0fe7f47604a3b8b31cb2f6d584df618e30454203e12e5c6797e4955bec4c4ab855263734c87ff48dfaf303f284a62c", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386375, "uuid": "315d43df-cd55-4f90-9db7-6c31e627bcf1", "value": "T1183184EA21A10E716C96A92B72AF495479D4E5EB10CE6F886CEC3CF9548CE0470107A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386375, "uuid": "eb711d07-5bcd-4899-82f6-0388cf2f4877", "value": "24:v02e+02V02Uc4k02Jas02902Es02Jb02ss02l02eO02qaF02SK02W:vrfP4kjb/T7bvMOLXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386375, "uuid": "60b139f7-421f-44b4-a26b-b845df018868", "value": 1587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386375, "uuid": "cc5f25d1-d981-4c06-93da-ccea4b47be47", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386375, "uuid": "bd2f4482-6bf8-46f0-8ffd-c449180f6657", "value": "sex.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745f6686-0346-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770373656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373656, "uuid": "0cde1c0d-40b6-44cf-975a-a13b5cd76d7d", "comment": "Malware payload (Mirai)", "value": "e6ad2cbe9ef73f80d1110c6097431328", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373656, "uuid": "4a983a6b-b328-43cd-872d-4872f153a170", "comment": "Malware payload (Mirai)", "value": "c1c6a8df21a8cc4ceb95e5745e81bca234d3d8d4e1909c82bdf2dbb85edc22c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373656, "uuid": "d5029ee4-2b71-41f4-996d-f179f83bc02a", "comment": "Malware payload (Mirai)", "value": "486fc358412eec595d0f9b821c818b77da8a8216", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373656, "uuid": "03ae3097-6e44-4d0a-8fdb-34f4a8a1962d", "comment": "Malware payload (Mirai)", "value": "e7a711c40dd569a0c71a68954730fe7b05eb1dab02cd79365a0a17c3b2b806da6267e930b5e2fa36a6d5adde66b293fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770373656, "uuid": "f0ad9308-b172-42aa-89c5-ecdae30aef83", "value": "T13EF3F1A5F4808E72C7D1B6BEF65E164833570B3CE6E472168D249B31339766B0F2AC52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770373656, "uuid": "9ee23155-a476-4050-8c75-4f48beea90a6", "value": "3072:7D0ownSrawIcSb2o0CJImPA/KFH7cn+biSEIAfgIhEPJxK1VoGLUtZ9/FPU:7xwSuwIcSB0CJDoMH7cDqsSP2V3Lwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770373656, "uuid": "94bbcf42-69a6-469f-892c-2d7ab25e804a", "value": 164783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770373656, "uuid": "a8ccd03f-90d0-422e-bee7-91b3a1bbb346", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770373656, "uuid": "25a6d473-999b-4a95-965f-0f4f50956523", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452bf6a4-0378-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770395051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770395051, "uuid": "8d457166-db0c-499d-8e70-07301a78a29e", "comment": "Malware payload (AsyncRAT)", "value": "5a4788facf07bd54d887aac38153d47b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770395051, "uuid": "de8bc675-e588-4b43-b01f-36c00e1ae217", "comment": "Malware payload (AsyncRAT)", "value": "c255a1d3111319e4ea419e190eff81c7b6556f1744c5fc203a39c78a83a018ff", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770395051, "uuid": "53bb2876-34b9-4d03-b50a-abe4c1fb4d3a", "comment": "Malware payload (AsyncRAT)", "value": "bc9f39984ae3a68c285c839337a99af547c57273", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770395051, "uuid": "5d15496f-76f2-4e66-b10d-bc1844eac411", "comment": "Malware payload (AsyncRAT)", "value": "c9fc75856df7015d355bed92c27e869644a8ef0530fd363dfe83703f61af6295d4f8f1ccb0539f62fbf541183a5eed9a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770395051, "uuid": "d5cafd94-bfc9-4786-b922-f65c1dab2694", "value": "T14BD25B0077E8816AE1FD0BBA99F196408236F5871807DBAE6CC5518F1B23BC4D621FF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770395051, "uuid": "c7ccd1b5-4a66-4e66-9e54-7cc2515feebe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770395051, "uuid": "c36dd247-4ebb-4f00-815f-3b1be8d00d41", "value": "768:53yoVAwW2xBp7CMnN9TjIbuBO281hg7JNGVY7:wxcxBIMnNJIb6Ov1W7JEW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770395051, "uuid": "7e947b80-28aa-4b5e-992c-e9902fb694c2", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770395051, "uuid": "6b822d79-8289-4a79-b59f-92dfde4409b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770395051, "uuid": "ec72a564-7522-4c81-a278-f85963b1ed34", "value": "iesetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b787d96e-0349-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770375057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375057, "uuid": "bb7ff906-c89b-49e9-a416-38762af41bf7", "comment": "Malware payload (Mirai)", "value": "b2ff608c35d180493f6fb094aad79ada", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375057, "uuid": "fab0c666-1a21-44d3-8449-39d6eac7179a", "comment": "Malware payload (Mirai)", "value": "c277f03630ff0b108512295ec561254083ccf7cd39251bc02448c5952aa997d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375057, "uuid": "5f132ff9-9004-40c9-99da-42e36ea36577", "comment": "Malware payload (Mirai)", "value": "686c1e3e8cbfe43913c885c25f054b72be691938", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375057, "uuid": "91afc6b5-515e-4a97-a8a1-7a88cfd023f1", "comment": "Malware payload (Mirai)", "value": "fe7af9dc067da1fa38b4b9d32ebc7946eff53a28a4aca27b895fc7c3900f34cdc03d37630fee7e0ad1f91eb965401608", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375057, "uuid": "a30b5b0c-8539-4916-97c1-b85352f92d2d", "value": "T196B2DFEEA4142009CD8DAC7E071EAA624E6992C172DE5FBAD3508DE43BFD90F704D0B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375057, "uuid": "63016980-ff51-4522-8c42-e1e7370ba4b3", "value": "768:chrQlS07dEv0UXqUhvQE+CXQjn90dOpZqaWvu:KQlS07FUXqIYSXQrfqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770375057, "uuid": "cfc21fa6-e5fe-4653-af64-6a77e7c830bd", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770375057, "uuid": "111deb21-9d6d-41f8-a5ff-6646acd10fbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375057, "uuid": "b30f0124-bec9-459e-8fc6-c45e3dc54358", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0388b0ab-0315-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770352421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352421, "uuid": "adc953fc-622e-46d3-88a2-9d707fca5cac", "comment": "Malware payload (Mirai)", "value": "739e589f80a2d32d5cdef5ed48fe4c61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352421, "uuid": "cc1334cb-c28e-481d-8a1f-48ad890637b8", "comment": "Malware payload (Mirai)", "value": "c2a4ef2eb8c5ca609540bd3dede8cdacb0505ee466f439733deba18a73eccdbf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352421, "uuid": "900dcc7f-0edc-4ebf-b140-4ffd3c5135aa", "comment": "Malware payload (Mirai)", "value": "ba62d2baea29802fb932366fee9b3788faeef8f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352421, "uuid": "e62d0e99-86f2-4ec5-9437-9232b273201a", "comment": "Malware payload (Mirai)", "value": "0ad7294be2cc10821cd05b9362104ea8d3922ed25be981ba9c8399366897fed61a2f2f3d741648c25206ea55002a117a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770352421, "uuid": "ab8907ff-ad08-4ada-9e6b-48dc6467ee6d", "value": "T11EF2D681AC81962BC2E4237AA6AE018E337177ECC2CFB62BCC115F14768596F0D67B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770352421, "uuid": "39fefafc-f326-4a9d-8456-547249405b6d", "value": "768:jmQGvVxptgG58LFSPQzfqa4eHHWCLJk1J92z9Df5Bqn3Sq/Nkv:irxpCG587fqnGV88L3q3Sq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770352421, "uuid": "1d3c8d11-c1d6-473b-a278-d2f3f912225f", "value": 34836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770352421, "uuid": "8c7912b6-af1c-43f2-b51b-3be80aa69fa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770352421, "uuid": "12cdb324-1b35-4db1-a297-8cb176353ea2", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7550e8b2-0346-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770373657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373657, "uuid": "6168c9bb-5708-4677-9663-5bd86ca46b1c", "comment": "Malware payload (Gafgyt)", "value": "6a273d57365152e11c71aa0ec0834b76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373657, "uuid": "eb183806-0aad-454e-bc87-1abb18f758c8", "comment": "Malware payload (Gafgyt)", "value": "c45d69d073301cfd2c2e13a046b88c6dcf1e535df2b955cca91961363da1d619", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373657, "uuid": "8691172e-666c-4397-bf42-c6acb0c869e5", "comment": "Malware payload (Gafgyt)", "value": "372adccfb7ea4510f31020e204b9e267d023eed2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770373657, "uuid": "6db4d5a9-1c1b-4355-a085-f21c8a99431a", "comment": "Malware payload (Gafgyt)", "value": "2d29902df12d6ef77dc5cc6fde3b0fd9962d3b27677a1ebef70c5c741090322102307aa0e44fc5f16d2b7cbc5ebe2449", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770373657, "uuid": "0880b571-110a-4b67-a806-a572d026c7aa", "value": "T180E31206FA8794F6E0830A7259D39A1B5730FB710584EE97D306BB24B9F3B25510F59C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770373657, "uuid": "b301a280-d49e-401c-a3ad-b24212b4a556", "value": "3072:rOlNTZa+Ef6jQeuwBXDfOAl59mdqDS0vRHH6yQAQNLJnc54jLDbFgoOlB5:aPGfcQalGAl+AvRnsAQ7m4PDRgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770373657, "uuid": "261d205e-28b5-42e3-b6a4-b074bce0f20e", "value": 149209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770373657, "uuid": "0f9f28f4-f5df-48bc-89bf-9ae61073890e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770373657, "uuid": "efa43824-69fd-42e7-abe5-3a4435278d2e", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1cac799-037d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770397381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770397381, "uuid": "ce68b449-e979-4cc9-b919-d35563ddd8c2", "comment": "Malware payload (Mirai)", "value": "e74c391dd83ecbc008504ddb25af5664", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770397381, "uuid": "262793b2-210a-45cc-ac6e-6a8caaa9d573", "comment": "Malware payload (Mirai)", "value": "c7a29e82fc10f3b8b6984e3251d7a2d8b45487a3a19078741da7a6b5a551eae0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770397381, "uuid": "726119cc-d08a-4dea-bf64-a96aeedb34b0", "comment": "Malware payload (Mirai)", "value": "2836e4c11a7718f218735e40e8c7b77d2965e8b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770397381, "uuid": "3e8482ab-d07c-4952-95a5-793855565c57", "comment": "Malware payload (Mirai)", "value": "1bcf91fbf515a039c224221ba0c0a62261bcd562bee335ac72792905300a1f3b260c94af2bddffb732e8c4533e220066", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770397381, "uuid": "0ec41efd-779c-4bd9-b371-2992366ab48f", "value": "T103D31B65F8414B12D5C111BAFE1E224E37131BBCE2DE72029D246F647B8A9BF0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770397381, "uuid": "900660e9-2d03-40f1-a3a1-8869bb4e5bbf", "value": "3072:6qexN6NdUHZD+iX9EZfdza8VHBZDM5iOuLrM:TexNOd40iXiZfZaoA5iOuLrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770397381, "uuid": "155f428a-c956-40cc-8413-fd49884c6c76", "value": 141180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770397381, "uuid": "7cf478fb-515d-4c0c-8123-5ca541beecb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770397381, "uuid": "d69a671c-8877-4f14-b546-2c4d997f7084", "value": "odin.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2767c68-0358-11f1-a129-42010a9c0007", "comment": "Malware payload (MillenuimRAT)", "timestamp": 1770381491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770381491, "uuid": "65d57bd0-07ee-4554-a958-75cd7906ef71", "comment": "Malware payload (MillenuimRAT)", "value": "aba64e6e010da3363a4380659ec2a4da", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MillenuimRAT", "colour": "#1F3A5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770381491, "uuid": "038b8c3c-5c69-4757-b170-ccf64906aa3d", "comment": "Malware payload (MillenuimRAT)", "value": "c7be3f05516120faaac3af4a589b620d8bdec5a5e4437e08a8da5cad2388f7ed", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MillenuimRAT", "colour": "#1F3A5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770381491, "uuid": "5ac1610c-769a-4729-a739-1fc04f781aa4", "comment": "Malware payload (MillenuimRAT)", "value": "78f4c5451938e242a479cb037dc1793bc894780b", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MillenuimRAT", "colour": "#1F3A5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770381491, "uuid": "7ff7545c-7fe8-4ad5-a605-4a3048fc8ccc", "comment": "Malware payload (MillenuimRAT)", "value": "004344f93a33768c696d1a7f14c5fb8cde9db64545b39250a8130a5d5c0e83cf25e201ab7a89f1ef1d019d7448165066", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MillenuimRAT", "colour": "#1F3A5A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770381491, "uuid": "88a1a472-1529-4d4f-84cd-ad9d7f720bfd", "value": "T1AB32327CCAF4FCC0871F72C0B9D6ABC2119E9723AA6B1BACF19804E14650656EF7954C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770381491, "uuid": "4155d282-a057-4222-a99d-26df378ae974", "value": "192:J/tKvFwMgezrW3wUVYpsiJHcFb/ZYtUYLOaaPI9UpMy0awWMLZVHH3hezacQGYLB:JVKNwMg0UStHcFCtZOaP4My0RWMLZVHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770381491, "uuid": "75fc9773-c9f7-4ef6-96e6-9120c65736ee", "value": 11072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770381491, "uuid": "3a27b652-fc41-4e14-8cef-de68687e425f", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770381491, "uuid": "fd83ebfc-15b5-41e2-a6f3-995d5659bd14", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa41594-0361-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770385209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385209, "uuid": "d704a5ec-2d7a-44e8-9ed4-8966c1978846", "comment": "Malware payload (RemcosRAT)", "value": "00ff1c4f3f7212254472bd11fc93190f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385209, "uuid": "a18f2ef3-61d9-406a-8502-2c32386064a8", "comment": "Malware payload (RemcosRAT)", "value": "ca2bc8440294a99723814bd83ea4bc9c635da2059f28fe7172a9970211bfbf82", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385209, "uuid": "12b58ab7-54ff-409c-82b3-5b6b1640ba1d", "comment": "Malware payload (RemcosRAT)", "value": "f83f2fa08298d50fa8f70c8cf95ab994b8b63317", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385209, "uuid": "8c2ac2b8-ef3f-4f6c-9f0a-4721f0a64d78", "comment": "Malware payload (RemcosRAT)", "value": "cc6e027e8967131417fa08927926ca71f9e9da50703c92b3286f789e4574ed753eac079441389f31da06cd471c224a13", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770385209, "uuid": "26dabdd9-ca6b-4972-afbc-9b7fc5f878d6", "value": "T17F6609412B00E835F61A9B9CD631BE382697B00368D9DF4D326C4A653B279276758FF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770385209, "uuid": "ed551260-9d2a-4815-80a1-8846b66e5283", "value": "98304:LfBY6EKmI6rq18rOxbceWlneOJ3FTKW7TFHqvxtSecODxXWBQDqUu3hZWDu:LCV1rgkQcLll3RTFv0DB4QDg3H2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770385209, "uuid": "6237a7a4-8319-4cc2-8b53-045eb82b1a34", "value": 6774930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770385209, "uuid": "ee621d14-d4e6-4a7b-88c3-0149bb47c3b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770385209, "uuid": "3a228f7a-13a9-42fe-836f-74bd4147166c", "value": "\u4e2d\u56fd\u5efa\u8bbe\u94f6\u884c_\u4ed8\u6b3e\u901a\u77e5.pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f736dd4-037f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770398075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398075, "uuid": "3a238e5b-0504-4ea0-bcf1-d134d20a7e4e", "comment": "Malware payload (Mirai)", "value": "c0ea5b4f1c6a8d3e7805ea674f7242c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398075, "uuid": "bfd384ba-a9d8-4e55-a3be-24c19c302907", "comment": "Malware payload (Mirai)", "value": "cd80ff8048e37c5867be108d2ac3302a51d10c3e32a738f573f4f1c3d7571f63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398075, "uuid": "bb31a9f1-f960-4835-8ba0-3c953593c645", "comment": "Malware payload (Mirai)", "value": "34edf8ae014075fdf94f1b68af72fe5dc4a80081", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398075, "uuid": "90a3070d-d3d9-4507-8819-2548ed3b9dad", "comment": "Malware payload (Mirai)", "value": "50266f9ef112479fa4cb567401c045c907a87242ba262dfb97c257831f17f76a2560db3c0032d463ae070bed2c6b15ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770398075, "uuid": "ba928852-5961-42b6-9f16-7c8294327d9b", "value": "T11DD36B73C8366EA8C664C0B8B0718F791B93A51581471FFE6AA7C2754087D8DFA097F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770398075, "uuid": "c60a5bb6-0e5b-4166-97de-dbd4789f8fd9", "value": "1536:qi5z+fxP93H//zIz0Qz2SLM7ChUKgY7KL6Reo2l+WvXcSGN8hZYeQ:qih6xhH84QzDLisbgKReV+W/cSGqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770398075, "uuid": "88c42124-72a1-4b29-9a1b-356330d2e8ee", "value": 138148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770398075, "uuid": "909847d5-be6f-4b54-ab61-babefef19221", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770398075, "uuid": "f0e1bfbc-5bd6-4655-9d13-b941f630bd61", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af2949fe-0386-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1770401242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401242, "uuid": "3106e8f6-3552-4af1-b33c-5516825a7436", "comment": "Malware payload (QuasarRAT)", "value": "7587cd91d20fe42ba7c29e6ba81d157f", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401242, "uuid": "c69970b7-9b35-419a-b612-cef164b1698c", "comment": "Malware payload (QuasarRAT)", "value": "d0f9a59609fdda92a65b63563a1b15e60ae62a783afffabccbe29020a5e6e5a1", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401242, "uuid": "26aa4c82-0120-4ff2-be46-04c05a2e917b", "comment": "Malware payload (QuasarRAT)", "value": "ef8f6efd42379363111cdafe2bdce214bd148d21", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401242, "uuid": "6ab64c54-6089-4374-bf85-1798b89757e4", "comment": "Malware payload (QuasarRAT)", "value": "02a1a8366de8f566487a11131de27806bebae23293bcf9fae5b87c6b9dae72d1f7653101bd1b2d2628b51b4de532a8da", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401242, "uuid": "6e6dc5f4-9d0a-46ee-8788-cbc1cb3bfed7", "value": "T1C4E55B053BF85E23E56FEAB395B1401657F0F81AB3A3FB0B6191A3B81D53B404D416AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401242, "uuid": "365977bc-ae91-48ff-8cc1-d9d169089ace", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401242, "uuid": "54b9acb5-878c-4b36-bcf5-69ae5d577fa3", "value": "98304:pGTkXD2nr8axKPsPplChSMf3n8/PyLRR4Xx:sTt28SeXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770401242, "uuid": "d8a66828-ddde-45b3-af7b-500431a8308b", "value": 3292672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770401242, "uuid": "8311f7e1-98cd-4ab5-a6a3-504b681d1fb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401242, "uuid": "b3e8aea1-bd13-419e-87c7-066176e48ae9", "value": "diskpart.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e9b8a0-032b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770361907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770361907, "uuid": "fa364a76-e35a-42d0-b371-5c68088cce4a", "comment": "Malware payload", "value": "3565d4c82b4545bd6a87e702d37b46d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770361907, "uuid": "376ebffa-cd99-45d8-972e-1e07d7db7127", "comment": "Malware payload", "value": "d109a04c26b2edb8777f618281604819d70fb7703aa5410206da9c3a71002f68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770361907, "uuid": "c6d47bdd-164c-4af4-9b12-7fd5075c5bf2", "comment": "Malware payload", "value": "a4f9284cde315ea7e6f2e9a3ea285179f4c012b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770361907, "uuid": "e4ab5b4e-9422-4400-816c-f34bf40ee68e", "comment": "Malware payload", "value": "9bf107144262155fc91875a83932f31c0b2eb96912768dded8d17f33a161bd292bc4202422d680c6042b16465f68d78d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770361907, "uuid": "7e71e09c-5e2f-4025-9507-07bc4d50e3bb", "value": "T11A7533F0F2E413EE6C98ABA5EFCDC398F0E995251870A07F5D9F055A48772A753240AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770361907, "uuid": "4e7339ab-7a69-402d-b0f3-c34f7fb97f83", "value": "24576:lHOxweZC65l4+td1KSWsLf4eF/OOpquclBb/Wlg48uKORCKfqJypGF3YrXj+9+Qf:4xNdt77WGQmAv4+sfEypG5Ym8Q/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770361907, "uuid": "e1c38873-31c5-402b-9255-98c55b96d588", "value": 1642695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770361907, "uuid": "26334e14-d0f1-4290-ae57-9f1e705f1166", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770361907, "uuid": "0c241807-b565-41f5-a465-ed6ef19be96c", "value": "bizy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a612b0-037f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770397973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770397973, "uuid": "2872adfc-1a93-4eef-9de3-734e67def719", "comment": "Malware payload", "value": "e51c6b85494b3b94e37bceadb1bb6036", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770397973, "uuid": "37b950aa-3ace-4883-9fea-3433f2171059", "comment": "Malware payload", "value": "d16b8d98adf20f23761ff4d3e7ea516b299ea6d9d0b26e8acede7e96df67adc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770397973, "uuid": "f7f7e239-8fff-44d1-9684-a1d75aaef5e6", "comment": "Malware payload", "value": "3da50162bc86e54794047554e7d5e2edcca86e9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770397973, "uuid": "1c564422-f928-4066-9fe8-5cb99c73cba8", "comment": "Malware payload", "value": "25a50ec45306890b80b39104b75ba5a2cf6341e4bb46390259a74fa581b4a06093e3cd804b647ad257aa6ca4bd341af9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770397973, "uuid": "4b71d987-07de-4dfb-b6cf-a209200c4e8f", "value": "T1EC87338C9F5009A3E8DDC87E91B3DA6EA202B8DF17F2C9575BE540920D6B1C9DCB1712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770397973, "uuid": "47d33279-08df-4957-bdff-073fb43d362f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770397973, "uuid": "e4e2bf5d-0902-4a42-b762-2f696c7f7e86", "value": "786432:drYT67R2FW8ZgnJaGziuilsXMb8qMw/f3cGyCDFz1XDwfKLILJax7HwWmDlaZaFe:5m67R0Wugg0izmcV//dpkcAj2aD5Cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770397973, "uuid": "c2e28f06-39ef-4e2a-800b-ce3df013605a", "value": 38144096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770397973, "uuid": "229a0c5b-f78c-4b3b-9750-7abac7fa806d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770397973, "uuid": "4d60035f-feff-417e-af91-64c38a98f7fb", "value": "Fleasion NT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "331a1f8e-0386-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770401034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401034, "uuid": "7e866cd8-d981-4dc1-989e-69ecc324e378", "comment": "Malware payload (Gafgyt)", "value": "db261495ae8ee624a2ec819cd6a572d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401034, "uuid": "e80b6dc6-fee1-4e64-b924-1d958b673c4a", "comment": "Malware payload (Gafgyt)", "value": "d20be7c765a896244b138ba18354cf68834871fc4a9345c1dcd322eda96e7378", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401034, "uuid": "07910cea-1096-4d1d-a28c-8b0c6f31e761", "comment": "Malware payload (Gafgyt)", "value": "89ce21ba7d2c584e5672eecf3a7d7c554f8dff77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401034, "uuid": "4360f23b-6cc3-444d-aa7a-ab7c77675e31", "comment": "Malware payload (Gafgyt)", "value": "62e8ce0cc87f74d56fc25f51aab4e769284a3f7fffdc7b43c8663ef074114ec3dd8adeda4cedb51ca3024f5e578a6f65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401034, "uuid": "f6b4568d-06c2-461e-8ea1-aa00f0d8f1c0", "value": "T1B9D3B76A7E11AFFEE268863007F75F70939525932AA19381F26CDB085F7128D1C5F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401034, "uuid": "46a12da8-e667-4e6c-b4dd-e70bfcb55b29", "value": "3072:fflT32yc4c7nx1qs8RvduSXekkBXCqd2ES2vuYlPrKnJ1G5hW8xxxx84r/tzYiFy:lKzK/G5hW8xxxx84rSiF3xemqY1fuBme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770401034, "uuid": "06cf004c-793b-40a4-bceb-b59ea12cfafd", "value": 137917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770401034, "uuid": "b60404fb-c8ab-4a40-a87b-2d0f3449f764", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401034, "uuid": "e57eb5b1-2720-4c96-b542-4128f0232739", "value": "yakuza.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52020dc3-02f8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770340097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770340097, "uuid": "ba931498-79a7-44d1-af54-9a9a2d4e655e", "comment": "Malware payload (Mirai)", "value": "7d9cf8911fde12c7975b09299cd09a93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770340097, "uuid": "2288ab66-332c-4b18-8e2a-4c44b756b9e6", "comment": "Malware payload (Mirai)", "value": "d216a98d6e6dadf1ab1177f03795689c98b73807aa92d5330507599cc43cbd32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770340097, "uuid": "e3221c8e-a01f-4026-b120-d5854d3a7e60", "comment": "Malware payload (Mirai)", "value": "ed15a9069bf4dd49146f2dbe0945887df2266ff5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770340097, "uuid": "e2c247cf-a9ae-470e-87a0-584e058ccb6d", "comment": "Malware payload (Mirai)", "value": "8f6bdae0193813e943cb41e25eb92690e26ddd733c77c0597efd5bc059d9fff1886ce32a0dad2ee1d1136158b33e57e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770340097, "uuid": "40b68ee3-6aaa-4345-9f15-e29f46df4387", "value": "T11BF219C0A943ECF4EC1A06B01177F7769776F4352128EA93D7A9D973BC81A01EA07399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770340097, "uuid": "fb6427df-b847-4b7a-afbb-fbeb407cb348", "value": "768:eKlCwPeNe/9EmoWKEHw2anEHSA0A210nSA+BOyYj2:fCwPeNe/9ERWKEH5BHfd80nSA+oyYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770340097, "uuid": "de4de681-fd26-4fda-9e3b-060090d756b0", "value": 37476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770340097, "uuid": "331b4287-8d1c-4542-8288-227a191379fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770340097, "uuid": "6b57fe6b-399f-48d1-98a4-6d90b465faab", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c54238bd-037b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770396555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770396555, "uuid": "e5d8d187-0ee2-42ae-bfb0-1fa8ee6371ab", "comment": "Malware payload", "value": "9c84655455cfe026651ea96949abf103", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hacktool", "colour": "#059CDA", "exportable": true, "hide_tag": false }, { "name": "HackTool:Win32/Malgent!MSR", "colour": "#D6E849", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770396555, "uuid": "61e57a61-3493-4758-9da7-0341b64e71ad", "comment": "Malware payload", "value": "d4483b235b21eb695eb5ddfff9467081dd486f78e9000a5e39d8ae2ce28e1d7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hacktool", "colour": "#059CDA", "exportable": true, "hide_tag": false }, { "name": "HackTool:Win32/Malgent!MSR", "colour": "#D6E849", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770396555, "uuid": "5d757037-7129-47f2-80e5-1a73d05a02a9", "comment": "Malware payload", "value": "c7b153071c0c730fa20610498864e3f190904575", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hacktool", "colour": "#059CDA", "exportable": true, "hide_tag": false }, { "name": "HackTool:Win32/Malgent!MSR", "colour": "#D6E849", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770396555, "uuid": "a5db4387-75b1-42cf-aa47-9a6f7733a9e7", "comment": "Malware payload", "value": "b239ea62cf0cb0fb515b7237aa9261626fea2f7cc7f04b7306cc18e75d5caf3993e5ee7f955fa52e53f0fcbe742dc06d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hacktool", "colour": "#059CDA", "exportable": true, "hide_tag": false }, { "name": "HackTool:Win32/Malgent!MSR", "colour": "#D6E849", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770396555, "uuid": "a6caba1c-3f24-4c58-9938-1a13010a5b3e", "value": "T10A772853B9A9C0D4D09A9530C262E1D3BAA17C464B2457C73BDCBF2F2F76AC0997A710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770396555, "uuid": "074ec2c7-375a-4413-b46e-8232e78583bb", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770396555, "uuid": "4b48fb92-fae9-46a5-8283-087ddaf38766", "value": "98304:RFq5lnfviq5EpmqVa0SRE6QMG/oVPKRjJy5rwBWqk5YWrE2:ROfpjqY0SREFMG/oVPKRjarwBtk5l4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770396555, "uuid": "0c40129c-7f2f-49af-a06f-9bf1560a28d7", "value": 34337792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770396555, "uuid": "0c19d9eb-18a1-419d-a0ab-d606c105a6d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770396555, "uuid": "beb98a49-6f94-48dc-88c0-29847b74b61e", "value": "fs_windows_amd64_upx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afddc6b3-0349-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770375044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375044, "uuid": "f95ea8b7-3c51-41ef-ae44-2321f178029f", "comment": "Malware payload (Mirai)", "value": "e91c7b55598e483d73e531ffbb3cec1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375044, "uuid": "c4523b95-5491-4b9e-abba-0c1c32c6a49c", "comment": "Malware payload (Mirai)", "value": "d5b998abdcc64673a041d6b1adc055f6523bf650627fe7cb46831d2d13d6a9b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375044, "uuid": "2003deea-4dc8-44a5-8029-07ba10f07bb9", "comment": "Malware payload (Mirai)", "value": "4fd289a51591c74eb745f0e8825c0345b5222066", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375044, "uuid": "b38dfa05-7595-45ff-979b-b951dd3fecb4", "comment": "Malware payload (Mirai)", "value": "d639bcb40265b08bb95957f0c19495fc9db9983a7fbd90c6908fcfeff2844607e470d12b7b5c99fc837487e6ef7b2872", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375044, "uuid": "54c0542e-bad6-449e-b54f-ec1e9cd7ff66", "value": "T14EC2D0319111AAF18F328577E97C1441790A5CFCA0AE3063A4699FDA76D38F38F685CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375044, "uuid": "494db9c7-4dd8-463b-9cac-81e940aabddc", "value": "768:rV8Yjg8RU8b9Ed0UR5K5gFMIoRIcM79q3UELOf:5Zjg8RLme5gFMHO5aLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770375044, "uuid": "5609536d-1d39-4dc0-aa3d-8c7fa7282cf6", "value": 27292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770375044, "uuid": "c452a659-e5a9-481d-bbd7-2eb33d511804", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375044, "uuid": "d01de6c4-af16-4f79-8e9c-cc2c7569046d", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a384011-0312-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770351358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770351358, "uuid": "a8c9d48e-b337-4fe5-93d0-32fba0afb828", "comment": "Malware payload", "value": "2fd38477043704c73acecadab057e75b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770351358, "uuid": "06f1f1a4-5e8b-469a-b963-e4a7547ec29a", "comment": "Malware payload", "value": "d66ab29a1f7dc523e45dd07c0cc1f010bac700b57441ade0b652fdc0dfd122af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770351358, "uuid": "ce12a352-becd-49a5-a22d-785ab14a7069", "comment": "Malware payload", "value": "f60eb59f4398893e6b4c6d288253742e49fdb0d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770351358, "uuid": "177456cc-1e79-470d-a97d-46bbc5964f61", "comment": "Malware payload", "value": "0c38fb40ca0f01a0ef58c1c2ca963491612e89b18a44d68c02c4ded7cad5a03a9852afb44f715d754d9cec360dc017fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770351358, "uuid": "1398229c-3a2d-470b-a928-f2b10ed276d6", "value": "T10F765B32F71426BBCAC3D35DA262A2B29EF064608326425FDC4FC3AD3D5646CD17A674", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770351358, "uuid": "187bac74-76e6-4615-9d97-8d08c72f98a8", "value": "d8bdf6acc67ac13e86a4384faef0c137", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770351358, "uuid": "8cf145a1-aafb-4526-8f8b-c28a45ee36be", "value": "49152:H99UYMMW/s3UASFzoEBBq7/yQ+JKLWluxobhNWtfUeBGff+Et5V3R/UpMG/h5wWu:HWFzVB87ScWPQTU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770351358, "uuid": "93c83881-04ba-427f-915a-feb92418ed9d", "value": 7823360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770351358, "uuid": "a5b9a778-cd10-4b75-b6e5-053dd1de4ada", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770351358, "uuid": "519d407b-9452-48ac-859c-413bdedb0247", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01293647-0315-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770352417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352417, "uuid": "08d91bae-d7ff-4be7-839b-6476d220b89c", "comment": "Malware payload (Mirai)", "value": "03afd4ac5b4ed8461bfd78bf7e32c347", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352417, "uuid": "5875ecf8-f5ba-479c-a4db-369a505e5ad4", "comment": "Malware payload (Mirai)", "value": "d6ecf84c4fc0ffba0860653bb9663b271ec8d5a0822cc993b4bc6bf5a6ae2af4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352417, "uuid": "a249dc9c-227f-496e-845f-5e7a96bc9580", "comment": "Malware payload (Mirai)", "value": "90d13d1ebf438fd27f819e33e391e41a45f8619b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352417, "uuid": "026eae78-bbfd-4df7-b30c-bb755d7e6219", "comment": "Malware payload (Mirai)", "value": "1f9a87c08d5e1a9dbc661111e8e400c4ed336bf948e96cd80e6c7fe3475c72f092f2a3527627133c547a8f6d1e28db6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770352417, "uuid": "bca3c698-c2b0-4031-958d-134ca866b45c", "value": "T178439416BF650FF7EC6BCD3749E82B0524CC650A21E87B3A7934D818F61B25B49E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770352417, "uuid": "59376943-fb71-4d53-b5e1-fddd24989028", "value": "768:x4EJFBwExxBuMI5BQeOfeKUhtv6bxXic8DbFWy:x4ETtIwvfpUhR6Mb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770352417, "uuid": "f39cd89a-85dc-49dc-b683-3eb879e1dbac", "value": 55236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770352417, "uuid": "6ac4ac19-6c32-412b-82cd-b8f3acb6ee9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770352417, "uuid": "ef7de841-cbcf-424c-a5f9-2c428873a482", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8451fb-0363-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770386234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386234, "uuid": "00001216-4d2c-4624-824c-0b965a49fe63", "comment": "Malware payload (Gafgyt)", "value": "1f33174e3ffcc99c01fb24395627051c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386234, "uuid": "755a9cde-c3b1-4281-ad16-d9b4d7e8a8e6", "comment": "Malware payload (Gafgyt)", "value": "d7ea1d504dac74a1cd68ab5119680fd8a3abe6deecd99a8dfcc01476f0ebf611", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386234, "uuid": "542c198a-62ff-4096-9cb7-e4cc527a06b3", "comment": "Malware payload (Gafgyt)", "value": "4413f2926559e5c5f02a0d5d6128a0604e35219d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386234, "uuid": "d929679c-b111-49cd-a4ba-2341c335772a", "comment": "Malware payload (Gafgyt)", "value": "77e590e362252f18a9be9d8005c19a867e094a22652535485c4676fd194356944d00a599470349db4605d7bcb4db772e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386234, "uuid": "c2569449-b65a-4831-8a8d-8cb65b249dbc", "value": "T10CB31813B7B1DABEC08252B12BDB92F19423FD7D0732622B33957DA51B388D96D59302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386234, "uuid": "b58d7546-356a-47cb-9bcb-cc0fd9fb772d", "value": "3072:od0w4SAewzi+Xn+8Uhw6W+aPMJmDk1c8xF6KjW:zfO8IBxJmDk1c8xF6KjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386234, "uuid": "4093e5c5-6027-4f10-9d04-88c6ef7d485c", "value": 114825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386234, "uuid": "eec532fa-f25d-4b95-a12a-33e2ad73b780", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386234, "uuid": "7c0f15aa-7e1e-41a0-b7da-a27b9f70cd63", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6134166f-0335-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770366322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366322, "uuid": "fe1d74e5-4c7c-48aa-ad2f-5147c6fadd82", "comment": "Malware payload", "value": "2aeda101ec722f3513ca09213ccd703f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366322, "uuid": "b7483dfb-13d9-4ada-83e5-bb4f1337dd96", "comment": "Malware payload", "value": "dafe3928c608a70b227f29d211d4974383c4dd0fd8006c5215c45e54b691ce68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366322, "uuid": "e10e3ef6-fe25-4255-84a8-03f7eac91b85", "comment": "Malware payload", "value": "17695924c5d6cbe77da06551158c279ec749c4f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366322, "uuid": "dd701251-e45a-4616-a997-eb6d913bf108", "comment": "Malware payload", "value": "194a1fb0cb2f89bca3d253ee93559587899404c156234e285772c4ceb735887acf89cfb4849831561b2d089073e32a0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366322, "uuid": "68e3d674-766e-4573-843d-82dff1a8e318", "value": "T18F860984BD846BE6C46C5F7584EAC95523B02D144AF1463A26A4FFEDBC72274BF0788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366322, "uuid": "a9fa2c78-2a17-4eaa-8815-eb48d5a81437", "value": "49152:3siChJwUkhkTdGdET9wMkKN0VJz8CHNVT93Bfso23u6IKMRLHlmgYEwqbA7v6RGK:Muw5CUMmqKCgfJEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770366322, "uuid": "5940572f-8f76-440b-b83b-94cc0c729198", "value": 7864499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770366322, "uuid": "93ea284a-7a8a-400c-a07f-d2e1367c6d5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366322, "uuid": "e40cf704-5681-4c15-9ca3-e422d201b136", "value": "linux_mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b535d77-0364-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770386364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386364, "uuid": "9764affc-01b5-4fa3-8607-ca69f91f9022", "comment": "Malware payload (Mirai)", "value": "84367cb60c1187fe53b77ba0aba13d5b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386364, "uuid": "f410a3f6-8e55-46e2-a27d-7da206bfecc6", "comment": "Malware payload (Mirai)", "value": "db4f3093ee1bc5f6181b05f03156f8dd5605a7d92a24757b39e4b45505c63221", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386364, "uuid": "0fc366cc-a3ab-485c-b401-e029044c313b", "comment": "Malware payload (Mirai)", "value": "36c183959dad2f9eec82e9ae604270b72b7f5646", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386364, "uuid": "8b8cd7fd-bb1d-47d0-b91f-759184f41831", "comment": "Malware payload (Mirai)", "value": "0ed9c70045e17c4d015ce4d3489cba31d08a7ae39724a1b93bcfac21f112e12c2aa0e6084055a35b00edbc298eae0989", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386364, "uuid": "c4351fdd-ff3b-4373-863a-73de94f9f9f4", "value": "T19251898443A10B3A2EE2D51E72E5C89476B854EFFCE45F04A9DD7CBF409DF681848E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386364, "uuid": "0954dd7b-6d2f-4cae-94d9-14e4976582ea", "value": "48:v2sms096s2ZFacs/qFLcsAvmsg2sUNB9sWvsQesalsI4siusG9su2KsaQ:v2sms096s2VsQ4sAvmsg2sO7sWvsQesN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386364, "uuid": "1dd08141-38d8-4d59-a6c2-a07d851ea8a6", "value": 2685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386364, "uuid": "2cc4a94d-24a0-4a9f-aaea-08cee8fd2b47", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386364, "uuid": "cac68962-5073-4cd6-8cce-4268771d5a42", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ed9b6c-03a4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770413838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770413838, "uuid": "e3e4f485-882d-4dd9-9f40-6be1c16d693d", "comment": "Malware payload", "value": "1222b2d73fe06d861092740babc267cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770413838, "uuid": "e3adc143-d5c2-4ab6-b087-0bfdd4dad3e2", "comment": "Malware payload", "value": "dbd1710e75a3db4b9303b1208d24a06ecbf919a6d4377fe5116da7f3a0841782", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770413838, "uuid": "df5c052e-3b00-4d85-abd3-e79ec7a0c73c", "comment": "Malware payload", "value": "f691b6af1c229f3f9b0c3600eb9b5ae2331a9ef3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770413838, "uuid": "50548331-b54d-46f2-bc35-45c22a80ab10", "comment": "Malware payload", "value": "8e858c6e40c72f7fc373abd6824f4852dace12a634d8bdb70eaaf462171b877a20a8b3b83ba8c3a223b98f22ba023483", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770413838, "uuid": "45cd9a65-28bb-4ed9-adc5-0f0b82ab3632", "value": "T1F5C42A7EAC14E327F60CA0BEE287D3534F6578110236BA931CBA972411495739B877EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770413838, "uuid": "4bfd1ed1-8b67-463a-a0ee-8723aed10099", "value": "fc960b9f00b5c476474282bb39f86c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770413838, "uuid": "95ac4975-c44b-40cb-a4f9-fdc06bc26215", "value": "12288:EcVR9cLXtGJKYvFSPXLI6zavBjR2+Q40S:EcVR9lKocLISavBjR/2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770413838, "uuid": "b4c0c347-4956-49fb-9b2d-b4483494df01", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770413838, "uuid": "ad2978c2-2432-47f8-ac71-c70ddef6f411", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770413838, "uuid": "2175d8ae-0761-48eb-98cb-1d6e49b6aa08", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ec803e-0363-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770386243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386243, "uuid": "0d15aebc-6747-407f-b28e-5758ecbb059f", "comment": "Malware payload (Mirai)", "value": "b50fb70947750070f8c08f7c299770a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386243, "uuid": "eebed0ff-ddf2-4747-a5b5-7a2c49751d73", "comment": "Malware payload (Mirai)", "value": "dca82e4cea1f26889f0c8cf8e24a6c8ecb054bf9236af12a45141748f69c0087", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386243, "uuid": "630c75c4-d18a-422e-bd64-7a2d1da14eda", "comment": "Malware payload (Mirai)", "value": "96b2aa825cb7f256ecb3248e7981a017c2299ba5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386243, "uuid": "68dec188-e3ea-4ded-8d02-799798b3f720", "comment": "Malware payload (Mirai)", "value": "074252da68a4b8061490644cf6e22665e81d5466e0c9727003bd48c05a0de6a7db6e555ea6bf2ece2188ff8d17499c37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386243, "uuid": "ce1299a5-d31a-4a4b-a38d-c28a9eec4cc9", "value": "T17FA35CC0E743D4F5E81646716137F7329B33E03A201AD943D7ADAE36BC51A91D62A39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386243, "uuid": "ed29c2d5-3a69-46f1-a08c-1495ccef6e1c", "value": "3072:1ahaoH9poXxVyWHbkXXNk0BZKQd66LgUvDD:1ahaoH98TyWHbkn/JdbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386243, "uuid": "1d113181-ea49-4353-a899-18ca1ccf34ec", "value": 103080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386243, "uuid": "3ca234d0-18b8-4903-ad9d-f7301e0020b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386243, "uuid": "2a9bdf2d-80f1-497a-9d26-2129d837a2e7", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d2da6da-0335-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770366342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366342, "uuid": "2e32f5c2-e9fe-41b7-b5b1-80db46cef276", "comment": "Malware payload", "value": "dc61c2149820e1b2da0402c1b2c1083c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366342, "uuid": "18d2080f-3239-43fd-8e03-22f1ae0f2d09", "comment": "Malware payload", "value": "dd38f3b9c649eb51aa73bfd8a5761d423a90533bae188d9e7260736ca79c3d03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366342, "uuid": "08c7d9e5-2b39-4de5-a1a9-3f7780b0c13a", "comment": "Malware payload", "value": "875a73c02277e4224f71972a9d55d9ccaf0bb4bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366342, "uuid": "8375362b-7202-43ed-870e-6a5c4f487100", "comment": "Malware payload", "value": "aff946837dcc9f5504bb1db0c5629efbff29c8c38087730bb0bd0ec310a94581d86a1f5a8ac59f398d910f880aab5238", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366342, "uuid": "16e1518d-399d-4b19-b1d2-7d29d1850ff5", "value": "T178860A90BEC62E66C19C137545EE625662643E444F92072723A4FFEC3E7773CAF4A848", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366342, "uuid": "b1f64b32-4cdb-4798-a5ce-573b51af1d9f", "value": "49152:XZH5I+72jsrUhJQSzBhJE3p98BKOzR2GMHecL6WocI48KY7SaQqUpYjxiZ5EJ:XBq+qIrUhJ041fJREEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770366342, "uuid": "243cacd2-3783-4701-a02a-4092f1383a8d", "value": 7864468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770366342, "uuid": "019cf013-75a4-4780-abfa-69a60057b10d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366342, "uuid": "28e7d183-f455-4e4a-a665-b69dadf9f781", "value": "linux_mips64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bf3c1d2-0386-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770401049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401049, "uuid": "99aee295-3f6b-4a92-a80c-6d53e7ef75c3", "comment": "Malware payload (Gafgyt)", "value": "eb272a764aa457bd97508cbd26bf8663", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401049, "uuid": "5af1820a-a6e7-4821-aec2-32f11f1a3067", "comment": "Malware payload (Gafgyt)", "value": "de7008eee0827cb292fd9b11bc0fac34eeac5cca90abd577f0f3a2f0f03240a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401049, "uuid": "e927d516-66e8-44cd-83e9-ad59eb315b44", "comment": "Malware payload (Gafgyt)", "value": "73a30c64047fb6392f3a2730e41955e852e37c56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401049, "uuid": "d7b65cdc-e4ea-44bb-b398-ef89c6d6d7bb", "comment": "Malware payload (Gafgyt)", "value": "30509414c0625fbe59b49a4c75aad852ab6c69992cc8a407f55292dc166c3b07355179e52cc97a18a08e9cafbe31f2eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401049, "uuid": "b18cb7f9-0cca-46b0-9dae-15a932215c14", "value": "T15DA33A377B130E23C0CA947111E31731BAB5D2DA39FA5243B9A16DE86F266843562FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401049, "uuid": "b0000b0e-d58a-4416-8c76-a756555632ff", "value": "1536:XBJ2MNM5oqtkUtn7phaK6igkvmQmF6OXj6ufeuTe:KMN8v5phaK62vmQmF6OXGufhTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770401049, "uuid": "6a94228b-3b42-426c-9b42-7e54f506ccba", "value": 101398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770401049, "uuid": "0b0228f2-ad8c-4a12-ab48-2210d399f366", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401049, "uuid": "b068dac3-995e-486f-afba-8bf335d7f656", "value": "skid.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e058067-0360-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770384731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770384731, "uuid": "c3e7e563-0221-4b80-93fd-82517fa5c957", "comment": "Malware payload (Mirai)", "value": "196083a32209a8ddf2932fa9bff69ede", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770384731, "uuid": "297e507a-f002-496c-af32-3f3667efa3c6", "comment": "Malware payload (Mirai)", "value": "de81ea152227008e1f43af66157e92d5bfe6fd30dea9429a2e38070e88bd549e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770384731, "uuid": "52229caa-fd69-4fe8-ae27-5f81e0b61c03", "comment": "Malware payload (Mirai)", "value": "f995b1a8b23849fb34b994fd4aa7bb3a4133dda7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770384731, "uuid": "dd20e887-f64f-43b2-b140-91670631b5cc", "comment": "Malware payload (Mirai)", "value": "27d274d4184a676cf81119697f4924e0f73dd182ab1070d36ac43d477078cf89fef2d639b6fbabaa25f306cf0cf3a29f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770384731, "uuid": "8faa6e50-de45-42e2-937a-deae098b2917", "value": "T101D0A79961208663768F8D55A3F385E5708565E81CD84625C6570817449D001B75751D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770384731, "uuid": "6f42529b-fa55-4b65-b88b-132e186b64b2", "value": "3:TKH4vk3pBxU1+3DnQ/AMsRCvRFMLb+J0yAQLQO9SAQLQbKJaOdosBRj:hMc+TnIAM3vjIAPEEwEwo4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770384731, "uuid": "b5f401e3-8691-4fae-bcd3-6895412c1eb7", "value": 216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770384731, "uuid": "af647a7b-c7e2-4a80-805d-4b862397cbf6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770384731, "uuid": "4605f813-1b51-44f0-be8b-fa2efd51c1fd", "value": "jack5tr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f48f7aa-032d-11f1-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1770362910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362910, "uuid": "22162077-fa36-4ed1-939a-751306d0346b", "comment": "Malware payload (SantaStealer)", "value": "c52faa41d2a8e1a4ddb2a3455999111c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362910, "uuid": "6cc2b78a-2336-46e6-bdcb-42ab1a41710e", "comment": "Malware payload (SantaStealer)", "value": "de97e3c6aeab51e927a35c60775d0543018bd61914644d0078fe34b78e1efc92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362910, "uuid": "ff5c3b31-5a2d-44e7-9a7d-b72829e4f664", "comment": "Malware payload (SantaStealer)", "value": "2ca6dd1907a0dc91bcd9ec99eddc617262b535f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770362910, "uuid": "4a9414bf-4bc1-4bb9-96a3-3f791ec7b328", "comment": "Malware payload (SantaStealer)", "value": "586a02510df06010320af133c6656fc9255ee57c0e63d5e56882c3369843f81ce2831f46249772e1aef03ec8af23e595", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362910, "uuid": "b50abcb6-fdc4-41ab-a996-87e7880961c0", "value": "T19666D0CAD16B40D6CC067FF598142BC39B3056324A3404783AABBE594F779FA811EEB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362910, "uuid": "e8fddd80-72c6-4b88-bba0-9bec86eed3c8", "value": "09bf3c2c0d1e1c721043f5ca267758f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362910, "uuid": "5fabf228-8866-4fd3-86ec-0f5bd732aed9", "value": "24576:5MOINaFnWcXcxVjmCfLRrIm0RXLkqsMXNJsaCZTPJVbHaZ8xcb8ggWEK72wAAxyH:528+3PNAiNkF6jSYZJ8jo8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770362910, "uuid": "e1ed79e0-7d80-49b2-b3f0-6f5610d99fa6", "value": 6804480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770362910, "uuid": "d6daeaf2-8e94-41b5-8c2b-12be4b6c076d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770362910, "uuid": "ea6332a6-a3e8-41df-80cf-86a29141a009", "value": "SecuriteInfo.com.Win64.MalwareX-gen.52463829", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64730dfb-0335-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770366327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366327, "uuid": "1a12e6e7-0a21-4e05-babc-a171b36796e3", "comment": "Malware payload", "value": "cf5fc725ccab8c76a2855592ba0453a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366327, "uuid": "695900fd-483b-4be2-a894-d34167278227", "comment": "Malware payload", "value": "deb268c11fef2076132b3d5d858c613e8839a8fda61f1630aea1c420802207dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366327, "uuid": "f5f71c49-6bed-48aa-8fbb-640c65f8680c", "comment": "Malware payload", "value": "e9badd68ffa80946facd241f407199aa8265c46d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366327, "uuid": "a64a498b-de05-4c1a-ad85-df932eeecc16", "comment": "Malware payload", "value": "1d38ee696b54cccfb04a5668448d441bb5e915bd391abe0be76d895ef8dd4b9992aba81897f2e2e516233aa0fd082444", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366327, "uuid": "53c67c45-363a-4f92-bbc9-646826804a68", "value": "T195C32B56BE52CA12C1C755B7B7AE464837276BB8D3F931028D246F90278B4DF0E7B212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366327, "uuid": "5c1e93ec-2b9f-4af4-b0e6-54e4ba7282dc", "value": "3072:QUZ0XnCmdzP55fDpXaopmy6vs2U3WFSgD1kPBFrUZ2Xj:lZ0ymdP55b4ouvwzI1kJFrUZ2Xj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770366327, "uuid": "0f8d4d64-4dc8-4465-939c-bf5232c36cae", "value": 120952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770366327, "uuid": "6e5084ac-67fe-4b04-a4c0-f8c954748274", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366327, "uuid": "12818e32-7377-42c7-b719-5dc75e6a4ce8", "value": "data.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc2ccb4e-0349-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770375091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375091, "uuid": "411a8f35-b35d-4f72-954f-00ab7e028b3e", "comment": "Malware payload (Mirai)", "value": "7dfbc87aab4c896df7178989a8fa0ea1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375091, "uuid": "c6e16744-5674-4921-8d74-dc9026a2b08f", "comment": "Malware payload (Mirai)", "value": "e0937908386cfe22e32d17addf6a0f326d804418e7b9964630ab8c70bf9a3258", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375091, "uuid": "0ef5ca01-3d59-42dd-a8f3-d35dadaebd5c", "comment": "Malware payload (Mirai)", "value": "586e937ec0e2d17abb8ff35a843bf639d0f4ef3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375091, "uuid": "f0148294-8cda-4915-bbb3-16fbde0f2e0d", "comment": "Malware payload (Mirai)", "value": "fd09fa6777c26e25712f5301d7bcde2c6787ecd0bba7c9d63bd6c3b0259c8572e6151b327f022f770681011b4f2b66e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375091, "uuid": "f2f33dd5-eabb-4b4c-b6e9-1fbe13dcab11", "value": "T1FD334B42322C0F17C0A35A74252F5BE487FFFAD122E4F685251F8B568A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375091, "uuid": "de341cfe-2a76-40cc-b0b5-1728c9646bd4", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+GwPKg+s96Bk9DgI3i8Tw/:ivW3jdQGqt7Y+Z+zJ9cmgISb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770375091, "uuid": "e47feaaf-7aea-4197-aff9-6b836def954d", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770375091, "uuid": "2bf4b873-13c3-49af-a5de-cd3085d69e5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375091, "uuid": "87b14b37-8951-4de3-9e9f-7735aea23439", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6836e886-0335-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770366334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366334, "uuid": "e2e44f1f-ce27-4ffc-bdfd-40a98cf39eba", "comment": "Malware payload (Mirai)", "value": "9322d7a736195358783dd02c538e5005", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366334, "uuid": "8820a801-6dc1-45b2-8dd0-d3b394856705", "comment": "Malware payload (Mirai)", "value": "e1144fd4880d7efc8c22edf8bab285951dfec16789e749a224d90e2415a2e3b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366334, "uuid": "4ee84580-19ae-4a71-b2da-21896c438528", "comment": "Malware payload (Mirai)", "value": "dbce97062e8b5de487883b58be5d18938c61891b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770366334, "uuid": "ae18e899-39cd-45b3-a4db-c855f9c82bfe", "comment": "Malware payload (Mirai)", "value": "020ba5a6aa82e5464870a7b081348209f8e3ee5ea0e032786c3875a8b2cb0e7f7ae2428bc1132148936dd0ea1e39d6ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366334, "uuid": "182c93d4-b445-47d0-a441-240fedeead25", "value": "T1C7E47D9CFE4E3D42E2D7E2789E4987E1732B71E4D32391A33982434CD5CA9D98BB1512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366334, "uuid": "14ea93eb-5dd2-480b-b88d-814f82da0498", "value": "12288:8gTiYNsT9cH1hMIMIrF0KZVKNYVs7SMqFDldrAevDiBw5dzUW8Or7x2:8gTiYNsTiH1h1LXKNYy7HqGviLv7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770366334, "uuid": "174c6b7a-a59a-4d42-8dd3-e6ea460bcd8f", "value": 665664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770366334, "uuid": "e7ac87fa-5e34-4985-a5e3-48b321549027", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770366334, "uuid": "383fb880-4842-4541-aaa3-fd59cf8bfc17", "value": "data.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d8dd45-0349-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770375052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375052, "uuid": "2093510d-221d-43b7-8266-d3b03eb3fa6e", "comment": "Malware payload (Mirai)", "value": "fa1474d73c6212073a2cfc866c14ac68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375052, "uuid": "793a49c6-b5b7-44e6-a2a1-2de1f138cefe", "comment": "Malware payload (Mirai)", "value": "e148df54874034e30a89c7e64371da330d42e7ba6cda157043ec965029c9805c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375052, "uuid": "397b09a9-97a5-48d2-abce-6670dbc21799", "comment": "Malware payload (Mirai)", "value": "c67938ac70471c59a830b577f67573c15dcaa5a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770375052, "uuid": "a4e58070-fab4-42d1-ab51-6a664a22a121", "comment": "Malware payload (Mirai)", "value": "2aa01cc01446994d79f2d0a0670c3cf681bbe40b05e42ae052794bdf9cd26f3e1784b3adef365dd4cf066d7c108541ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375052, "uuid": "f56ef34a-4d6c-466e-a36e-6afef243edb4", "value": "T1B8B2CF384F061B98CA1AC57E86D68B103A742FB11683EC1BB191BD839F5F4B878437E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375052, "uuid": "6a3f2b31-fd18-4123-a249-51d1182490bc", "value": "384:yeD8ZSH2LLZUYyGZbsOiTrowSN9rnfYhLHR+43K7TkoHKZcXmd1JgGlzDpH7uNjp:yeD8ZSWvZHZbs1row697fYhL80K7TFqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770375052, "uuid": "a4d1a56f-f21e-4379-ab1b-f71c80600e5f", "value": 23776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770375052, "uuid": "ad63a7d3-326c-4d26-83f4-c7dc0f095fb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770375052, "uuid": "c4490c48-0b41-4eef-8904-cba63694b091", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07add641-0364-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770386358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386358, "uuid": "2e8a9c96-635e-4c62-9919-bc4d24d2ed4c", "comment": "Malware payload (Mirai)", "value": "1f7a4e570626c7ca631bce05624fdfee", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386358, "uuid": "f0ff0331-06af-404b-99c1-abdb7a843e35", "comment": "Malware payload (Mirai)", "value": "e26fd1fd84a093163f86c1372585637693037281ffe170730df125cd976b2a7b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386358, "uuid": "8ae9217f-5742-43dc-a7fa-cdf789de86c8", "comment": "Malware payload (Mirai)", "value": "f8f09de8b3377b138dbb2623d53aee56c0677bf9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386358, "uuid": "69820a94-c70a-45cb-907f-7bca876cbc67", "comment": "Malware payload (Mirai)", "value": "dd6cc39927f09bae6eed8b97cbd7a4194194ea0cb3dba0244733ee2a5889ecf945e300bbda168c26e613c694bdc4efcd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386358, "uuid": "9d3e4bae-8bfb-48bd-9bd7-cde7e156885e", "value": "T1DB51FFDB0284DB32D65DC54EB7F4F174610AA1C3A7DF9A08EE84982D8EC9D4C7295F44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386358, "uuid": "4029283e-ef20-4759-9a79-269708f10bd2", "value": "48:q876O62JMIDyDbiB8fnfuZUWUWcvyy2DCnCbwLZbL7kzS3tOthM3IEy:qD2JMO0biBOfuZ+Cbw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386358, "uuid": "ad5386eb-6836-4094-bbd0-5fb722ed16e1", "value": 2881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386358, "uuid": "87fe5eb2-4cdd-4451-8c1a-f453ff7ed4b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386358, "uuid": "76adf5ee-4f6a-4cf0-b55b-dadf9620fb3b", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979bcf54-037f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770398196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398196, "uuid": "4ac70d2c-3241-4e79-ba95-d94fba0a29bd", "comment": "Malware payload", "value": "b239dc2d40f8cbcd06e2fec2a2bdbb17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398196, "uuid": "aab034d1-577d-4ddd-b3d0-4ef330ad1387", "comment": "Malware payload", "value": "e2f465973483a0f6e7b20dae40ce2d4acf247b6e8c17c34ba928a0c413c57670", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398196, "uuid": "06dba054-3b56-4ce8-9cb7-7530ab2292c4", "comment": "Malware payload", "value": "087bfec9da9c6306da99b8350f77cbad73779b58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398196, "uuid": "ecd306f1-98a3-4aca-b0b7-128e00c53268", "comment": "Malware payload", "value": "587a31e90decfd06bad95ab815d27aa258f9ed1fe22ee6294b210141e70b35dac413ca7fe7e7438708fedac23f993d8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770398196, "uuid": "221d1261-a65f-4ef2-b231-5260e7efe915", "value": "T1B2963314A2B405F9FCFBE23ECB129915E2367D016B62D9E7079442811E736E53A3E3B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770398196, "uuid": "199c064a-4fdb-4c08-b73a-19956248dc77", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770398196, "uuid": "5a25c0dd-2139-4895-8cdb-4a86efa25099", "value": "196608:tipFr0BbBfurHmIQ3qemdUSCtbbeoMi6KPM9qLbDOny:tWrYfuCI6mdUSClbVkw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770398196, "uuid": "9ef2448f-60ac-4879-967d-c94568571215", "value": 8797672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770398196, "uuid": "c4e11821-0215-48a4-8067-42a39ccf7563", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770398196, "uuid": "9a315581-0745-4d9c-938a-6f12a52fd447", "value": "Guzeloyunv2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cee20aa-037f-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770398071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398071, "uuid": "e2318d52-a71a-41ff-83d9-25d620f7bfab", "comment": "Malware payload (Gafgyt)", "value": "f470d119449b8a764143e20dcd36bfba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398071, "uuid": "1708b8cb-3bd1-4a3e-827d-93180e0e7d31", "comment": "Malware payload (Gafgyt)", "value": "e487b73c3b244906e80add4409a00f727300a8f9e00488e8a69fa19f42a57cef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398071, "uuid": "d0363f10-d172-4ef3-8365-d10cc2ab3e3c", "comment": "Malware payload (Gafgyt)", "value": "b1d85448a65a6360f39e1622a2cb3b76e58dc90d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398071, "uuid": "1060f2a1-5d0c-4898-9383-dbe6785fdcf7", "comment": "Malware payload (Gafgyt)", "value": "03faaa538d12a7e467be8679d6520a90a3792e33f513d38e94f44eb51c3c9fdb140202be27d4021debbe4463ecf74e84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770398071, "uuid": "a382604a-4790-426f-8514-200ab9f2583d", "value": "T119B31993F801DEA2F40EAA7605D74721B630FB660F431A7263573966AE362D53827F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770398071, "uuid": "cd89cafa-c6bb-48fe-97d9-b1243208c525", "value": "3072:lK+DjGICKW59bQvyceAJ3V+fDhmFZ09DRAoQfgm:lK+3GICK60ycvJ3VKDhmFZ09DRAoQfgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770398071, "uuid": "2b4d9700-2d2d-4d09-bd03-e2fa81597b71", "value": 109317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770398071, "uuid": "8a3a39ea-10a0-498e-b603-7987bbf6a7ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770398071, "uuid": "bc33cb1c-13d4-4843-b8a1-f218db3bdde7", "value": "yakuza.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae4010c5-0381-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770399093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770399093, "uuid": "83efa023-a908-419e-9d1f-36af2105eeb2", "comment": "Malware payload (SalatStealer)", "value": "2c6ddbfb2a43cb0756602807d57a9474", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770399093, "uuid": "8177c853-1dbd-4396-91b9-19d8a6a1cb92", "comment": "Malware payload (SalatStealer)", "value": "e4f4299f58d6cd4b9ce5333ab9095fda707bba86bdb461d178a4db28f732e7ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770399093, "uuid": "bc86e263-f23e-4d7e-a42b-a02a947dd8ef", "comment": "Malware payload (SalatStealer)", "value": "f0d13b1a39d6b50cc325bcccc1ab5d32712904e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770399093, "uuid": "1482d9fe-55ff-4a3f-a133-a5cbef762045", "comment": "Malware payload (SalatStealer)", "value": "57a2aa1d49f7de13bd7cd1c8c657e1eebf69ed847b23923d9877896b605e3442dc6bed84716d8766015b1f8da31fc4ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770399093, "uuid": "4438f164-9c27-4cd1-ab67-6bc47e0861c3", "value": "T1C3E53334458B7E4CFF7C89BBDA193D1868486E91F81B064076AF1A75FE6611B88E40F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770399093, "uuid": "7aa2c0b2-8c3c-4719-a74a-19e03005f322", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770399093, "uuid": "0727e3a0-522a-4808-b980-9704f5d0469c", "value": "49152:Srtf/tc9siiTeIYqj9DnrDxZKV9hwynhQNe9WInLSc49L0o/myeHBxAE:Src9sN9Yq5HKV1nhJznULT/mycT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770399093, "uuid": "7a96f281-412a-433f-b7a7-ff21d6122844", "value": 3290624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770399093, "uuid": "65d06d70-e907-46c9-aa94-3bcfa5988bcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770399093, "uuid": "84cf2b40-be3f-4543-a35f-a5b4a0015017", "value": "banan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76cbe94f-02f3-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770338011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770338011, "uuid": "6279fb69-97b5-4e92-89c9-8c8a5163b977", "comment": "Malware payload (Mirai)", "value": "cb422787d6694c77d6dde9bf54c8dbdb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770338011, "uuid": "e00d7e3b-3081-4c32-9e1a-7fddd03dc2e6", "comment": "Malware payload (Mirai)", "value": "e545105c549778ad247be60f5e1d8a6a248e03d90ad7e58f811fb06bd4dfa7d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770338011, "uuid": "227832bd-514a-4da9-9cef-32f53f7111b8", "comment": "Malware payload (Mirai)", "value": "d936c5fb7b32bbf46c8b643b915a237ce0fd9071", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770338011, "uuid": "f7b3e1d1-8f39-4674-9ac9-93476df8d501", "comment": "Malware payload (Mirai)", "value": "7cf0eb77067f6d0b6733a79487890d089a95fb589bebd72fc89b47cc2a5c8c29eee8f768768cbb6f55dd3ebc26750ef8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770338011, "uuid": "a4fcc18a-b571-4ddd-a228-156e527f6812", "value": "T10C130881B8809627C6E4237AFA6E01CD332527A8D2DF731BDD226F50778682F0D77656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770338011, "uuid": "d84eae96-703d-4040-8d6d-9ae9513eae92", "value": "768:+wwFwp8yYjvulQZsI9DTH4gY8G169YcrjxJl1P/NMBdb2zkLzS:OFK8y6vueZdxLbrN1P66", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770338011, "uuid": "5bf34757-54d3-4378-9d6a-c7d6fc549e58", "value": 41828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770338011, "uuid": "380375d2-ce6c-4cb6-92f6-eb447d339f9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770338011, "uuid": "5bf94726-9568-4823-af80-5ecf4e3d4549", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9f1ef5-0386-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770401051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401051, "uuid": "6b783f15-f5e5-4ef4-8998-12ff381e4daa", "comment": "Malware payload (Gafgyt)", "value": "2952a83111ab66ec8f96d497a926bd91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401051, "uuid": "7ca31269-9cc7-4e8c-be50-75ca6de5d93b", "comment": "Malware payload (Gafgyt)", "value": "e649ebf65eb37615639c2e100842864952f412fef172c60f332bafb4e3d5a102", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401051, "uuid": "57074d47-88ed-4bd0-9f2f-bdf7546d92e5", "comment": "Malware payload (Gafgyt)", "value": "c50069fb4d2317af742e01720764c45c5581ff29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401051, "uuid": "49201b33-eec9-4553-8373-019f0130d0c7", "comment": "Malware payload (Gafgyt)", "value": "7b5c6d80dc14d5d3df36cfe6fa6dffe26cff69f0ff45dcda2fb3c6e423bb4b58604efe77f796180fac60571efe6913b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401051, "uuid": "35895b77-2301-41fc-8d69-afee6bb82886", "value": "T195932B05F8454B13C1C227BAB7CF47493B266BB95BEB3302A6346EF02FC5B991D25960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401051, "uuid": "fb9bf02c-397f-468c-91fd-467e6940a219", "value": "1536:yu5sWiQ5ftEesFfw/DrRTOs15hOkKxX86I0mRxqQEqn/lJXfPe:jiMsGrz5hOkKO6/mRxqQEqn9JXfPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770401051, "uuid": "2dcbaf38-b257-4b50-bd2a-0ef054c3f11c", "value": 96196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770401051, "uuid": "8d6baf46-5517-4903-8d47-ecd04a26e016", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401051, "uuid": "c3ece93f-6dda-40dd-9795-a834388b3b34", "value": "skid.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe168cc-0363-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770386238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386238, "uuid": "43515bba-c180-4b77-83ac-fb6de991fb09", "comment": "Malware payload (Gafgyt)", "value": "e9826ad78a4820816c2a93ea810179a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386238, "uuid": "04ab2df2-e32a-4565-8d1b-c4abdd28c3a7", "comment": "Malware payload (Gafgyt)", "value": "e752485ade46b1becc7f3c0b9d92d958c89ba9f46be39270ead77a0ed761087d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386238, "uuid": "3b4707d6-03d1-4679-9bdc-0a1718cb44d9", "comment": "Malware payload (Gafgyt)", "value": "8901577b8be824ceac7182f6ed99eb81630138b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386238, "uuid": "d42bba9b-46ec-4289-b5d1-ea0601b6475b", "comment": "Malware payload (Gafgyt)", "value": "51b7ebf44efc87c3fe1687f9f2040d78685962bd2ca55dafadff6df09b265eef478d2827870c26f4013a16bf62a0c8d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386238, "uuid": "0d8aad5f-520d-4dcd-b5ef-77fe9ad7dfef", "value": "T173C30A45F941875BC3D327BAE74E428C37355E2897DB33156A38BDB42BF2B982D29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386238, "uuid": "2e023412-0216-42da-add5-1763c2c78538", "value": "3072:hQrFRNfuLrGhEPOD0Kg3gNlmBoHQuQekQnYW:IFzuaEGQKg3CmBoHQuQekQnYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386238, "uuid": "9ccdf44a-e614-46f3-880f-1d8ce8c163a7", "value": 120177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386238, "uuid": "ef68ec7e-afeb-4bda-8f66-945296f7a97e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386238, "uuid": "58825192-1a32-478a-847e-f5ccd123dafb", "value": "co", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc6fb92-030e-11f1-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1770349509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770349509, "uuid": "191bd45e-a306-4b2b-bedc-ee7d62a73917", "comment": "Malware payload (CobaltStrike)", "value": "9a9664cfb9a12708c43041d72d8720f3", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770349509, "uuid": "5e893302-8be8-4319-93e3-17803b25f4b9", "comment": "Malware payload (CobaltStrike)", "value": "e754b9e5953573cde2280ebe130f8d97538a524309de65acab9478ce6501ec84", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770349509, "uuid": "2b8ba810-d3f9-415f-9678-62e5f80f65c1", "comment": "Malware payload (CobaltStrike)", "value": "387613533b1b1586a44cd44db025ac98e219c7d0", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770349509, "uuid": "f6d026f6-073d-4fff-949e-aee260538b7a", "comment": "Malware payload (CobaltStrike)", "value": "34dc1022b30d22a0b447b9d8c01ebc6fe04e94c7c7bf17566d78e8ab8b2421ae4d0cb5bef88768a1d6f7088b9c9b6ca0", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770349509, "uuid": "9ca05312-b5c9-498d-baaa-935e670226ef", "value": "T1CFA2F7ADF24204FCC627C170DAFB4739EAB1F42116112F3E4660DA7A3E606A53E7594D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770349509, "uuid": "5b5fef50-3667-4cc7-9604-7a93f7cdb44b", "value": "f24e4bf5f5814cc136af1ecb8e2cad89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770349509, "uuid": "3c8c16da-7c55-457a-9da0-879e14c83533", "value": "192:wjxpSLZhpnL4JmDWd1+qXifWLDCUbmTSMX38nDf/q5Tj29dCbHtM6YQ5Y5rJVqdu:+pSVLwmDg1qm8dX2qbnYQ5Y5rrqdAJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770349509, "uuid": "2182cb2c-87ab-489f-8eeb-bd6908033535", "value": 21504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770349509, "uuid": "ca5d40e3-ad75-40a0-ae07-d4cedddff9dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770349509, "uuid": "6d244de8-0824-4e79-b3e5-89a304297d57", "value": "e754b9e5953573cde2280ebe130f8d97538a524309de6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "086acd96-0364-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770386359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386359, "uuid": "d2dc3ab7-d09e-4e97-9cf2-0f17e1835ed7", "comment": "Malware payload (Mirai)", "value": "e92772e7f0147dbc068943d311e7f147", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386359, "uuid": "cfc42de3-4c7c-47ed-a485-a8001f33de86", "comment": "Malware payload (Mirai)", "value": "e7995882447589b695c9dfcfbccc950c3290d54bb542edbfa9d55b2cb0320a19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386359, "uuid": "153fb57f-130c-41dc-8a91-6e42e2687ada", "comment": "Malware payload (Mirai)", "value": "7227b70f220df53c05bd9a83b530a5778c02da3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386359, "uuid": "d4e2bde8-dd34-48eb-b004-e3a372b9e743", "comment": "Malware payload (Mirai)", "value": "9af509b7872ee5e07f66d314f079a140e3d59e4ff92c2a7655b0a6c027286115e7f9e91a9b5d8d7da06979ca5e62f1c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386359, "uuid": "62024e08-c534-4f9f-abf6-4110813a568c", "value": "T1E973012B514F4AB3D0E99D33B00B7B34AF74E057E8F52F05F851A046EA1DDB2A184A79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386359, "uuid": "cd12d0ba-7244-4129-a119-ae69a656a3a8", "value": "1536:EOlDJ9nqHLw+ZQeuFvQfPbYGiNw7VI/rW0wvnEJ3gzE94e/ohol9orx:Ppn40+ZsvaTYbeO/VwP/zE99/ohM9Sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386359, "uuid": "b68a2f52-17f3-479f-a4fc-f19293318590", "value": 74724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386359, "uuid": "6bed3cbd-86bb-4e60-81b9-702be3b1820d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386359, "uuid": "1bb2f69a-431e-4800-8d84-b1f8fa72b786", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c60d2424-0363-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770386248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386248, "uuid": "fc4d20ad-7f16-428e-bba3-5d618a317c3d", "comment": "Malware payload (Gafgyt)", "value": "18d7838b4afff22bdc3ba7ff4e23626f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386248, "uuid": "eb4d0713-0ab6-4667-91fd-a49e9d0b0b9c", "comment": "Malware payload (Gafgyt)", "value": "ea4607df5ece1c539b4550699a31ada5dfa69cdf5e84dc6746c7a5c1ed1b62ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386248, "uuid": "170b93a6-9ca4-4799-9b67-66f8fc8f68ca", "comment": "Malware payload (Gafgyt)", "value": "9ed42adf7903279ec281022887717f5f6eea3c8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386248, "uuid": "8c024bf2-74ff-455f-8355-5d626af44d31", "comment": "Malware payload (Gafgyt)", "value": "3cc551dbb23a531d27fc49c8dceca6364b321b8ec2dcf1c86d479dc951b5095e444e22d148c73632f8276b78707ef0d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386248, "uuid": "a1a60180-3e9e-45f1-aade-2deef16a5dab", "value": "T146933B56A780D5B3D14305B316979B620033FE7B1A5EAE0AE35E7CF18F3A0987221B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386248, "uuid": "e9014112-b002-4389-9de4-b0ee375c4c97", "value": "1536:msqmQTbw7U+OU0Cf5UI8E8WwP6kHzgk81VwcG2emVGMUNLe5um7WAgcVjmZIcBI:msi2UVUtBUI8GwPfHkk8r/eLesmqAgcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386248, "uuid": "61798ac2-ddab-43f6-926d-9098d72e0d93", "value": 96268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386248, "uuid": "fd0a14bf-2ee8-4c66-9894-ef937a920567", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386248, "uuid": "5f2c6b92-3200-4c02-b382-fcc099e8921f", "value": "586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007675aa-0315-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770352416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352416, "uuid": "5d8dbb85-dad7-46ca-b249-3620a1cec29a", "comment": "Malware payload (Mirai)", "value": "fc65617c0ad31de96a73844623074591", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352416, "uuid": "88d8e9d9-6c03-4810-9aea-47b31374837e", "comment": "Malware payload (Mirai)", "value": "ec0668ab8d331c47249493c077273fa930b88a000f91af382e54bed9f75d0f21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352416, "uuid": "0457e473-b963-49f8-94ea-4bfd1edd05b2", "comment": "Malware payload (Mirai)", "value": "988959d3e903b71517b27eda7ddbc82131d5cde0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352416, "uuid": "36874b45-29ca-4651-9be6-e16b96bd5646", "comment": "Malware payload (Mirai)", "value": "ff5eb8217d4f97478948d62d96f447f852b5557f413ed5a2ba689fcf2700aad5627a66b7abc7d00a21e05aff36ff0547", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770352416, "uuid": "2062c4ae-1f9e-4ca1-b359-208985cc7f54", "value": "T18A330981B8818F25C5D413BEFA2D018D331367A8E3DFB2129D116F24778697B0E7BA56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770352416, "uuid": "9bd3fa9d-77e3-492e-9e34-50a6e5c448df", "value": "1536:UZnttHHhcJOEZBPpKGlJMY5OPhITiiKK9vTB:UHWJpLp9LKK9vT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770352416, "uuid": "563b1800-26c0-4eeb-98a3-d17560039167", "value": 51992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770352416, "uuid": "9d9b0b90-c87b-4b5a-a827-f7cd6c1dd410", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770352416, "uuid": "fb6374db-b3f9-40fb-8abf-fea79b22fd53", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e556f30f-02fa-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770341203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770341203, "uuid": "6eb445a1-5a16-45a5-a4ab-53fc80cb3ae9", "comment": "Malware payload (Mirai)", "value": "6debe21c8881eb16a7d14b1fdf779888", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770341203, "uuid": "b688f447-fd0d-4e69-affc-61799d818c72", "comment": "Malware payload (Mirai)", "value": "eccd5f1a4ee61cd60e8ecebdf5bcc33b2153b5d702feae4e2c13f252d09e74fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770341203, "uuid": "acb3fb14-c726-4468-b244-c09445fc06dc", "comment": "Malware payload (Mirai)", "value": "3225cc3ca9f73c8c7b79983e46d445325c76b016", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770341203, "uuid": "86528f66-9b8f-43ca-8567-e1f86f2c4496", "comment": "Malware payload (Mirai)", "value": "09e08ebd6b542cec6cf17ffcc799526d8a59bcab6340b0d1ed2e2dcb974e11b0d666f255da3041d2cbe08512b6d5bcab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770341203, "uuid": "2909ed29-d1dc-4f43-85fe-25f5b90b1ab4", "value": "T1A2C3B81A6E12CFBEF66A837447F34E21965877972AF1C581E16CEA401F502CD241FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770341203, "uuid": "3b1d4646-cba1-4178-90b5-b7b02b0cf2a5", "value": "1536:vFMfqlZxp/P41tTZHibJii0TRJwYmmi/+2jYj5gHYsIe3W63FLYBs:vvZT/Q1t0bgzRJnj2jY+BJFLEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770341203, "uuid": "660279f1-1c6d-4d14-8fc7-1b90117d57b6", "value": 122444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770341203, "uuid": "5d781b4d-6226-416c-9dc6-fe7b13e577a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770341203, "uuid": "b845bec1-b363-4780-870d-712b1f5c32f9", "value": "manji.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ba1590-0361-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770385434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385434, "uuid": "4aaff919-f769-4155-9928-e52837e93105", "comment": "Malware payload", "value": "d715f82e6d9e2ce196e2e9993cf7386b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385434, "uuid": "85991cde-6756-4b9a-ad91-6447836cda42", "comment": "Malware payload", "value": "ef11cd51b373ace721eb8c86a13db48146963ffe3425c7bff5b5da069b36e6f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385434, "uuid": "2994964e-4413-49f1-84eb-0fe11d6543dc", "comment": "Malware payload", "value": "d0abd810276f5167a12f2cf8aec60bf587ab5417", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770385434, "uuid": "5c48d705-153f-414e-8f7b-471d67435441", "comment": "Malware payload", "value": "e9256ca23a1e5035f5da46933e4b74d2448c83562844f571ea503eb963b2eec1676cf302dc8abc3127869bc02be49668", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770385434, "uuid": "a97aec8c-4b6f-4b9f-8c51-be07969e6a02", "value": "T1A3F51943AA9B0DEACDD667B461D71336A734FD708B295E3F6608CA341D536C0AD2EB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770385434, "uuid": "c26aa25b-3725-43e3-951f-0ecfe1db9e69", "value": "89afecaaf3115bc8adcef7be463979f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770385434, "uuid": "29a18c13-bcba-40b2-95a5-4f0913d36922", "value": "49152:PETvNtSoVCjlGdbtn5ipMsCrSLe0omsHL7KItmJya/vpTN9ZF3:82e5EpMsCrSLe0omsHL7KItmJyIN9ZF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770385434, "uuid": "3a290ad2-4257-4021-9893-08448d14a615", "value": 3329641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770385434, "uuid": "a92313ad-0490-4770-aea9-63a05628efda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770385434, "uuid": "603f9f0a-a273-4381-902f-1cdf12c2755c", "value": "WindowsUpdate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e2f2c7-03a5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770414641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770414641, "uuid": "389a9fb1-01fe-4734-9b6f-42baff9f8c0a", "comment": "Malware payload (Mirai)", "value": "c4afad56374da6ac27d592b5876a7b33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770414641, "uuid": "95b3af68-d699-442d-a9ff-a2fff0a4f4f3", "comment": "Malware payload (Mirai)", "value": "f06a167c8a02b1285d27f25dc4c090167b78ef193258959d35f231cbe69793ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770414641, "uuid": "18d0f5be-9482-4e9c-8a8a-8d6d56ecfdc6", "comment": "Malware payload (Mirai)", "value": "46beb59b101c3ee327fe22d152b4bc8c59a6f29b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770414641, "uuid": "52257dc1-1600-47c9-8832-208afc6c20b3", "comment": "Malware payload (Mirai)", "value": "9492f35467f127267173d888c0f1151d78388cffb454420e0ec032cd6f1e42ca7609c542fd358442e7e7d1f4a1c78a6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770414641, "uuid": "e9b52d67-9fd0-4a44-9e55-bd3c4138d359", "value": "T1A4A3B85D2E219FBCFBAC863447B74B20A69833DA3AE1C685D19DD6001F7024D745FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770414641, "uuid": "b73431ef-7f85-4e1b-8f4f-992dcd2210f0", "value": "3072:b8y5DLyyNJsrsRnFKszYMH47ctv25InAB0FfCLt:x5DL9nsr2DTectv254hit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770414641, "uuid": "df7d314a-7dcf-484a-a58f-2bdfa2d42ddd", "value": 105224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770414641, "uuid": "4cfb1d78-8ed8-4dd5-a23f-9840cf6aabfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770414641, "uuid": "9966cc36-849f-453f-8bf6-184f1e17001a", "value": "binary.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f991a70-0334-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770365782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770365782, "uuid": "1d452978-3ea2-48be-9679-1bd683a7563a", "comment": "Malware payload (AgentTesla)", "value": "ecb5592e7fe6f3f30114211bc99dba7c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770365782, "uuid": "c6444d3e-dfa8-451b-9b5f-8720920417f5", "comment": "Malware payload (AgentTesla)", "value": "f1202c9eb7f3e0a04c1edd0901c185ea998b55651528a4428622e5df5355f3fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770365782, "uuid": "30a42e0a-107b-47b9-bc58-404372376e20", "comment": "Malware payload (AgentTesla)", "value": "272a22b44f1a48b9515263477131680310bb9e91", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770365782, "uuid": "7ca9f2dc-3f0d-4985-917f-18b05e6a616a", "comment": "Malware payload (AgentTesla)", "value": "9232e0e9f81954c5c5ce48f5d51612ca47d3422859287455546c78f342cb65563642b3d94ba94258836db0c23e84f8b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770365782, "uuid": "f8a7a9f8-e028-4133-9f5c-cc42cd5cdfb4", "value": "T12C4517351AE7114F8B41CC9162F23ADA1D22A8F7B21A529C7614CADBC9DBF4D780C47E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770365782, "uuid": "57b6795d-9777-4643-88ad-753fa86837e1", "value": "768:Jnvszdf5I2sQIWgcjdQZ1WZiWmVugW1mVDqaAZj2tserPoxsVHnwK7q8xoBp1XLy:/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770365782, "uuid": "bae522ec-5b25-464e-b700-c7975f59d0cb", "value": 1166806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770365782, "uuid": "4e2b1839-8dc8-4941-9b72-0a34d86b2e0b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770365782, "uuid": "5bfd6151-6412-497e-a70e-f15dbba5983e", "value": "DOTX58902402586.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b658ac0-037f-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770398068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398068, "uuid": "846c0367-1d60-4508-bee9-240a0eafcd4f", "comment": "Malware payload (Gafgyt)", "value": "9ab82f9d7fd428819fbd766335b81cfc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398068, "uuid": "2e5ad64f-aae6-4a48-8043-fcb43ef1ddb4", "comment": "Malware payload (Gafgyt)", "value": "f2ba5744fa6342c8b6858a420efb06ca31e0126e82d574dcc4ed0f603e4e2066", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398068, "uuid": "cb39fefd-de78-4ab8-b03b-9cb8a4738aa8", "comment": "Malware payload (Gafgyt)", "value": "c07e9df870601ad0ad88baa87c4013e3a7a179c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770398068, "uuid": "f19083d0-c27d-423e-8df2-20605e652950", "comment": "Malware payload (Gafgyt)", "value": "8e49a2d78dc0900a40233e41214a43fa41418fe3b50f6588433b3bc5b8ca9c236d6b637106ae3b15c29715e6381c56fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770398068, "uuid": "4a61d934-64f1-4425-9da7-9d2e51470e96", "value": "T153B30805F9404B23C6D26BBBF79B438D77366658ABD7330196297EF02BC17982E3A150", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770398068, "uuid": "af32abac-7a24-4780-bf42-930b55ac7a0c", "value": "3072:VqDUOulvQ+nozmrCEJ0gtcbWI5h8CbH58bDoeCRl7YHQQ/hVOmAD3m:JJ0fWI5h8CbHH7YHQQ/hVOmAD3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770398068, "uuid": "91b394c3-c7d9-4ddb-8e59-35ccfe6fcf48", "value": 116040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770398068, "uuid": "f10e9719-22f0-4dba-8a37-6e15e4c0e453", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770398068, "uuid": "031544a6-4692-444a-a1ce-84da07624265", "value": "yakuza.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2227c6e-0363-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770386241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386241, "uuid": "651d3242-9aec-4313-8b50-64ea781aac08", "comment": "Malware payload (Gafgyt)", "value": "20f7727451bd5f8eb9602f7c875e767c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386241, "uuid": "e273094a-e94f-4e6b-8914-599bad53e222", "comment": "Malware payload (Gafgyt)", "value": "f2cf9f6287dd6d972a186a754a2f76435bb5d7cc18d3230052caab1820be8ef7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386241, "uuid": "8ea340ed-93d2-43a3-81c9-1754d8820fc4", "comment": "Malware payload (Gafgyt)", "value": "8b4fa009b25f1fc610426bd2f4f06968beeaf433", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386241, "uuid": "8e011353-b6ae-43ad-8bc5-ac45fb710193", "comment": "Malware payload (Gafgyt)", "value": "13dc88c3cf8d386a32d3e7121ed643827d55c27861100d94df210ce1d22db7fc8e86791e8167817a54f89bb5122c7ec3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386241, "uuid": "4228efd8-f795-4421-9ce7-d098e4d57e7f", "value": "T1BAE3866E3E21ABBEE16886310BF76F70C39529D636A19342E16CF7185EB124C1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386241, "uuid": "6e005e25-a8b9-43f2-bbbd-b043322484cc", "value": "1536:mVNs7K797V+nv57gbj6l6T6B6v6N6/6AePe1ebeZe5bwClA2rKQA1dXAQTI/e0h5:vY01ZkXAQT4Nk9//ImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386241, "uuid": "405f5aaa-3dc0-496d-a0b8-57a5f861857c", "value": 152121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386241, "uuid": "7e7e71fc-4d05-4d85-85b6-e98cc9e95379", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386241, "uuid": "bd46f991-432d-44fe-923e-449bf46fe575", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "002e308c-034f-11f1-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1770377326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770377326, "uuid": "e5238ef0-8398-49ec-bbe0-d218aa040130", "comment": "Malware payload (CobaltStrike)", "value": "5e3d7db2419fe56409c3a678137cff71", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770377326, "uuid": "df8bf963-be78-49b7-a0c1-45161e9d4e97", "comment": "Malware payload (CobaltStrike)", "value": "f2db3b97950873f2cf496bba7b50d63e5f734e9009ddd8bc70088a935f0a0357", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770377326, "uuid": "3a572363-b664-49f6-839e-faea06346dd0", "comment": "Malware payload (CobaltStrike)", "value": "1b35706ac13921714448f07592e67f063dd9270e", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770377326, "uuid": "16785ffc-f0e4-4ec1-8fcc-e171e5484142", "comment": "Malware payload (CobaltStrike)", "value": "ce4ddca542321450a5967502acd1bfe4ebfdbee66447a96d36aa48c97b9bc232b1d1e45de3f007914c85d8f52a042477", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770377326, "uuid": "6005f63b-f827-4da7-9243-dcb7cff9f86b", "value": "T1B6A23A059A5604F8DB5FD27FC8725237A5F2752443228E8F0B5DCA1D1E32391AD3FA09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770377326, "uuid": "c4f82762-39e4-4b41-bd92-5e18b5e7468f", "value": "45abe91b6aab4866f67cd1a20118f63a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770377326, "uuid": "365bea3a-a64c-409c-8952-67ce52586073", "value": "384:ibNeEfFVaBXJuNFRA97ZliT452IK46BQ33gAlKWBk:i0KFVaB8ND74Eo3wAlKWBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770377326, "uuid": "6e0d90ad-8e15-449f-a52f-db15a2ca5574", "value": 22016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770377326, "uuid": "d54c1af4-0bd9-42ee-bc1c-01c5f6be754a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770377326, "uuid": "3ef66f6c-1093-4704-9267-2f672668129b", "value": "Project1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187ae3a1-0365-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1770386816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386816, "uuid": "033df94f-9d63-4311-8201-9c3186bedac5", "comment": "Malware payload (ValleyRAT)", "value": "950ff528de61de0c950606d52d8b6c73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostRat", "colour": "#66C979", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/GhostRat.CKD!MTB", "colour": "#C28566", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386816, "uuid": "6dc0c9ac-e260-476c-a4aa-d453913243d2", "comment": "Malware payload (ValleyRAT)", "value": "f4541e8a44142832d5ad0897a22d88d0caab4ffc0179026906e9f19c3dbcffcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostRat", "colour": "#66C979", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/GhostRat.CKD!MTB", "colour": "#C28566", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386816, "uuid": "77499dd5-7d59-4e21-9520-53fbea829ba5", "comment": "Malware payload (ValleyRAT)", "value": "e41c42a0adf9576c87b572bdb22800d3c5799d6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostRat", "colour": "#66C979", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/GhostRat.CKD!MTB", "colour": "#C28566", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770386816, "uuid": "0df936b1-b2b6-4272-bdba-58d8092e6964", "comment": "Malware payload (ValleyRAT)", "value": "64dc3371e126a04131a9d5a99f14ab4308bbcde92fbe3e5e5b4ce0994bbd3f22c4176959355538274e4f5d2dbd5968a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostRat", "colour": "#66C979", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/GhostRat.CKD!MTB", "colour": "#C28566", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386816, "uuid": "ba28377d-e923-4634-9689-d039400ea37b", "value": "T1C8F38E4737A450F9D4A78235C9A29B46E773B466073197CF17A086AA2F237D0BE39331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386816, "uuid": "9f634c69-0f4b-4f55-855c-4e806f387345", "value": "fb51ede541a9ad63bf23d302e319d2a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386816, "uuid": "af2a7fda-a018-4bd1-8572-5ae683caefed", "value": "3072:JO55k/y5dAj+BMTYlgEQnB+Y+pek7+3OrFZeUqe6oQEVwNTm92Z2Stc:JO5n5d56TYZQnB+DpekyyqmCTSZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770386816, "uuid": "9f7d5328-3440-422c-af92-98712ff4d0ea", "value": 171640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770386816, "uuid": "82924a31-c145-4d11-803a-50fa99ebd9f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770386816, "uuid": "b71623cc-fb87-406f-92cc-8a0a95c8be03", "value": "explorer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6467c07-037e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770397898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770397898, "uuid": "1e0ebf14-18c2-4ab3-9d8b-70bb47ce6a87", "comment": "Malware payload", "value": "c67707e7fcd64074d19ff06f7a47c0bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770397898, "uuid": "55e780a3-91ca-48cf-97ae-10bc9a7be627", "comment": "Malware payload", "value": "f6b7e5460cb547d061b5d7d1b9df3539dcd88bcf3b13337f9885f861fc29052d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770397898, "uuid": "0a1ceda0-b00b-4214-a1b8-5ba5d1053c38", "comment": "Malware payload", "value": "df87c66cde685e24ffe3d83b5cbb475016e16e0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770397898, "uuid": "a51d6cf1-f59a-4897-a1f4-e6b3783aff93", "comment": "Malware payload", "value": "c249fc41e5ab246d3539e23de23d6e898a43586449c24b679a1443dd355a53ee1b0bb0a33f9b4a884fc2a63838a02538", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770397898, "uuid": "809d4bf1-1867-48d2-bd85-79f821cdcd8e", "value": "T1FE1733CEF39904EEE0EDC63D90D68A169AA378D36765828F07F50A054DA35C5EF39B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770397898, "uuid": "04416b46-e6dc-431b-a10e-595ea47e4815", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770397898, "uuid": "d9bb53f0-b281-4773-99e1-dd34e73c4d76", "value": "393216:lFxf76mwlf3ozjkCUW8J/1+TtIiFw/MaC2Ro3FBSU1:l/lwlPozBUW8J/1QtI7/k2KVBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770397898, "uuid": "294a2bdc-7b2c-49ba-94e2-eb478a944a95", "value": 19672044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770397898, "uuid": "50bbe0eb-925d-4b8d-8937-86461511bbf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770397898, "uuid": "dfc360d8-1410-4292-9e29-82372e8a1501", "value": "QuickDupe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e816ad0-0359-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770381645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770381645, "uuid": "ac1bd427-7d03-4e15-afba-ebfb4832f862", "comment": "Malware payload (Mirai)", "value": "d0b0366a2fdea44894f594ef84aa94c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770381645, "uuid": "d05014d0-1278-401b-aaf6-5fd0d0ce7744", "comment": "Malware payload (Mirai)", "value": "f74659b693b12c1653f8cdbce9625c6a6700b32eac4e1902c025d0092957a3b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770381645, "uuid": "59573b6a-6992-435d-8d5d-0663695f79eb", "comment": "Malware payload (Mirai)", "value": "0a9bffee97c27f525991e0b7d253e4580dfcda7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770381645, "uuid": "6a4eff94-d5bc-4c83-8d9d-c1cdb8eaf3d3", "comment": "Malware payload (Mirai)", "value": "1d94d1678098b996bb100286b55d8901467de5148ab01022cb5bed2350c9a1ea48ac4c79d2f896b6b484c7129c3bd087", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770381645, "uuid": "93ed4c6d-bf92-4816-b860-28263bc02a09", "value": "T15D13E68578D2DA5ACAD053BBFE0E418D331567D8E2DE3213DD252F503BCA52F096B161", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770381645, "uuid": "6b44b5e9-67d5-4572-9b9c-24e77a3f235d", "value": "768:vRbJ1H51zUeb+qangTuOHwIrz8E2J4SyQ8spAn4hUWDz/b1cJl9iUjRur8F7iIja:pbJBzPSFXn2rHPsLP/b1cJlvFNXjJEjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770381645, "uuid": "f6ebe8b3-4210-4277-8a71-e344d40fdf88", "value": 45433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770381645, "uuid": "d0c35349-7e20-430c-b249-b7b3b0b91b72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770381645, "uuid": "3b1ebe1c-1235-494a-80b9-b8ac56ee7907", "value": "Hilix.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a136a7-0386-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770401031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401031, "uuid": "76e22245-f271-406f-9563-5f606d4d9f99", "comment": "Malware payload (Mirai)", "value": "798f01faf3431bab6db275a8b2b676bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401031, "uuid": "9ed67039-ce57-49a1-a3a3-ec75ecdc82e5", "comment": "Malware payload (Mirai)", "value": "f7f1fe7955d25ac8c44ae66aa20f6da36bd6eed17eae31f13ce919335ff18c54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401031, "uuid": "ca2236cc-203b-4a7b-a3ed-6daa924cabeb", "comment": "Malware payload (Mirai)", "value": "6ba1097cc92635bce9f4b6fb68c53b22233f6816", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401031, "uuid": "8b24a73b-ec1a-4f6b-9dbf-8fe852a9ab0e", "comment": "Malware payload (Mirai)", "value": "bffddae05c8d4e52a8811a86231519e186e65eff1e844b40752b3923154aa6eb88faefd5dc861be913477e801308b02c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401031, "uuid": "f651960b-5e99-41d0-98a9-1b17db829efd", "value": "T192E34A06731C0E47D1632EF43A3F27E1C3EF9A9224E4F644645FAA8A9271D361586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401031, "uuid": "881e9d38-e278-4bd6-8274-d7da1a676b6a", "value": "1536:4ET75Xl1eURZlKbsIH7xsUptBJ+zbo2B46+A79iauTvAXhkrb9u6qfsqXSR6eTPZ:4ETNTL6xiodA4aTRCPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770401031, "uuid": "6001291f-bfc7-479e-893b-17b119db1ea8", "value": 154600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770401031, "uuid": "6c0fc608-8c36-4d4c-8ac2-fd287377e17b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401031, "uuid": "ae907f85-e9ac-4b02-b2f5-f0e903266383", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff087146-0314-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770352413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352413, "uuid": "3f519eea-9ae7-42a3-a647-b69586d57a2e", "comment": "Malware payload (Mirai)", "value": "96376e99f33651e0872e4a2e0dcf2bb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352413, "uuid": "3596ed49-568a-4e72-b932-0dea4cc38a6f", "comment": "Malware payload (Mirai)", "value": "f7ff0cb10d354ecba4a76735883157faec56328a102de87521b737c3684b8536", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352413, "uuid": "3411cc4f-b1df-49ab-8d22-9bd6529b6630", "comment": "Malware payload (Mirai)", "value": "4a5acae975d935474d293262ea509c4fd5135d81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352413, "uuid": "98000b7b-f23a-4292-9640-6200b214d4cb", "comment": "Malware payload (Mirai)", "value": "d5cd58bb63cd8d98cfbdcea963b88bc5c35226cb76f53535ceb0628ed8590663635416ddbd1ef49e2441e6e061fa71a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770352413, "uuid": "d98724be-b274-40db-87b5-b9efed1ac7f0", "value": "T14A133B31AA761F1BC0D0A8FA61F74728B2F1465E25E8CA4E7D730E4EFF6184455132B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770352413, "uuid": "65698f40-7802-4af1-88bf-92c36355bf93", "value": "768:X3oPvWIdAovK4pt3fYoDsPTYW9QgnO++mUKhrC:X3QWYARy3fYogPT99Qg7+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770352413, "uuid": "9fa08373-adb2-40a4-88cd-e937bd9ac314", "value": 44116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770352413, "uuid": "f3e8b50e-7828-4d2a-bfb0-97a03950c743", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770352413, "uuid": "5a3cc708-9439-4cc9-99d7-a27debed18a7", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb314f3-03a3-11f1-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1770413827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770413827, "uuid": "10e2ace5-3c95-4e0e-b070-99e52bffbdbb", "comment": "Malware payload (njrat)", "value": "5c2fc067a621520684b39802c9900ee8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770413827, "uuid": "652c3004-1f17-4aa1-a58b-4da257ef3369", "comment": "Malware payload (njrat)", "value": "f835e92eb109331beb56cd269bd2f6cc7998cee93511c3fe2976fe29005dc2c2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770413827, "uuid": "79c0db18-7255-492a-a1e9-0470bc6d12f4", "comment": "Malware payload (njrat)", "value": "85d0ce793229e793d88b82f16f835c922d14af06", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770413827, "uuid": "773f6872-a87d-457a-bc65-e23e60bb0fcc", "comment": "Malware payload (njrat)", "value": "5cd544999175de646d1eafc01af4a348d2a0444e90c72999f197eba6c34f6b57117dd5c5aaacdf14e305d76c2b6a422a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770413827, "uuid": "5c232cca-0f00-49e5-ab4e-9a108d25592f", "value": "T1083523119EA5BDB9E93B983D77634D223B2272067C762315EF90FE0529E4AD8913C7C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770413827, "uuid": "6ef4e512-69de-4a47-9ec2-8ed7f980c5ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770413827, "uuid": "26d52933-12cd-427a-a500-144cc6c50f53", "value": "24576:qGdRy0CdkC2b6LSE2p6cCfJfS0JrvFJlj2O:qGLoyC2b6LSCD1F3j2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770413827, "uuid": "3eab8fb4-2f7d-45b1-b08b-faa1140e0974", "value": 1083392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770413827, "uuid": "6b87fa55-9dba-421f-8321-bafacec125d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770413827, "uuid": "cfd832c6-c9ae-4a32-b459-e6e415805ac4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c953dc-0315-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770352420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352420, "uuid": "34c70676-783c-41f5-becf-d9af7a0ee21b", "comment": "Malware payload", "value": "ad065071f8f4b6e0a78e6b54ff5cc031", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352420, "uuid": "46260630-b70b-4c9e-b6b1-d5b2904af66e", "comment": "Malware payload", "value": "f83db9f2b72bea56b76acb3808e96329e805e972d4b02d602c0689168467a7d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352420, "uuid": "d3641222-34c5-48be-8bd7-1f5c8eb37803", "comment": "Malware payload", "value": "92ce8111f32827468744ffa8d06653753cd554f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770352420, "uuid": "c2f666ca-b8e9-43c0-874b-ba2e14db206b", "comment": "Malware payload", "value": "ef48307a738439036ab3e35ad2c7b60c8ef1898240c139bcff30b8bf243c82eea5da7a4319c7699f9059a2170a17dd16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770352420, "uuid": "1a8b312e-f2be-4981-bb2e-f29b753514fd", "value": "T1C6031C42722C0E17D4B25AB4293E56D083FEBA9020F4F689655F5B9B8B35E3640C2FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770352420, "uuid": "66f8c130-6b4c-4270-9278-acc4c458119a", "value": "768:mNspAj5uSR1gRhWRInXJZTSZOSczF02qSBIqLpHm:Es2I+YZmuqSB5L1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770352420, "uuid": "0ee2b6b8-40ce-4d4c-a038-58f31af523a5", "value": 38084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770352420, "uuid": "d22a7f71-fa77-4379-a170-b4f93842c9de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770352420, "uuid": "a1bfcf29-6ef3-4621-83e9-ffc4a4e9c715", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b295311-0386-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770401047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401047, "uuid": "fec0e711-6432-4328-b984-17b7d45e7320", "comment": "Malware payload (Gafgyt)", "value": "feedddb1c9de359104f433be98e6cad5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401047, "uuid": "a741c596-0e6f-40ce-9e85-0d4bee60f966", "comment": "Malware payload (Gafgyt)", "value": "fc306d13987da53e3359c2a823dd5c629fb04f7969937afb6c482d58f6a13166", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401047, "uuid": "17ecd95c-d4b3-4c87-b5bc-9d96a4c394c1", "comment": "Malware payload (Gafgyt)", "value": "9786e39088a956faec1f6859bdd79bfbe23b8100", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770401047, "uuid": "35367b5c-d54d-4bd9-976c-905a164a5ae2", "comment": "Malware payload (Gafgyt)", "value": "73248e4c982067b93a7ab73472f82a0aa9709d02694ee7e25f4ea58e3c0738da531d8627d54b90923d167053a3025ec7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401047, "uuid": "5848f227-34a3-43a7-90fc-3fb92e63d57f", "value": "T15C834A829641DAB3D1931AF512AB9B150132FA3F1E1BDEA2F31C3CF08F125857265BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401047, "uuid": "cb85c6ce-cc51-43f1-af3a-cd6aaf4c48f5", "value": "1536:T4bEkXUgMcRUz1OfbIYpIOvXceEQ9E3+MKA3+5hCK4+7she0QzUzJYQ2Wk:MbTUg5UBOjINOvseE6E31a5hCw7Ue0Ql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770401047, "uuid": "46fe8422-2cd7-410d-9323-ab8447db52ac", "value": 87860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770401047, "uuid": "2e42c022-2f08-4a73-8d08-26de5c959279", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770401047, "uuid": "7fd97cbd-3104-4805-be05-601c08e1cfba", "value": "yakuza.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60332f67-0390-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770405404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770405404, "uuid": "4a52906a-e5d5-47ba-b32b-e85bf60a9bca", "comment": "Malware payload", "value": "8cb837654b3a9d0b89fbc2268b401cca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770405404, "uuid": "1e8a6172-25ae-4a2a-98f8-bfceaa4ed291", "comment": "Malware payload", "value": "fe4e5fb28d2c2b3a640112b6b125ce8c4afa8be28342e3bfda097ad9dd2ef9ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770405404, "uuid": "a8b0191a-42b6-4aa8-a728-c4de4939da27", "comment": "Malware payload", "value": "40403cfc76d6016c35e75ff7c2a4244c5b3d2df1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770405404, "uuid": "58dce03a-63b3-42c8-bfb9-ad1e7944a3cd", "comment": "Malware payload", "value": "d9f7147d83675b78a5b0205bdf5a284867116b0d1f6dc1536a5d01533074f78a0b5cf21680746e99cc7704175c2a56a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770405404, "uuid": "07eb1b4c-f75f-4035-b322-43e7164a106e", "value": "T172D5E11BE3A800FCD0B3C3B5CE429A13EBB2B8055634A69F57D58E962F137615A3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770405404, "uuid": "65dd55fe-1f92-45c3-a0e5-9bf23bc91f4b", "value": "be15b07624586215d0bad5ea251755dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770405404, "uuid": "1c4b60e1-025f-4447-9a1f-36dbd7f41903", "value": "49152:/G6fFvymYFZLYCBegkCsvLLHkSrgKgA97AlaoSsMZyUZ77O:/GYoECBWo4oSfyUpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770405404, "uuid": "a30756c7-b537-4840-a2ba-b5b21e797afc", "value": 2880000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770405404, "uuid": "2b7fd86e-943d-485b-ac1b-88be9cc70621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770405404, "uuid": "9e852f1a-78ee-47ec-94b0-5d3cc4b74e86", "value": "chromelevator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a807a9a-0352-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770378712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770378712, "uuid": "58ff8b71-a1aa-42a7-b85e-b861a33d3e0f", "comment": "Malware payload", "value": "8ebbed8b95fba632be8374c753767622", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770378712, "uuid": "a9db9929-02a2-4b2f-acc0-4b73f3c4f12e", "comment": "Malware payload", "value": "fef611ec877bebdb9b9a5b454b23dc5b9d0e3cbcd8743501392f71c5e6d2b661", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770378712, "uuid": "ee6ab44e-1fd1-4e7f-94ab-a2dafb846289", "comment": "Malware payload", "value": "afd4122b722bb84668434869ba514232b41f8e8d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770378712, "uuid": "f3bba6ae-eae1-4b62-9969-23ee370b031c", "comment": "Malware payload", "value": "d755b8f8424b11912236a147d820aab071e199cf4b5089f974e514d22ac75ef24f7c2147cfd90fe5b19abc31008430ca", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770378712, "uuid": "3d47d738-e28f-4d08-8627-dc7177515fc7", "value": "T146C6225AF32CA02FD97B543349B6122102570D478E83AB93BA19724D29FB6C84F5EFC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770378712, "uuid": "99de64f1-2a30-4c8f-8f51-ea7eb9838bae", "value": "196608:Giz9af5CxnXKq0Pv5lI+A5RNG49SjVFDAk6fKDsnYeIaZcg/P7nC9zu:daf+nl0Pv5WAQSjrDu+s+gu9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770378712, "uuid": "aa7efd60-f08c-42b8-b5f5-b637a33f518b", "value": 11598471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770378712, "uuid": "fdef60d3-dd31-47d5-a2ea-a15dc3d46e69", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770378712, "uuid": "9fa00433-3136-4b9f-8705-5c415e9d9696", "value": "Smart Cleaner_1.0.3.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e48acb28-034f-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770377709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770377709, "uuid": "9abb7cba-c9be-4900-a0b4-1e8064614c16", "comment": "Malware payload (AsyncRAT)", "value": "469f0ca7b6dc25033533f569ba82ab8b", "object_relation": "md5", "Tag": [ { "name": "anarchyrat", "colour": "#992565", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770377709, "uuid": "f49b0c96-dac0-436a-a8eb-60bf7e613ad8", "comment": "Malware payload (AsyncRAT)", "value": "ffa91995a8c70fa9cc940ec15df0308c3a2d592014636e7ed6bf799f15213fd5", "object_relation": "sha256", "Tag": [ { "name": "anarchyrat", "colour": "#992565", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770377709, "uuid": "8f987c16-e8f7-4d38-ae95-17bdbfa5b97b", "comment": "Malware payload (AsyncRAT)", "value": "e74705c1fd0f5e0e683c0d8466c779d0ee8d4ce1", "object_relation": "sha1", "Tag": [ { "name": "anarchyrat", "colour": "#992565", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770377709, "uuid": "2e5f0773-32c3-4d85-97a7-5e5f33d44a41", "comment": "Malware payload (AsyncRAT)", "value": "7517fa1e30b4578c9d69d91a633a88b6acfa48379b3df90e2a31be9b3ddb32bba502ee5e3a3b767bfe8e715ce2028ef2", "object_relation": "sha3-384", "Tag": [ { "name": "anarchyrat", "colour": "#992565", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770377709, "uuid": "71ac91e6-0810-4ca5-a505-a515b9fcee14", "value": "T14F93AE002B98C9A5E1BE4EB4ACF2560106B1D57B2102DB5E7CC811DB679EFC586227FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770377709, "uuid": "985379f2-dbb2-4c34-85c5-264e27dfffa1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770377709, "uuid": "662425bf-6ce6-40b0-bef6-70e3031132ec", "value": "1536:wkZECGpDMfq+fbbSElsurGiuQpPCCAf3HCVclN:wXCIDufbbSk1d9CCo3HgY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770377709, "uuid": "34dad0a6-a08c-4bd8-83bc-bb3e9bcb34fa", "value": 91648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770377709, "uuid": "658345cc-63bc-461a-ab1e-57a97e905e97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770377709, "uuid": "df142390-d472-4769-ab09-c6adff0a4266", "value": "ffa91995a8c70fa9cc940ec15df0308c3a2d592014636e7ed6bf799f15213fd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }