{ "Event": { "published": true, "date": "2026-02-28", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-02-28", "timestamp": 1772323382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "b12ca26c-46da-4201-a27f-bb6e13341d16", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dbbf26f-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772289280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289280, "uuid": "a4f43831-a482-4816-abdc-4c133994c6e0", "comment": "Malware payload (Mirai)", "value": "6a8a1b94352940ee975a155a04d9e146", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289280, "uuid": "fc83fcc4-a48d-46db-ada9-3e5038a05e56", "comment": "Malware payload (Mirai)", "value": "000b1197a20fda86baf2ce46256e042b2ab7c97d2123bfcd75bdc6a7ccc42028", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289280, "uuid": "874bf600-fe18-47b8-bc81-0d9e8867569b", "comment": "Malware payload (Mirai)", "value": "6c3e852ca250e5169452691e2ff59664e7588a0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289280, "uuid": "1a1d7475-9067-4664-8c10-2546213f9ecb", "comment": "Malware payload (Mirai)", "value": "7bdf47307f1c9a5f28ee97f3eb54c26ff7b33ad87fdb2ce284b1fd0a74be2e57dead7e61bcd1d77463ace0d61298253c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289280, "uuid": "1cbb2157-58aa-42f2-a06c-abbcc562845c", "value": "T19E8328C1BA8BC4F6D80748304067F33FCB32E5394066D75DEF6A9E26DA376416B16289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289280, "uuid": "bb1bdde3-83de-470a-85d9-d25362bc975b", "value": "1536:xp8qEknpXLVUkU6nW4SIWJawNK2oXcKQW2E/I9x:hEkp7VUt6n6ouK7XXQZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289280, "uuid": "8bf6d62f-7bd5-4882-81e9-a9aa908a5b5f", "value": 83600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289280, "uuid": "38094873-9879-4721-9666-58101388a620", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289280, "uuid": "7e8e40f7-cdec-436e-b532-4cbb77970e46", "value": "nwfaiehg4ewijfgriehgirehaughrarg.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0683f1aa-149c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772279578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772279578, "uuid": "f68b89c9-44a4-47bc-b3f4-3af3382993d0", "comment": "Malware payload (Mirai)", "value": "aab99c4efe8cbdcb3f7c440e9413afa2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772279578, "uuid": "f74415c9-89a9-4d62-bba5-a8aeb85d98d5", "comment": "Malware payload (Mirai)", "value": "0028541b6b0285ef58de8783b7b00c0b5bfb1242e48ff27625d22ca4fe05bb76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772279578, "uuid": "fff745a6-0212-40b4-92c9-cb47abac3605", "comment": "Malware payload (Mirai)", "value": "6052c49ecf9b51c4e7b1a2279ac2b4dba0cd65c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772279578, "uuid": "7e1bdf64-cb37-45bb-b22a-b10944f7a4e5", "comment": "Malware payload (Mirai)", "value": "366a2d443e0e47ebcea6726e9027a80f02429353723f6e0c248626427ca13540fe34d85bf291b296763b3b5894357071", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772279578, "uuid": "089333e9-e252-4a18-b91d-1ecc358f95c1", "value": "T13CE31A45F8505B23C6D612BBFB5E428D372A17E8D3EF720399216F25378686B0E37642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772279578, "uuid": "a2261460-80c6-417f-9127-946550439312", "value": "3072:3ITEs7uRKpUlWnF46r/b9l5n5CYp7G7Wz:3ITyRU66F46Tb9Hn5zNVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772279578, "uuid": "bfe7ed8a-afd8-49a6-a2aa-3c3b27ff105d", "value": 146208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772279578, "uuid": "734707a6-8d22-4ff7-9f26-eb79c6f2803c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772279578, "uuid": "7c19055f-dd66-4d98-ba0f-3a07d1c44fe6", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f19bca55-14e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772312184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312184, "uuid": "824510ef-6095-4d7b-9f7e-fcadcdb621e8", "comment": "Malware payload (Mirai)", "value": "295572653dfafe81f0bb3aa736162f5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312184, "uuid": "241d2719-6311-4700-bbaf-aa51d9968e45", "comment": "Malware payload (Mirai)", "value": "00993b24466a8ed1bc543d86a6dffb6f0e30a395a3555fc394418c9f12217f8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312184, "uuid": "6644a3ab-395e-4a95-ab08-81e2526e1542", "comment": "Malware payload (Mirai)", "value": "4319617671d718b918458c19eb04b37659b6f1cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312184, "uuid": "08c12306-5bd4-407a-a160-8532bd88eefc", "comment": "Malware payload (Mirai)", "value": "9698881757a4eab6e332d5a186dc2bbed7338673853a3f9c56a2011efd8da964e306f6dbf7cd358f68390b1a5d64343b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312184, "uuid": "64e3e333-f112-49dc-94a5-36915bfdfcc3", "value": "T146639D71C6A62D90C4808974B7B8CE7513A3D904D19BBFF64657C669A017EECB20A3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312184, "uuid": "c4ca0da3-04e5-47f9-8539-280b185315b6", "value": "1536:javugNNVFF2m2iPCM+TleTTKJZgcwWgrC83fDSc:jUNV3LYMTWJmWgrLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772312184, "uuid": "fd56add9-1f74-4d30-a1a0-810af4b622b7", "value": 71160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772312184, "uuid": "140200fa-141c-4f95-a8b3-59128be8b8c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312184, "uuid": "4390dac6-e553-4412-8589-f0709637dc50", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "182744ed-144a-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772244389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244389, "uuid": "5ea9a840-7f52-44a2-a4db-c359228864bc", "comment": "Malware payload (AsyncRAT)", "value": "d8dcf08a1825ad4b3b45860f9849288f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244389, "uuid": "42a3d829-a0bc-424c-b2e6-31595f9fe441", "comment": "Malware payload (AsyncRAT)", "value": "00d03d0cec73743249e196752c767972467a1fab87198bf6b386143fd3bfa212", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244389, "uuid": "a29835d3-bf1e-49c7-bef4-8c9fe70b9d45", "comment": "Malware payload (AsyncRAT)", "value": "4d240b52705be3f6e03d411422fb926f219eedd8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244389, "uuid": "2be2c57c-61be-4196-9d22-bf4b8786eb68", "comment": "Malware payload (AsyncRAT)", "value": "5c44dc2e80ee036045d72d075dcdeb446b7a809e2559b8259bb49f461e13a1e3f05c10ad5755d553eef47b9d711a7271", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244389, "uuid": "9a096aef-fc6f-41d5-a902-efa64648cf50", "value": "T104231A003BE98126E2BE5FB89DF1614187BAE6633603D65E3CC941D74B137C6CA41AF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244389, "uuid": "34ea779b-cf19-456e-88c9-82ddd0bac8d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244389, "uuid": "1d4f5064-cd13-4a39-9663-6fb6c76755dd", "value": "768:5q7T1bXgg4yox4kOicvHk3eHlWMPbPgF0qE6enX5L6nAJGYI6OCrZtYcFmVc6K:5B76XvZH0ub4FrElJL6nB6OqZmVcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772244389, "uuid": "881e548f-ab86-4bd6-a862-39937d970226", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772244389, "uuid": "7d2569d7-076a-4523-a6ee-4fbbb963f4b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244389, "uuid": "d018403d-2ebc-4ad3-a8f9-a0a4e0530512", "value": "00d03d0cec73743249e196752c767972467a1fab87198bf6b386143fd3bfa212.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef89cd30-148f-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772274385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274385, "uuid": "423542df-5604-4c06-8a5a-744883bc558c", "comment": "Malware payload (PhantomStealer)", "value": "203786d30cdffed3f0148e433cb5f29a", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274385, "uuid": "ecc61325-9a23-4763-ab3d-23759a4ebffd", "comment": "Malware payload (PhantomStealer)", "value": "014e34604297b7492f23012b7316d44bd7f107a3d440ae44f659fc6e8f932799", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274385, "uuid": "7673d479-570e-4093-81ea-cfbe79872ca2", "comment": "Malware payload (PhantomStealer)", "value": "5d9e3d12aadce9a4410c0135d930b7ba8f18ad19", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274385, "uuid": "2d4c52ac-19b3-4c50-9e1b-8288822152a6", "comment": "Malware payload (PhantomStealer)", "value": "45f19efe54582ac2092c8abfc07563db1d0f2da092b207b32bb6c7ddb6c8e1193bdc12afbc5e45c67f5464de0f5e8f2f", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274385, "uuid": "467d3a58-73b3-4eb7-8f2b-9667692e5647", "value": "T18326D1A803CA0FBC5EA85C3D50FD48CD297307744567B8A2B7D2B93879DBA41894F267", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274385, "uuid": "230b1804-d0ac-4a35-ad52-4fd73a9897b9", "value": "49152:4gkBVMMVDkudkGcsS/PzgU7vEMMRvCtyiTKpgxGIAyaBCGAbfqu/ok6m/uGTTX9A:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772274385, "uuid": "da642571-e656-4906-a121-bc1415cc2a06", "value": 4591581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772274385, "uuid": "97e09aef-5f66-48b6-965b-a732dd6e118a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274385, "uuid": "e24fc57e-b59f-481e-8a31-abe294bf0f3d", "value": "203786d30cdffed3f0148e433cb5f29a.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f17ee49-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772289283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289283, "uuid": "5d2753ba-c049-47c3-972b-48ac0db3dd4a", "comment": "Malware payload (Mirai)", "value": "9650ca9674e76440403600c5b928b9f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289283, "uuid": "4a1067a7-c68b-4862-b4e7-5e7b7fa72268", "comment": "Malware payload (Mirai)", "value": "016c9737a74547a5977e46165342a369779c8a7d962b1272b8757465342567fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289283, "uuid": "86370dbe-ff3e-4e4d-90a8-3f2b200f9aa7", "comment": "Malware payload (Mirai)", "value": "5ac5d77bd0d1b0a4917a839de8553faf2cbd2bdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289283, "uuid": "6128bea4-b8be-4e4b-824f-96ef4cd2df9a", "comment": "Malware payload (Mirai)", "value": "621c330d3747c5f4956f8137568d93103591b18f4c5d179c5e08809f91b2d0a06803b56ca93381152438845541e28b0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289283, "uuid": "6945073b-f29e-4dff-b00a-35f78a6e4129", "value": "T16E933A55FD819A12C6C112B7FB6E428D372713A8E2FE3203AD255F21338B96B0E7B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289283, "uuid": "d58b305e-142d-459c-875d-1678410f2cac", "value": "1536:tjVGOhJxToZRpmAFL8k1gqlAho0coDbJe7oIwst0vWvMBE:tjgOhJxTo98kCqlAho0coY7RTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289283, "uuid": "8b17c1b6-e6ec-4afb-84cc-ecb48cda94d7", "value": 91948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289283, "uuid": "977c43db-6403-40dd-ac4b-13b600a58445", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289283, "uuid": "bbf20f10-b478-4b95-8c9a-685a0caac083", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91414eb5-14a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772285394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772285394, "uuid": "c94e3f61-65fb-4082-8e25-141b25835380", "comment": "Malware payload (Mirai)", "value": "0c174a34d2c1bd9c5941da2e7c4e3292", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772285394, "uuid": "97777977-edab-489a-a200-ccc7542ceb45", "comment": "Malware payload (Mirai)", "value": "01b064d7885a173901721afbfa805c4677a0c8326c2be1a3e4e1eaefecb5ddac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772285394, "uuid": "597b1f2b-fd52-41b4-bf95-2a32df340da5", "comment": "Malware payload (Mirai)", "value": "5a7e3d49b824d00c42c9f20ca4e941e404346b99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772285394, "uuid": "83bac99a-1ff4-48c6-9195-0f3c086a4486", "comment": "Malware payload (Mirai)", "value": "af0ca5ba8973ccdfbda088359405b57c03dcd09080ea54f8a19c73598b9fa9d119a08ff5b419d1bc6caf6cdbbd988fb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772285394, "uuid": "3d53ef5c-2ea7-4da6-83a8-b8299273d1f1", "value": "T17B142A46EA404B13C4D627B9F6DF42463333979493E773069528AFB43F8679E4F12A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772285394, "uuid": "4d5e08a9-7a8d-46a2-a78f-a53355260f5b", "value": "6144:2R1aIBqbNragXnDWS24eLlBOIA0rM/RuRw:o1atbNraInDWS2DFA0A/cW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772285394, "uuid": "2f5d1562-0be8-44a8-97df-7f0cc4a245cd", "value": 198026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772285394, "uuid": "6a95ca13-3511-470e-b649-d3b2d38214f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772285394, "uuid": "7b41f1de-4e34-402f-b635-f9b1e07cd2b1", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d9bd79-144d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772245645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245645, "uuid": "8b4c7f18-7abb-45f5-a81c-153e6c6c69ca", "comment": "Malware payload (Mirai)", "value": "decbf9ab259031ae61d751bb8aec915c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245645, "uuid": "7aa5895b-4e78-4aa6-8fec-b5121632bf33", "comment": "Malware payload (Mirai)", "value": "01fcc722be6e6233cc7da2fb3c0fafc9cc74b86a6cc9d680a2ca17f556d88db8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245645, "uuid": "ef9c2b36-2bca-47c5-9819-d8bb6797102e", "comment": "Malware payload (Mirai)", "value": "2a98f79d218b337a9ffd3b3c7bc9126139287e0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245645, "uuid": "f1db26d6-f135-48de-9c46-5d2adce3a600", "comment": "Malware payload (Mirai)", "value": "060209aad541cb29bdc51cdea0ca8f339db1d287a57f26cbfe157a890f325b9801b8b7799f5f487b2f53377f7c476fa2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772245645, "uuid": "77c19212-6181-4c61-8af0-279e0730dfb6", "value": "T1A6D34A2275391E2BC4D0A87E22F74361F1F167DA25A8C90E7EB20D4FFF252206547AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772245645, "uuid": "7d2fd5e2-1bef-47cd-bc1f-644b06fc3063", "value": "3072:FCldeCsOs9kzj2vV4XcZgqgCBV30Y+FelsjXj/Q:gPeCK9kzivVYHCzlmjz/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772245645, "uuid": "840a0e8c-7205-4686-8ee3-4609ef569dfb", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772245645, "uuid": "4fa651e9-d4fd-4ef9-bfcf-64c044e84a79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772245645, "uuid": "c01fa7a6-621c-4af5-af66-e6cb20dd28a6", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e95a4f-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772289244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289244, "uuid": "16e43e8d-5e81-43f0-9c13-98f264c2fbf2", "comment": "Malware payload", "value": "98c5036109847e94ca2e2bfa82ed65eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289244, "uuid": "4e9dca3c-8992-46b8-845c-891c86e8ce0b", "comment": "Malware payload", "value": "0247de29820624edc644233a914701729d267ce2011786b4fa5fa1795c363bf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289244, "uuid": "c92b0a13-b136-4b7e-a5df-42c2e71e5a2b", "comment": "Malware payload", "value": "a0032ea83028e8c67bab4b3fea09c854442c3b17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289244, "uuid": "98e961de-1a6f-4582-adbf-00a1b89b6eb3", "comment": "Malware payload", "value": "4480f948aeb0b73ba62ee81134f59ff9d7e11eec976f9c3592d07ae8887d7aa5bdebce6c5ba1a76c1a9de62d5c84f012", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289244, "uuid": "7ebaa2e5-6875-4cb0-babe-8714355165df", "value": "T1A6D3D01FB26750B8D025C27426B3C83B5771B9702122AF3E7251EB349E70DA12F99E2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289244, "uuid": "62cd940d-440a-47f6-b282-ebb2263c2345", "value": "d0211f71ed6994a21532e888c12d1098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289244, "uuid": "eec5e73f-35af-42c8-bdb3-bacfe8dd7b9e", "value": "3072:bxFSU4WdDdJfecNEBTzSx32jAgeEPdB7838uWplo8:toUnJfecNFxmc/OdBILwo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289244, "uuid": "fff758f4-4341-49c6-8568-b3b65dcaa2a7", "value": 135728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289244, "uuid": "cbcb9092-1926-49cd-9f42-2816798881ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289244, "uuid": "cdabddf2-97f3-40b3-b5cf-40d4e49b287a", "value": "0247de29820624edc644233a914701729d267ce2011786b4fa5fa1795c363bf2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad840c43-14af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772288018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772288018, "uuid": "60e5ea3f-42de-4f6f-9866-e36da46d4e27", "comment": "Malware payload", "value": "fb0a8ad4794f22e578065880cb4d61a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772288018, "uuid": "12de7077-0fc5-4ab3-bd81-d72b98b60fa7", "comment": "Malware payload", "value": "02491cc10fbd3b88326a2b51faa0b83287aa34e4e1e2a299632b02326bc2dcaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772288018, "uuid": "28bd06ec-05ab-4a1a-8ed9-3920974a738a", "comment": "Malware payload", "value": "ca1d583590dbc7f3ef9742635072f4e9899fe0fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772288018, "uuid": "236ecec7-cd59-4110-8e8d-72d389652af0", "comment": "Malware payload", "value": "a464538d6951344c7423982930a3b619ed66842e6bcc670bf0f94731eb782f1cc5bf5eddcbcc161baeadbdd9cd2e4898", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772288018, "uuid": "a6efec02-3718-48cf-9347-026af41f970d", "value": "T1F356F001798A4060E612E73BB4AE9F7B9F34FC40576420873BCB97D67E5B610AE23395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772288018, "uuid": "741e7c7b-d812-4178-bfd7-7d9aaeb992a3", "value": "6661d547708834743b5e56b68c17ed89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772288018, "uuid": "38bd6fd9-a7fd-4597-a2b7-116f4a62f601", "value": "98304:ZTnxJtWTQ1Un/YcGcLyFE88PumR6HZF6lhhK2HSK1gWzJS6ve1ZO:ZdLWTQvHcq2JyMkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772288018, "uuid": "a5bfc20e-770b-4e75-badd-c80e8f9568dd", "value": 6217728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772288018, "uuid": "cc42ff80-0e35-443e-9bab-00bc29db1104", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772288018, "uuid": "b0117af0-2cd6-4ab8-8fe6-1ff18b78f141", "value": "AccsforgeRustExternal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d2a6d3-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772289292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289292, "uuid": "37a7c7ca-093a-4647-966d-08aa300758ac", "comment": "Malware payload (Mirai)", "value": "ce52f78c8ff23fbd9d82b8e4a41c7c34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289292, "uuid": "cfc1d6b3-4d76-41dc-b310-638d8b983b64", "comment": "Malware payload (Mirai)", "value": "027cfa6ceb7b46a0fd3fb254969e4aa078f27343e4049965c5fd012314b84002", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289292, "uuid": "43809ae6-c775-4c81-9a1e-c692938aa9cb", "comment": "Malware payload (Mirai)", "value": "44c96f2f0aa9095500fdd53ccc2b99821fc7f5d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289292, "uuid": "357aa28a-860e-4e7b-af0b-e403c8ca51d2", "comment": "Malware payload (Mirai)", "value": "5a273bba750d1c71eb595dc843e8a4712a66b8cbb1ccb417f55567eaab24d032dfd29d281b1e03a91eb45c6654a05290", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289292, "uuid": "25d76869-8767-4340-9006-10b8b2ba1981", "value": "T1FF042B46EB418A13C4D227B5BA9F424533239B64D3EB730699287FF43F86B9E0E67501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289292, "uuid": "5845f796-8143-4e6e-85d1-f49cd5b43b00", "value": "3072:cpN2w6qnG6tjaWAZOvJsFFsDL7oQUpDCqXEhISpbWM/9HO8OU:SN27wjavZOvJsUDLYp+q0hISpqM/9HJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289292, "uuid": "ab44d066-0391-4dd7-a5ca-e82815f6b568", "value": 177907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289292, "uuid": "dfa614fe-ac94-4ea0-ba4f-e9ae7f7ac3bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289292, "uuid": "e7f1f0e5-1413-42d9-85fa-7bb378e8dd2e", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "877e5a2f-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772289243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289243, "uuid": "da09764f-287a-4755-aeca-d6a88fce16d3", "comment": "Malware payload (Mirai)", "value": "1b292c8c6cdb520410adaa14e195f072", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289243, "uuid": "a0ba2fb5-e0f8-4f02-8dd1-4bfcf96401b4", "comment": "Malware payload (Mirai)", "value": "03052b7ea3d80c3fa053f35cc1c3b00b5a18df51dbfb5df5db9d7e66a9707e1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289243, "uuid": "326ae4a0-4ab4-434f-8c7f-836abb0635eb", "comment": "Malware payload (Mirai)", "value": "d956e301728a5f7c574d09cf6f5b427890ea83ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289243, "uuid": "bc04c21b-5428-465f-a73c-f9ed18f5e912", "comment": "Malware payload (Mirai)", "value": "787f13f1722fbeda649eca03e67e1d5dff937d2bcd7928766602ee5cee692eb60103949550118f500900742bd4330104", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289243, "uuid": "437a064c-396c-4986-9119-7d6d72f8ffb5", "value": "T126C39E87FB8B14A0C8620AF017C71F9D6B53A211CE5FD8E3BC1E663B5A7A4DB1516381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289243, "uuid": "950da1b2-ecd5-4956-acd8-1e0da8b5e0d5", "value": "1536:Wt+2mPrGbK8rXOK5lr6eWWrf52T+by3JE5hl5/ECoYnxP/9gEvEL/LWb:WtQryK0XOu6eWWL5cYqi5hwCoYDgDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289243, "uuid": "f185ae07-b95e-423c-9d11-980a2f60625a", "value": 124676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289243, "uuid": "ec4c9158-d144-4eca-8388-2a1059a8d155", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289243, "uuid": "689091cb-629e-4f40-b634-1575d5391b10", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2bd59b3-14b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772291544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772291544, "uuid": "01df8239-0467-4182-a886-ba82074bd9c6", "comment": "Malware payload (Mirai)", "value": "05037c14b32700447995010208cb8b68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772291544, "uuid": "f4fa4134-97b3-413f-9c3a-794686e8fdd8", "comment": "Malware payload (Mirai)", "value": "043ab6b18ecbe610cef182efed798dd68850c048abe6b59624b6101a5ea6f772", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772291544, "uuid": "0fb67964-fd3c-409f-8cf0-9bd9b8451c98", "comment": "Malware payload (Mirai)", "value": "11ef8a699c8e6e4c76a96fe72db4d45c62578cf1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772291544, "uuid": "f9bdc800-26cb-4584-bb6b-525a4fbf3902", "comment": "Malware payload (Mirai)", "value": "7969a44b584de2e77a91c6f0151c94dc78029a5fa9c49f78c474bf01acb6b400bbfff8df82e9c1e1cc0b12a5bb1c542d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772291544, "uuid": "452a19c2-4c43-4c5f-8751-2c460fa66e34", "value": "T1F692C06F646060C0D2615836E6ED9EC7E2B60BFDE3E8307107A85A5CF262640737605B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772291544, "uuid": "b36c84e4-c95f-4da0-89ff-d7b9c04653ef", "value": "384:A3CFDQy54M7zLnmZFiPThj6r8CKozfdchYC+Gyx2QSHWzO6DkhymdGUop5hte:wCmyqM7zLnmZQLh+IWfdzFG/QPzNDks8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772291544, "uuid": "bb6bae01-6afe-431f-a31f-c8abad5129a6", "value": 20524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772291544, "uuid": "98418bf5-b8c7-4d69-912f-c297ac38142e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772291544, "uuid": "cd4c6a91-8d09-4955-9c9d-aa78027198a3", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd9a3a4-14e8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772312257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312257, "uuid": "70661306-8d86-47b4-a76b-3bc46553e6de", "comment": "Malware payload (Mirai)", "value": "042cb63da224a3a01c08a1500c0994b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312257, "uuid": "e3362e80-926f-458a-a4a4-c150437d937d", "comment": "Malware payload (Mirai)", "value": "05c9eab5b7e0640a8dbab5e2b185a018a97a2919511dfd5d0039380ffc23a548", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312257, "uuid": "c684b5a4-8c72-4634-bc0e-062657dd0ff0", "comment": "Malware payload (Mirai)", "value": "afd2f37a6bb316420d93ca13a4d5d19295adc74e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312257, "uuid": "72864feb-a5d2-422d-85a7-5ca1bf766f32", "comment": "Malware payload (Mirai)", "value": "8284decb01651dcc87d130dab07996a1b8decc6b26c612f2fabc821405ba745071612af0a4e90d8f45fa9c6514ada2cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312257, "uuid": "4b9f2882-8640-4018-9eae-fab7ee5fec1c", "value": "T19B634BC9D9C398FAFC150A7034376F32D676F57F3269DE87D7A86462A801502A21B38D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312257, "uuid": "44387050-aa26-4022-a392-75d09cdf2cc9", "value": "1536:sj5rv6nz5L/OlBhoL+Zz4sAyJsqd6dU0zfifSKSqu:crv6nz2BeL+ZzRAkdd6u0biv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772312257, "uuid": "256f2c18-1925-4d88-93f8-37c19f4b2865", "value": 70800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772312257, "uuid": "1e208c25-c121-4395-9b6b-ac30148c73f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312257, "uuid": "efe6a635-f1cb-4ee4-bc38-5e906a743f71", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d222d2bf-144f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772246848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772246848, "uuid": "41927776-1d1a-4db7-98ce-c4218cd4ec03", "comment": "Malware payload (Mirai)", "value": "6109a6e64f1995790c8fca892bd6b496", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772246848, "uuid": "0c9f5ace-9c24-4991-a699-2d64b322deb0", "comment": "Malware payload (Mirai)", "value": "06067218b24ae062a99f94c09adcad5c28abc6bead77370ec19c382fd72e88c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772246848, "uuid": "4602bc42-3728-4c58-9671-3ba4492a2775", "comment": "Malware payload (Mirai)", "value": "d29807f471f68affae7e6f7b4165e04f654ad3f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772246848, "uuid": "67f9f432-c8dc-4c3b-8f1f-4b36b59f4cf5", "comment": "Malware payload (Mirai)", "value": "be3a8cd606deb865e6602976b064b785292183b126e047d443f880b227dc307ff63309f036373c590b7c7590151ee22d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772246848, "uuid": "5f031cef-4dd1-4fd1-89df-48617ad81855", "value": "T14CD35C0677180E17D5A34AB0263F1BE087FED4D121F4BA89291F9B6A4672D3B1582FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772246848, "uuid": "a09e9234-b2df-4f9e-89c3-a9eac8e8c8d6", "value": "3072:i1kzeSFZhMHJqA+Kr5UbeU73HegqM89VkDA:7PFY+cqbeU73+gqM8XkDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772246848, "uuid": "5a33234a-7e0e-409c-a4f8-f999c6e164bf", "value": 134320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772246848, "uuid": "31e530a6-ff93-4579-926e-642644fc74d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772246848, "uuid": "6632bbd3-8607-43aa-bb70-560b25cca160", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b17038e-14b3-11f1-a769-42010a9c0008", "comment": "Malware payload (DiscordRAT)", "timestamp": 1772289544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289544, "uuid": "c3e1fdce-4d71-48af-b11a-65a812756593", "comment": "Malware payload (DiscordRAT)", "value": "f118acb7600498e8dafd74a42c700264", "object_relation": "md5", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289544, "uuid": "6cef2720-cc6f-40ad-b209-9d74c7b274fe", "comment": "Malware payload (DiscordRAT)", "value": "0644cfb2a81dd953aa5c3f37f72cae7ba5b7e60a0835f8628b9722a2322657b8", "object_relation": "sha256", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289544, "uuid": "f72aac2d-21e5-4d6a-9bbf-0e254d6a9be6", "comment": "Malware payload (DiscordRAT)", "value": "b40ffeeceb0d99fc1a0d3cb6927cd5678c65e06f", "object_relation": "sha1", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289544, "uuid": "685bcb34-60cc-421f-b00f-d2a3852c431d", "comment": "Malware payload (DiscordRAT)", "value": "4c2b617c3cc45a6ffd1bbe74c15afa2384b2c09a656a7bbb9531e8f669bda2102823df0dfc08e7e45b7195d181f75d12", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289544, "uuid": "988571a5-2c48-4352-8e2a-908b03c198ef", "value": "T1C273B8C877AD8903FBBF5EFD147141524B72BB17E935F68D088C54E611A2B828C42B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289544, "uuid": "9c7f4f9d-5210-49e0-8d90-2857e210f361", "value": "1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+IPIC:5Zv5PDwbjNrmAE+MIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289544, "uuid": "a0a4bce6-5130-4616-b0fe-57a8b20a8142", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289544, "uuid": "e7596031-1a1d-419c-b63a-a0976d850615", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289544, "uuid": "63aa4d8c-fffb-4336-9c36-86dc608fff61", "value": "abdullah.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cdd126e-14d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772303264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303264, "uuid": "7d5f0328-39ab-47c7-9d39-3a3d8710868f", "comment": "Malware payload (Mirai)", "value": "9f18ea2a96d0678397046fa2bdca64de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303264, "uuid": "0e4802c5-d0d1-4bbb-8972-5ad58bb47082", "comment": "Malware payload (Mirai)", "value": "0788c1c249cb3ed3c96f76062f1bfe0091899b3bef78160eb55a8c8014ab4f0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303264, "uuid": "80d5c82f-64ba-45b4-af12-ef0909554cc2", "comment": "Malware payload (Mirai)", "value": "67c70da2da2a576c711880e6a69ac828157d364e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303264, "uuid": "4ab8bca7-f5a0-4e55-81cd-50bc21ca78e7", "comment": "Malware payload (Mirai)", "value": "dfce5f18934ed82115225c9514abc372f4b176b3b40e07e9dc1a91c41660b52c8fef11bf4654ca589a57436ac9def834", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303264, "uuid": "1482a6dc-f0c4-4958-b366-fe4ec4a6104f", "value": "T1D6231894B9829A16CAD0437BFE0E42DD3725A398E2DE3313DD221F6137CB92B0DA7151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303264, "uuid": "b4d14708-fff7-4fc8-b33e-28c8496f80ff", "value": "768:UXYesyi5wPVQEkJVvOwxPFV4iRu6Jj3oSCo6gPj5+uB4Pl5Q1AL0xkbUFqBgEk9H:VZe4vrR476JdzPj5+uBalulObUoBEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772303264, "uuid": "f6db2b6c-fa16-4e54-87b0-2d69bacd0625", "value": 47940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772303264, "uuid": "73590b81-7c13-4830-a0d6-6023f67fc890", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303264, "uuid": "d74e084d-a5c7-41b7-a78b-18cb187bf2fd", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0166dad-1475-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772263085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772263085, "uuid": "73384ee1-9af9-4b67-8271-d024b9a0ddfe", "comment": "Malware payload (Mirai)", "value": "b63fcb283b08d419a0fd941281fc54e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772263085, "uuid": "6ef3a606-84ca-4195-9e65-1cec179333fa", "comment": "Malware payload (Mirai)", "value": "0983ff32b6bd942f968c8c8a44aedccd86f7334cefebbbf41c9dfaf44c83c2c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772263085, "uuid": "daf27f74-eac2-41cc-8516-85a5960a4db2", "comment": "Malware payload (Mirai)", "value": "2b17c41b55a2620888e3ef9dcdef50cffc348615", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772263085, "uuid": "8e21d499-296e-456b-9d46-9664b589fb0b", "comment": "Malware payload (Mirai)", "value": "87cf16734cf24296cb7ede95535572db0de088e7a333d6f99bea6406ebc80536cdb7e58e24931bdc478d94da93259a9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772263085, "uuid": "ead542bf-872c-44a2-8de9-941f5369047b", "value": "T17BE31A45F8505B23C6D612BBFB5E428D372A17E8D3EF720399216F25378686B0E37642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772263085, "uuid": "07821dd1-c2ec-4b88-8f95-f5d939aed92d", "value": "3072:3ITEs7uRGpUlWnF46r/b9l5n5CYp7G7Wz:3ITyRQ66F46Tb9Hn5zNVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772263085, "uuid": "7e70b9a0-9f69-4086-9886-f96b6c6b3b29", "value": 146208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772263085, "uuid": "4ed40220-49e9-40fd-9aad-770cdfd8689d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772263085, "uuid": "ea71520f-3fe1-4da3-9e00-2118b4304f37", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "479a367c-14b3-11f1-a769-42010a9c0008", "comment": "Malware payload (DiscordRAT)", "timestamp": 1772289565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289565, "uuid": "5afbcaf3-0693-4361-8730-d266eb9961c0", "comment": "Malware payload (DiscordRAT)", "value": "ee61af4d16f844c80a6561e5c69721cd", "object_relation": "md5", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289565, "uuid": "03e15c42-23de-46b8-b529-3a8d022e4310", "comment": "Malware payload (DiscordRAT)", "value": "0b3884cd80063362270780c7e28107b62cb3a6f7a2714cd176f003707f070360", "object_relation": "sha256", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289565, "uuid": "6e1ad18f-28f8-4fc1-947d-f12ffde515e2", "comment": "Malware payload (DiscordRAT)", "value": "c45300a8faefdf532224c057efbf745e7c6a5679", "object_relation": "sha1", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289565, "uuid": "cef9eea7-4b04-47a8-a9d6-76c8670a2dc1", "comment": "Malware payload (DiscordRAT)", "value": "c21d002bae8e91a6bd63177c04381906c149ae3a032f1e270393002848deda9ef1fcbbeb6363157339a14fe216403165", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289565, "uuid": "f51cc6d5-5238-46bc-b4bd-6d7518dd8c7a", "value": "T10E73B8C877AD8903FBBF5EBD147141524B72BB17E935F68D088C54E611B2B828C42B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289565, "uuid": "780fce6a-41be-4ebf-8900-a6b51a8e7a41", "value": "1536:22WjO8XeEXFZ5P7v88wbjNrfxCXhRoKV6+V+gfPIC:2Zv5PDwbjNrmAE+gnIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289565, "uuid": "9a0919a3-646a-4b8b-bffe-96cf12821ba1", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289565, "uuid": "83da762a-31da-4014-a528-be1d8fbfd189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289565, "uuid": "42251511-c878-48c7-86b9-bda8ed390884", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e7ea6e-148f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772274403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274403, "uuid": "bb44e6ed-7a3b-40f2-8e69-7a24b48e4fd5", "comment": "Malware payload (AgentTesla)", "value": "85168a2efabf817eefe5544f446ebf91", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274403, "uuid": "372d218f-355b-4708-8d12-59272dca9889", "comment": "Malware payload (AgentTesla)", "value": "0c6d4c23fffe39bb49395a5f263cc2f6fa9ff7b9ec0e221245931786117f6ffc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274403, "uuid": "a3364002-4be4-4619-8c70-f3883328e874", "comment": "Malware payload (AgentTesla)", "value": "e2f397c15076120e4493546a372327772eb6567f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274403, "uuid": "40ff8e93-de6f-42f3-b4c9-19b6e9899ed0", "comment": "Malware payload (AgentTesla)", "value": "b2365932bdb2feaebc56d730026bba06058a58a15434d5fc605165e8b6d47fd1d8f69c40f508aecb88f8aa4701d2ad9d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274403, "uuid": "e47c13ff-0c84-41a9-b94b-9a57f13cc830", "value": "T14A55AEA281421BB5B6F1731A10FB931F73B1AD4E1741CC40FBD6AA4F2EBE08D9255B49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274403, "uuid": "a90f88b8-f3f1-434b-adfd-2008f21b28ae", "value": "24576:PXMhdVGC0Dl3+BysbJxIajJZ2GIqFaGFOF19NRI48bRJlv6Kp2ZOrfygKIiYUxun:kFEltnS6abJ8s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772274403, "uuid": "9d7e7a80-ba83-46e8-ac0e-84daab59b6cc", "value": 1385133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772274403, "uuid": "746141ba-92a5-4b67-a097-2c55381840e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274403, "uuid": "b8a9b5e7-aa11-47bd-b03d-d4b0282e07e0", "value": "85168a2efabf817eefe5544f446ebf91.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "168ba3a9-14de-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772307951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772307951, "uuid": "9765d55a-9937-415c-bf43-931a556b6b69", "comment": "Malware payload", "value": "1942842ebf721b84d83342075e4463ce", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772307951, "uuid": "50352d80-65d7-45be-b7b1-a52e0d13dcb4", "comment": "Malware payload", "value": "0c93de2d78b508b065fcb9dd0224b02b4b21c3db0ae905e0da2c42135edf314d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772307951, "uuid": "6e167ae2-2959-4a41-8faa-fb3c8792e217", "comment": "Malware payload", "value": "5d468a19aca9ab6f3da939bb403763bb2d54b82c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772307951, "uuid": "e97ba03c-c59e-4924-9d2f-2bdfa8822842", "comment": "Malware payload", "value": "f7372050bc1f487204fc7ef207e4e723ea1de5ef30c5a7194d30489ef98c0f9e2b1fc9e380ab04eb79d8e8b134b776f6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772307951, "uuid": "69f666ea-ceed-4bb8-91f7-ead94bf305d7", "value": "T13EF0E19040A12DB02BFC5D6884555A5C90531761629B2F69A0F2C9F6CF670447709B90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772307951, "uuid": "3e2ee11b-379d-48fd-bcbf-ff12271ee339", "value": "12:MquhRnFxvhshjg+U2SSS/SeNWXgnxo8YHj6X:MfnnDhkg+nvASxXiajD6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772307951, "uuid": "b43f95e2-ac96-41fa-827d-eb441853d960", "value": 554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772307951, "uuid": "f7bb519f-9cff-4a72-b87b-6e07aa76c69e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772307951, "uuid": "cc34325c-fd96-45c5-8842-8cbec460526a", "value": "m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b88e3628-14a1-11f1-a769-42010a9c0008", "comment": "Malware payload (WallStealer)", "timestamp": 1772282024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772282024, "uuid": "8e97c707-f7b7-47b8-b25f-49328ba28a5b", "comment": "Malware payload (WallStealer)", "value": "e76586ffea5c92002e4a8edf60b64bfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772282024, "uuid": "78cae83b-e4cd-49e2-aa80-397759f37023", "comment": "Malware payload (WallStealer)", "value": "0d5b21c50ace8394dd64e9be86a4187362e6fe07af4be39ea5ed8c1d6fe937d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772282024, "uuid": "b4ae56af-3b7b-448a-add7-d89474a740db", "comment": "Malware payload (WallStealer)", "value": "80a4488db652d1da4a55a9fe3ef33dbb44b08675", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772282024, "uuid": "15b91eaa-af3e-433f-a59b-3ca4cbdca6ac", "comment": "Malware payload (WallStealer)", "value": "914714aa11c00a921c31764f566d5ec765f7a246342557b52e929e7a1cc98e72e909d9b20b4ce06e3d073ed136e5274f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772282024, "uuid": "89bfbcaf-2ca5-4f23-953b-76cc0b8309fd", "value": "T112D47B0DA7A581F9D1B7D0B4CD038517EB72FC564732669B43E04A862F2BAA49F3DB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772282024, "uuid": "7a20d160-05dc-4f24-83c1-b8210f3c2a11", "value": "a330d858063c312aaac6d9eaeb29a36b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772282024, "uuid": "75f48fc0-6090-4478-b5bc-4044227655f3", "value": "6144:6/FAnFeGb74gQ/Dmeqxt8UDRiiVxdB8+CbTrK9ZgnRs1VzYXWjPJAWzfO6rn:WA0sJQ/Zqb8RaxXaYQRkVkUTHrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772282024, "uuid": "bc9867bb-8d02-4ece-b1c9-6c00f12fd9ac", "value": 649216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772282024, "uuid": "120735ea-1a1a-43ce-a1de-b4cc47f137b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772282024, "uuid": "a3cdbdf3-13b4-4d7d-ad40-3dea334b68f2", "value": "babi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f26b59ae-147d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772266659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772266659, "uuid": "a4e89889-1bf4-4f37-a3a7-8040ec6eb37e", "comment": "Malware payload", "value": "8afa9c643ec74d4f4fa514635b40dbbe", "object_relation": "md5", "Tag": [ { "name": "22222optimized", "colour": "#577CE0", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772266659, "uuid": "9d1cbe34-34cb-45ae-814d-e3362d1e592b", "comment": "Malware payload", "value": "11f4ce447d2dbddd1aa82af0480f03043205aeb08eb5f7e6a5eb23c0fc24a6eb", "object_relation": "sha256", "Tag": [ { "name": "22222optimized", "colour": "#577CE0", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772266659, "uuid": "d41f37b2-dc43-48c4-bade-340a9dc5e857", "comment": "Malware payload", "value": "9bd64e1459930bccc6945f81f46691612e5e0841", "object_relation": "sha1", "Tag": [ { "name": "22222optimized", "colour": "#577CE0", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772266659, "uuid": "5da97d26-4d34-4c58-9157-52f4e554f8ab", "comment": "Malware payload", "value": "2a28b12719aa2cdc55d20a8701d7fe0de35acc27d8fe3d2c49a6056a7532dffe16b61311fae2812261d7281d2c5c5a72", "object_relation": "sha3-384", "Tag": [ { "name": "22222optimized", "colour": "#577CE0", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772266659, "uuid": "fdea8e86-abc8-4f46-afd0-4aa22f88cb82", "value": "T11CA5335FB409882E8C1597B251418605C67E0FFDCC5D0AFDEBEB9DA35286F88A481CDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772266659, "uuid": "05fb6e58-d0e0-4479-b35c-b57fbe696369", "value": "49152:pKqJqEvc1uEm8SGyyQq35335s8/LEVAxnzY4GkgkoylhWYI/04YfbAEx+:pFvcsEm8xd5H5QCdY4Gkg5QY3042AEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772266659, "uuid": "7b55650b-4204-4e44-bbd8-5e1cc243eb02", "value": 2221787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772266659, "uuid": "550a520b-5665-4d42-9799-80acaff4f424", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772266659, "uuid": "c5580177-25f0-4a0a-b5a6-cbb09cbab64d", "value": "22222optimized_MSI.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c774f16-144a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772244396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244396, "uuid": "70cb60e3-72e4-414a-9241-5750fd04f1ed", "comment": "Malware payload (Mirai)", "value": "26b716e24fd07e7ac5f0042b6d5d41f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244396, "uuid": "ec30545c-057a-4224-a47c-5b66920fc04a", "comment": "Malware payload (Mirai)", "value": "1237fee0d763b07d5e2fddf707cba759e6e8ae7e6be6594c1f6582d3b2e33961", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244396, "uuid": "7f744b84-75f8-4749-bcd2-039876b526e8", "comment": "Malware payload (Mirai)", "value": "845b67e651fc121b1a6ec0874d0e764b1aafd607", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244396, "uuid": "8ca0ac7b-c8e2-4383-a31d-782d8b9b5298", "comment": "Malware payload (Mirai)", "value": "723e18b9fb89d92e684ecdc254a9b799932e88bfadcc0168c98c2a4aa74f8fdc0318e0590bad26f096fc819816cf1846", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244396, "uuid": "8c946d5f-b8f1-423f-9ff2-a13e98b335a9", "value": "T17AC32912F98584FCC0CAC1340B6FB63AA935F1DD1238B2EB67D4AB123D4EE615E1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244396, "uuid": "9135e5d4-61bb-4f67-9087-4348ac115100", "value": "3072:iY83TgBMfVw+Z7cHIzO8SoMFAIRHp9hApD7bhYcPGkzQ6V8IattGi:in3TgBMfVw+Z7cHIzrSoMFAIRHp9hAJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772244396, "uuid": "cde60ed6-9aea-4678-bc3a-ab1d2284d895", "value": 125440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772244396, "uuid": "bd2d537c-f010-44e7-9685-8266e1b224be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244396, "uuid": "882a4154-b857-4d02-b70f-b05734365ff4", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e694ce-147f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772267125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267125, "uuid": "e9f977e4-f7bf-4bcb-a145-c4e31aff423a", "comment": "Malware payload", "value": "d94f2c267950fe9f2a17db0082a126e9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267125, "uuid": "f1a58f5e-8d08-4915-94e3-78e5364fb4f9", "comment": "Malware payload", "value": "124e12c7d6ab6a51c38c2f69dc4eb68587aa5d985c1d724a20c1d0c3458ca29b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267125, "uuid": "8f715183-66ff-4574-b75f-333ff48e866a", "comment": "Malware payload", "value": "16ddc8f26b921244845a286610c91c51f298576a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267125, "uuid": "498723f2-4d31-4005-b985-5e3f1918affe", "comment": "Malware payload", "value": "3eedcd7af5a37f83ff544e6a76cc94e5c72a415179586f826c8c3f8f6b092e94f82222406727a13b0aaccce9acd03fcb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772267125, "uuid": "5a5120aa-118f-41f2-978d-1b9fffaa302f", "value": "T10B75F807F2928AE1D55E1733C1D7480483E4E5896763E70F7A8E13B929C37BAAD0A357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772267125, "uuid": "676f9b83-06fd-4337-bd6c-d8ac77038540", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772267125, "uuid": "a7d8b6a6-8676-47b8-b194-4e63506e6186", "value": "24576:+RJC3hIChVXcnyezZ0POw2L6XH7CLCCGng7Dw:+f1zXwimng7D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772267125, "uuid": "49984a39-b661-4ace-aff4-0361c1c8f5ba", "value": 1573888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772267125, "uuid": "27cb09de-b4d0-4a98-a423-6108ad641817", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772267125, "uuid": "756ac85a-08bc-4e80-929b-2aace1fc4e89", "value": "Microsoft.Win32.TaskScheduler.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1cf95cb-14dd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772307890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772307890, "uuid": "8a9f9e43-cf33-432d-9c2d-fed99700d62d", "comment": "Malware payload", "value": "b3d61952efff75cecccb4aad8da4d516", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772307890, "uuid": "9f81c840-66be-4907-83ef-f83e3757d59f", "comment": "Malware payload", "value": "13616ddcb05290602a28ae0f5358acb39d974fa3e30c0295dcb079245faf243c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772307890, "uuid": "9d45bc09-bc0c-4bc1-afba-78bb5c804bcc", "comment": "Malware payload", "value": "252735b032cdad94ba06ffd9b12fd7dfb20c3fad", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772307890, "uuid": "ee5b52ca-62ca-46d5-8b65-a21270d19048", "comment": "Malware payload", "value": "f306c8504c10cc6c1563f0445cd130fc3ed914e9dcacca74b413fdb415e01253eb36b2a4aa2056741161873c08d66801", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772307890, "uuid": "c1fc321e-f457-4524-8dae-f0fd0285e373", "value": "T123260151B67090B7F1261C7C44CF2A59086B66DCFE28BFC7FC74688DD81928C39925BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772307890, "uuid": "298a1130-69ff-44d6-8214-430355320799", "value": "f1f576d3ef3824aade0a784c627eef2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772307890, "uuid": "9fd663c9-3c0c-4817-a3b7-0d172e158ce9", "value": "98304:6wxq+Ssvxr3aHMH4SWKFVYArLmvhSAuhEtnkRbFT:6wxpGa1DcAmpwFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772307890, "uuid": "d9e68d4d-d2b4-4b85-ab1d-5b2910eea4ed", "value": 4575232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772307890, "uuid": "4692ef2c-2c1f-4999-916a-1106e5638f2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772307890, "uuid": "d92ec6c4-f040-4dfb-9686-2e4bb787edbf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "124bbfdf-14bd-11f1-a769-42010a9c0008", "comment": "Malware payload (GoProxy)", "timestamp": 1772293771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772293771, "uuid": "1c94005a-f4b4-405f-ab6c-0131c6ddf732", "comment": "Malware payload (GoProxy)", "value": "54be6ae28bafeb4e681492fead5ab4fc", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772293771, "uuid": "1f92366a-e380-416e-933a-add8caa36313", "comment": "Malware payload (GoProxy)", "value": "157879b573e2d2b14931dc28fd58941694bc10bdae9c6b785755b056334564e1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772293771, "uuid": "48b02ef6-72b4-454e-b410-958ce182de5c", "comment": "Malware payload (GoProxy)", "value": "301f1941cde1d6dc3ded2327889a4b8c6349fa0e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772293771, "uuid": "94883cd9-71fe-41ee-b348-680a7fd92174", "comment": "Malware payload (GoProxy)", "value": "f3123631e9513cf615bbdad7525eab708511ce069644ca17fc8b51272c6ac8f16eaa8759a680ff363f71ee7065d83215", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772293771, "uuid": "0e647c51-9776-4b3e-9fc2-f0c0c524a45c", "value": "T12E663903EDA155E9C0AAE23185639153BAB17C485F3523D72BA0F7382F72BD0AE79750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772293771, "uuid": "0fe38709-8601-4209-b77d-22ce85eb68cf", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772293771, "uuid": "4421a521-0b38-4ac2-bb04-8df3345085a8", "value": "49152:x5LGu0XFTWTz3+5GyGoaKNo4FSov0HvLptrtN3TpKHaNPIUKTrg0ybqj5mY9N5Uj:xlGW3yxYvttrt1xN4fyu/EbsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772293771, "uuid": "a8369097-92f8-4e48-8f30-4beccf703568", "value": 6517248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772293771, "uuid": "df18f9dc-ae05-472f-8b0b-9cbb87708fc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772293771, "uuid": "9b7052e7-f2ad-46e6-80a8-444745fdaa9c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe89f203-148f-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772274410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274410, "uuid": "ad4aa82c-94da-4432-9c6f-8fa2f07cd472", "comment": "Malware payload (PhantomStealer)", "value": "8bb36db28de689e159fc4ee0ab3602f6", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274410, "uuid": "ae8b4a45-b1cd-4cab-9ff0-7d10d1c664b5", "comment": "Malware payload (PhantomStealer)", "value": "1624ad7f07ab0ca1b290560bf503ea461beee7d5b0836d69e64f8cc402fd3b7d", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274410, "uuid": "57a67dfe-2b40-40bd-aa2a-bd2dc610a5fe", "comment": "Malware payload (PhantomStealer)", "value": "9656efd5d3d25016183df97019ed34083c1e1237", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274410, "uuid": "4dd30d44-6d0a-43df-8a9b-48d80c715f2e", "comment": "Malware payload (PhantomStealer)", "value": "e08ce18dd1acec7b9f8ce957fe06e80cef8aa8956817f19061f1bfcbf73a5eb858a64c238107752a34424dd734f6c65c", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274410, "uuid": "1cba7f68-c6b4-429f-add6-fba4b029c265", "value": "T16926BF04AAC42BAD93BD3D2EA43D3A3067F6477F9673954738A2A58F16FB800571412F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274410, "uuid": "e598d2ef-b4cc-4003-9c24-13cfec6942b4", "value": "24576:hoppPHymPUteXrFIxz9ptIFXf4XHYmbftkzsBkF+pWiDgTH1AVjC3TvDpAAKnWl0:qstigKut5ukWKgSBX/AJJUPA1aJlfczk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772274410, "uuid": "d2536698-7e56-4c3e-b5a3-822fce43e151", "value": 4648741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772274410, "uuid": "e09dbd77-3d98-4aa3-bc36-30f5191340ff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274410, "uuid": "11231c22-3b48-464d-86b9-9e119e9de470", "value": "8bb36db28de689e159fc4ee0ab3602f6.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "126af655-144c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772245238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245238, "uuid": "1416747b-d9a4-48a8-9f27-77df18ed5ae2", "comment": "Malware payload (Mirai)", "value": "0cde8ee5dad8c52a27e1db81cbb4aad3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245238, "uuid": "438173a2-2792-4d98-912b-08532f6a579f", "comment": "Malware payload (Mirai)", "value": "194420d0393124ffc9586eaabcbe8dc643a9fe25b2db67b971fb5c01dc14689b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245238, "uuid": "a4fea6e4-db78-4c6e-b334-e1a9078b84c4", "comment": "Malware payload (Mirai)", "value": "e7652e8d1e09c5254fcc37dae9370074e0a6deb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245238, "uuid": "e11f1103-1f92-41c2-a6eb-10e68f017fb3", "comment": "Malware payload (Mirai)", "value": "9cd9537d70eb903f75749be760423df39b13f5377935ff75f4ec6fe3b659e46b18c70251bdae3dd57fddded174cba240", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772245238, "uuid": "4db9930f-dfd4-4d45-ad13-812e794ff2ea", "value": "T1C8C37B33D82A6F68D159E030B0718F792F53A59182875FBF59A6C2758083D8DF905BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772245238, "uuid": "ffd35524-7fe0-43d5-bdca-d6faa19f70a8", "value": "1536:ywxGXM/nvXvjuZ+Zj8uvoxloxtC+7Ks0AEbcpoYIMrTGjZzDkhJvDV4WjHQRr3/2:ywxtfvXDZjNhxtb+s2khJp4WLQR7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772245238, "uuid": "cd5c2baa-7325-4d95-89ee-9b294c340486", "value": 129888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772245238, "uuid": "d2edc9ed-abd1-4296-b467-179f3aa0ff2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772245238, "uuid": "ca93e5a4-5663-4f6c-a4c7-25d1080b9d55", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10150838-1462-11f1-a769-42010a9c0008", "comment": "Malware payload (CobaltStrike)", "timestamp": 1772254683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772254683, "uuid": "b7ef824a-1772-4f99-ac16-12c1dbf5ff44", "comment": "Malware payload (CobaltStrike)", "value": "2530d7848475ea20584e4d5998fec927", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/TurtleLoader!rfn", "colour": "#29AC6B", "exportable": true, "hide_tag": false }, { "name": "TurtleLoader", "colour": "#647BEB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772254683, "uuid": "6aa6134c-db4e-4dfe-aad2-323ce03f8683", "comment": "Malware payload (CobaltStrike)", "value": "1ace2c48573aa62bf0cf258b223d45e7cc9b6e21b441fd2ee8d93a87e7cf0f9e", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/TurtleLoader!rfn", "colour": "#29AC6B", "exportable": true, "hide_tag": false }, { "name": "TurtleLoader", "colour": "#647BEB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772254683, "uuid": "a76bbd54-a3c0-48f0-bfa7-f0c7fb48ee76", "comment": "Malware payload (CobaltStrike)", "value": "45c30e29bffcd84be139467680ce6689efa10308", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/TurtleLoader!rfn", "colour": "#29AC6B", "exportable": true, "hide_tag": false }, { "name": "TurtleLoader", "colour": "#647BEB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772254683, "uuid": "af477e8e-205a-42bd-b86d-b222fed914b5", "comment": "Malware payload (CobaltStrike)", "value": "3eabfde065746cdcf2ab60b3870e708de969d7c86aae751d21b30fb9ac745f58c50e5537e1fbe970e7e5913c9feb7f03", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/TurtleLoader!rfn", "colour": "#29AC6B", "exportable": true, "hide_tag": false }, { "name": "TurtleLoader", "colour": "#647BEB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772254683, "uuid": "2bf36e23-9b8c-4ab1-9479-aec45aabe677", "value": "T1A725B07BF69284BCC2CBC1B87782DAE5A871BC180130715E42D5A5527F5BC202FEE6E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772254683, "uuid": "24fdbdc6-46d7-4fa4-8a87-1719414694ea", "value": "f9f05b8972c1df9fd64d5922fa4b9a36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772254683, "uuid": "0af127b3-1fc2-4f80-8ac4-98e55bd2b37c", "value": "24576:RJ7kEmhFr0bLAQOqolEoZNvS69JBcWk3xfRR:Dk7huBOqoi4qqcW4xf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772254683, "uuid": "14998d9f-6aa0-439e-bc03-b3118bc4a0c1", "value": 1038888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772254683, "uuid": "59a9eff6-bbdc-4e25-bc71-1827dc4913d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772254683, "uuid": "bcee2357-bea4-448e-98aa-f6ce52c4b93f", "value": "devicelearn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d86b6bdc-14be-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772294533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772294533, "uuid": "dfeab13c-2651-4b6e-9aef-980e10b8d168", "comment": "Malware payload", "value": "8a1c2c7c1f68fa2b5601333c9cae33c3", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772294533, "uuid": "0e3e63a6-9929-4f93-a8c2-76b8eebfda5b", "comment": "Malware payload", "value": "1b315ddeac3883162a5d567b58b65cd47eb315aab6c59621d0047caad092ab8f", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772294533, "uuid": "c929fd1b-e205-4541-b4a3-164f95af7c05", "comment": "Malware payload", "value": "cfd6bf31596a93a3b262bdc6323c4aabc4c8f320", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772294533, "uuid": "2f234687-b96c-4bf0-a804-7f2e389aac60", "comment": "Malware payload", "value": "efa6641582952d14f93a71d65cfb69db25c335e083ee0fe53b6576f179aea96e91272a98a5df52ca0cd5648b8761b873", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772294533, "uuid": "b1be8a3a-1a2e-4bb1-ba2a-e5516ea2a8f9", "value": "T196C28204B8C461B582B3B3B57B9BB81CF86A42AB930686007D8C56C65FB4D1497D3FF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772294533, "uuid": "a531d51a-c165-4347-a8a5-080f6ce6b1fc", "value": "192:MnCRQg8UrJr5p7ZzDr4pV5aSzKmhRWYp4iQ/SKI6DX7mDoIf/Rv4enC4OBukiRw0:MsDVF7sp7vpdKI6DXjenPvkd089kW26q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772294533, "uuid": "8803a39e-d74a-4eb3-a976-ad010dff6267", "value": 27054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772294533, "uuid": "92bc263b-39cf-4465-ba00-8238fdf821ea", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772294533, "uuid": "d9a2e373-2d76-4512-ae25-d7597aac7a94", "value": "fonts.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e1354d4-14b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772290918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290918, "uuid": "53864779-727e-4832-ae4a-e3885c22766e", "comment": "Malware payload (Mirai)", "value": "4500a7e60304a37faed14bf10ca826f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290918, "uuid": "1d274a2d-180b-4d99-9b17-f1ef2496d4f3", "comment": "Malware payload (Mirai)", "value": "1b850be7bcaf92a41732b32815f5e6b44c012e68e39c1c377982d127c9c0d668", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290918, "uuid": "df783077-dd73-4da1-a383-176963db568f", "comment": "Malware payload (Mirai)", "value": "c6d9014ec1c60038a1c55cc20568050be6165011", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290918, "uuid": "6d157164-3a0d-46cd-8445-ef8f69379a51", "comment": "Malware payload (Mirai)", "value": "c90717bacd793e66d99b462d8fa96e2d47bd7fd5ff4911d0063d2de089b12e889ffbac5206f0173481c825af2aeab193", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290918, "uuid": "c051e80f-e576-48c6-9e0c-e8d4d6a74ffc", "value": "T1B203F855BC929A6AC5E02376BB6E118E3321B3ECD2DF7253CC205B147AC991F0D67B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290918, "uuid": "b9b1d0c5-ae7d-43d6-b0fd-5e51ea34aaf1", "value": "768:6GSlCcNVUwji94fTzgHemY197URctXTzSBMSIRz7Pc/nDyxOdg9sYXkQO:6lLUwuY15WBMVRnc/nd8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772290918, "uuid": "f5983406-830d-4718-a651-618d41502eca", "value": 40224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772290918, "uuid": "579fe123-b5e6-4098-8589-5a1e54ee33ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290918, "uuid": "d44b1b4c-fe69-4b64-88b6-115919b78f25", "value": "hoho.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "833177ba-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772289236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289236, "uuid": "5aff96ec-bed5-4766-91a5-1102854338c3", "comment": "Malware payload (Mirai)", "value": "a4c74aecaccd2f794669869166714200", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289236, "uuid": "f53f2914-824f-446e-b688-0dd9ae4c020c", "comment": "Malware payload (Mirai)", "value": "1bff5bcd75bb6af3874b2a18b975c16825649f141dbeda1ea2152b8937b9d424", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289236, "uuid": "db9d7715-8783-4f32-8faa-3952feac6a76", "comment": "Malware payload (Mirai)", "value": "bda692f99009ac49d4925cd8acb4af9163b465e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289236, "uuid": "634fe687-fba5-40f5-bd4b-9de45ec5f77d", "comment": "Malware payload (Mirai)", "value": "9429c9c25bfdc047cd9bc0f5cb191f3a45e51a1b09b32051396aa7b08edae472e036eb98e75360418fb04671c626c66c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289236, "uuid": "fde10414-f2fd-4832-8189-f0142d629d92", "value": "T1FD03F152E6D76C63C5F40830CA3D1812AF6386BCE3C876A4F56C46EE3309595A7F118E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289236, "uuid": "19f2ab1d-1e3d-48fb-822a-b02c7f41668a", "value": "768:hMmb6xeo3W2E5TH8wfhsSC/18MUrK3A1P/9eMs8Z24EIKs3Uozw/:nkfW2YDo5endVeMs8g4LzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289236, "uuid": "4bde9af7-081a-465b-9646-8b13fec2092a", "value": 40912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289236, "uuid": "c4134247-092f-478d-bca7-a54b3d5a486a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289236, "uuid": "68a931e5-72d5-44f9-a001-92a28c0028f4", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f2d7ea-148d-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772273406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772273406, "uuid": "9eadd3f8-ee4f-4b2c-b15d-d37303a8c150", "comment": "Malware payload (Vidar)", "value": "f9131edf95a0ec263a8a4d7e6214240d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772273406, "uuid": "3f1900bb-d837-4023-bd96-baf87e27340c", "comment": "Malware payload (Vidar)", "value": "209b9780a3ee377f4c3b9174522a906f2e487d479041dddbec5eaed627c2e3d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772273406, "uuid": "2a5dd66e-bb7d-4e72-86e4-03e72892ed56", "comment": "Malware payload (Vidar)", "value": "a7536c541bbcf03b3327abf447052bf7e2c6e9fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772273406, "uuid": "16ef4e4a-971f-4553-a44a-05f08734afcf", "comment": "Malware payload (Vidar)", "value": "bac1f0bfbb149d2c7c1feb4a76047b0545b453821c4a8d787999050486ad9392881b3f903d4499f58a8d7912814ac0c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772273406, "uuid": "ecade15f-8e72-46e4-a240-32896dad8338", "value": "T1462412B3F46412BBC249853298B6DF49BEB0042EBCD55C096FF7907A526B1B2C65123F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772273406, "uuid": "c232a3e4-8b60-4b5d-ad0a-11634423d7a3", "value": "ee53c10aff1d01eafea53328179e33a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772273406, "uuid": "37223d98-6316-48a6-9055-942d8aae8ad1", "value": "6144:8QQYr9WkZ5Amo15L2mY4Y4Xd6gK+Zf2WIo:8QQPkZ5Ami5L2l4Y48L+Nc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772273406, "uuid": "ab917d6a-65a7-4bdc-8869-98b11ca46d36", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772273406, "uuid": "80595206-138b-4f2a-a7d5-f3bf14f241cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772273406, "uuid": "feae5e33-5f2e-4237-a0db-6a4ac6407dce", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a45b02-1478-11f1-a769-42010a9c0008", "comment": "Malware payload (SheetRAT)", "timestamp": 1772264408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772264408, "uuid": "ba02687a-8433-4b89-8ce2-19cc04b4aea3", "comment": "Malware payload (SheetRAT)", "value": "00de4dc7648a103b475a06e9ede45344", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772264408, "uuid": "22c6370e-28d3-48e4-8f78-45b365943bf7", "comment": "Malware payload (SheetRAT)", "value": "20a13e3f72473eba7b152b5e1186be34b67a9938688c7776aea7f44bcd1dc743", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772264408, "uuid": "26da83d8-d25d-44e6-8db8-7adb8e25f15f", "comment": "Malware payload (SheetRAT)", "value": "c5a05a4f65e3d317e43061c6b662e6e2f4a61a7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772264408, "uuid": "13036f24-b319-4747-a865-f01283fcc6d9", "comment": "Malware payload (SheetRAT)", "value": "b6bce43a06ee4e862d653764be3acb32cb8f9d9068efa905a715090cd888d848d3432da1b398b98624052a132007b62e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772264408, "uuid": "9874f95d-d55f-471f-a8b2-82c7399678ff", "value": "T103C56F242CDE606FB1A2A9EECBF57465BE5FA16E1B0624CC205227F7B713D439BC1094", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772264408, "uuid": "fb4589fb-44a0-4965-9813-3c9a4a9b7840", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772264408, "uuid": "97fe4940-5bb5-4e2e-8dcb-66cb88afb7a9", "value": "12288:yfQPUWcfy5fu8LJeDRRgkue69Rhx7a8Fra2mze0Au/qx5gAin6nBReZdxxV7N:sRRyuq8U94RnMeZdxxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772264408, "uuid": "6cda98f0-e827-4010-b05f-05f47853ea7c", "value": 2729472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772264408, "uuid": "c70f43e0-753e-4d09-8df7-c87ea36e44df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772264408, "uuid": "551cb487-9cec-4cb6-bbca-64dacb317d5a", "value": "00de4dc7648a103b475a06e9ede45344.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b814268-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772289116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289116, "uuid": "a995c2d1-4143-46c3-89f1-3bf7487ba6a2", "comment": "Malware payload", "value": "ffff707c2c0d1c0f2e017d7d07ece169", "object_relation": "md5", "Tag": [ { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289116, "uuid": "3c8dd26c-7551-4983-be38-07857f824b75", "comment": "Malware payload", "value": "215704f55bfeae23525f14e21f62fa0f7aca191b4d4426f765e2eaf41a675fc2", "object_relation": "sha256", "Tag": [ { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289116, "uuid": "bb611c83-a9fc-44f4-b38f-80bdf9d32a5f", "comment": "Malware payload", "value": "e917056be5fd8a0101733bb54537564245d63f7d", "object_relation": "sha1", "Tag": [ { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289116, "uuid": "35b133f6-3ac7-4688-ab7c-facd4ff6b135", "comment": "Malware payload", "value": "081f06604f9bb772143030e17fdde45b0a6c8aca505cc18e051e7fa1739a0a9b9eb516d7e7a2f70dbfec9a53a1f4417d", "object_relation": "sha3-384", "Tag": [ { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289116, "uuid": "45973419-967a-44f7-a60c-d3ac6461d581", "value": "T1F3C08C0AE620D4FE480997C6E51BB8CC8102684200AB48B953640208028DC38C571086", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289116, "uuid": "8a364168-28b6-427e-8a69-96537ea5c8de", "value": "3:VSJJFIGFWQOC41NLftmAcLhzAK5DA3tnQBK9IeHAB8VCV:s8GFWQOC+szD5maBSJvoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289116, "uuid": "f4e6488e-b23d-4090-81c2-cb919de584df", "value": 142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289116, "uuid": "7ff12112-0902-4300-be13-15da617e8b34", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289116, "uuid": "f2a3bc7e-3490-4e8d-b5b9-ecd9948ccd75", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b4b34c-14b4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772290186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290186, "uuid": "e83a0a11-1761-40de-b956-d36f0399107d", "comment": "Malware payload (Mirai)", "value": "6e4c7f1708f7c3b842c01440e939558e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290186, "uuid": "4ccbe492-2c19-4647-a398-7c4c7e84ed92", "comment": "Malware payload (Mirai)", "value": "22abccc3cbe9afcd01493140dad8b3d00baef8a1d0818fd9de86f140248fe77b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290186, "uuid": "7c3633f8-5cbf-4fa5-9d4f-a0c05b5ca065", "comment": "Malware payload (Mirai)", "value": "347375a8ce87a0e16851f5c3071f9b99bf49d3cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290186, "uuid": "8395bc5d-abdb-4756-b3f7-9bd4ee2d7c89", "comment": "Malware payload (Mirai)", "value": "7c36a2381f61b801bd2bcc78ad4f2b5065c42b1f9632db4c1092247f6ca34e1727893a971c8ae9dcbf87e48a3855b144", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290186, "uuid": "1fc66454-2591-4821-b16c-445f9adeb7ec", "value": "T16C564B19EB8789E6F3A355F0134AD273693050199077B6F2EF8D3B65743A3406F2A22D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290186, "uuid": "adb76575-6bb6-4536-85d2-9b67d0664c84", "value": "98304:B+QbDl5Ah5ue37o15nzWcOmpnZ2Xv+Pw6XedZMC:B+Sh5AgXDY+ZudZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772290186, "uuid": "35640242-772e-4b14-8ed6-3796d53812d7", "value": 5915672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772290186, "uuid": "1160918d-0fd5-4a94-bfa1-6dd63c2446a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290186, "uuid": "68fb2556-1d90-48d0-9272-6085bec3980e", "value": "bin.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12289f8d-14a8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772284751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772284751, "uuid": "20bed499-8933-45e3-a480-e5070f319329", "comment": "Malware payload", "value": "40ce0278937307ba7e2ae12933793747", "object_relation": "md5", "Tag": [ { "name": "95-216-63-67", "colour": "#FBC290", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772284751, "uuid": "2f080185-763e-409e-aa9e-809276033cb5", "comment": "Malware payload", "value": "22dd6c9b0e017a070330851472d92c5e6d8e2af0d2e64a343c7ad071a5c1230c", "object_relation": "sha256", "Tag": [ { "name": "95-216-63-67", "colour": "#FBC290", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772284751, "uuid": "e93f930c-bf42-486b-814c-15e43f5d6cbf", "comment": "Malware payload", "value": "ee8a93d8c1fba9973d79f7509ecea5d53e0e4b49", "object_relation": "sha1", "Tag": [ { "name": "95-216-63-67", "colour": "#FBC290", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772284751, "uuid": "2588bc26-6b9c-4e51-99f9-7dc3520c7f5c", "comment": "Malware payload", "value": "de90d75b8cd2eda3d59acad17ab3baf072ff12d2b7eb895bf95656ed6ef4288a831f3f46f9e3aa9a112540f232968c26", "object_relation": "sha3-384", "Tag": [ { "name": "95-216-63-67", "colour": "#FBC290", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772284751, "uuid": "dc39c9fa-ff28-4dd2-91d9-10bb06db9355", "value": "T18981671F6C1B93799292C27282691DCEF9B5436FA911803476ECC9056B0473EE7DC1DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772284751, "uuid": "f043b8bc-fd45-4cc3-b434-51227a50bb2a", "value": "48:KkmwCOw0jNATblc1r5pmGJr3d/uuEU2VDiFevOqLwF4LWLKH+J77Vr9GmpjiFRS1:ZyK+Q5pF5+ZiFeD0FWWjVr9GITj+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772284751, "uuid": "036d0bdb-d5ad-4585-81f2-677d6894131f", "value": 3960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772284751, "uuid": "96ace2c3-c7bd-42ae-a16b-53486b2a047f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772284751, "uuid": "fa72a9f0-eb1f-45c6-9790-5ea966a67eab", "value": "22dd6c9b0e017a070330851472d92c5e6d8e2af0d2e64a343c7ad071a5c1230c.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c94709f-14b6-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1772290808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290808, "uuid": "82993e6b-2493-44c4-9db1-e0cd43abeb3e", "comment": "Malware payload (DarkTortilla)", "value": "98b741acd352a8a48fcc8f7c94b0502e", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290808, "uuid": "30fb75b1-9c47-4cbf-8699-72201cdbc05a", "comment": "Malware payload (DarkTortilla)", "value": "238441c6a05dd55e6cee3b33c991a8d91302c9e687e4607f2b33ca74dc850ea5", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290808, "uuid": "ecb9b694-e37e-4893-a6e5-ef56b8d67978", "comment": "Malware payload (DarkTortilla)", "value": "58585889116f7889fcbdfe79bfdaa659aaf78e81", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290808, "uuid": "79bcc49d-9d7d-4168-82c4-85bf6037d050", "comment": "Malware payload (DarkTortilla)", "value": "a5e3b4c920f854ce68c3ec1b2fa9f8e75d3f3a9fe3dedf2ee58addf4c5aadadb7ba675beba15616d3402cb521e84ea6f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290808, "uuid": "286221b7-9d5d-4375-b9e6-158370d1df30", "value": "T15135E0060EC32B94D1594F7CD2A610A877F0D55B9212E76F2FED42F0EEA7B4AC906463", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290808, "uuid": "580fff5f-5045-44d7-af6c-91f7b2cd4793", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290808, "uuid": "e5c58eff-beed-4602-ba2b-d239f1221d5e", "value": "12288:WuHN6JaLZokGOuXJxNB3+MLi6bvar5vknJlZelegsUPr3AMMSUqf1GFzO21KObA5:WglLZoNOYwMW9UwljzAE30L1KObz4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772290808, "uuid": "9b92416c-833f-479a-b8f8-8b1821077d13", "value": 1155584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772290808, "uuid": "581abbab-5613-4dd8-a433-7548696bcfda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290808, "uuid": "226dc268-b534-414b-b9f2-f55fe6a0a5a1", "value": "rOrdendecompraf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aec1650-1447-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772243105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772243105, "uuid": "c161b6cb-0ad0-43c2-b13e-45edc767c31a", "comment": "Malware payload (Mirai)", "value": "64a62a3e471cd7539b7785db1a9e02b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772243105, "uuid": "1aed8265-06d9-46e5-b9ce-7ca4eefd8c40", "comment": "Malware payload (Mirai)", "value": "241d077578b41ac4ce9c48cfb4b950968e487a1f30a4984b3af0cb8d22c79629", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772243105, "uuid": "4ac3681e-8e19-4ea8-8744-622dd9ffb588", "comment": "Malware payload (Mirai)", "value": "b99dc84f9bf077236b255d619e18918a86fa4875", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772243105, "uuid": "09bb7f3b-7871-4fec-98ee-782544b04865", "comment": "Malware payload (Mirai)", "value": "7527ef3f51b449c3009dbd20725bf5de7dcd5ced578655deb4aec137a2f35fb90616bc8a1100b6c21b1b7f9192867e70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772243105, "uuid": "1d7337fb-257a-447e-b686-9707df650e56", "value": "T125E35E9AF402EE7EFC0BD57E44670E19F930A3A13243072A529BFDA3AD311965D16EC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772243105, "uuid": "ff192ef2-3ea9-49bb-b64a-b3404a8ce9ab", "value": "3072:leWy5tMmSxA/EYfaAoa5omILfhF9nD7j2NiX:AimSxAsCo40hF9z2NiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772243105, "uuid": "3690c850-d8d5-4e9f-9c17-0382d86b319e", "value": 146872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772243105, "uuid": "4258cceb-c890-476f-9192-a88ff248f856", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772243105, "uuid": "baacf797-4b01-4add-ae64-32fe66853b08", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8635ef23-14db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772306850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772306850, "uuid": "d0677c76-c756-471e-bbec-41b76c9e4c66", "comment": "Malware payload (Mirai)", "value": "f716829048af27364b3d44e85c351388", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772306850, "uuid": "609d54bb-91ff-40f9-ac62-4ef1e5d7d4c8", "comment": "Malware payload (Mirai)", "value": "24d4f12d88d5d787dffe22d0fb215e00e5f23ae9c9e6702d7aa4da518f93a2f1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772306850, "uuid": "4c60c39d-4028-4163-bb63-27fca78bfc3c", "comment": "Malware payload (Mirai)", "value": "8649e9f2fa0d1d5e1fcb643665cb0813bd29042d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772306850, "uuid": "6c113672-9dd5-4c7b-b5db-913ee797c43d", "comment": "Malware payload (Mirai)", "value": "8d501ba527640ef9e23d079c4934c245c50a833b5a9f1e6b21a8d7c7833f3983d8f4cd5987189905ea6d5f48532f8f5a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772306850, "uuid": "4dc5e3d6-3fc6-41a2-ae22-4dd0ae7bca6c", "value": "T1F081F949725207A43E68EA22D37FCA185B42D4DFD4D21F89F2EE6AE04D8DCC83D541A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772306850, "uuid": "fc17f898-0c5f-4a4e-a919-492e574d3118", "value": "48:vMUlUIblUIUMEUcUhUHUSUbUyU2UXUzUBn:vMUlUmUIUMEUcUhUHUSUbUyU2UXUzUBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772306850, "uuid": "e713296e-23a2-4970-8295-e638a8c393cb", "value": 4080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772306850, "uuid": "888367ba-1cba-49d4-b319-5d25a5352b2c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772306850, "uuid": "94812f8b-b390-48b7-b310-e02a5ec6fb26", "value": "cache", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb1172ba-14ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772287182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772287182, "uuid": "50d951fe-ebf7-4170-850c-30b192da2df2", "comment": "Malware payload (Mirai)", "value": "371d785f78849602d65ce9f47d0be80f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772287182, "uuid": "330981a2-57f8-4263-8d55-14a242aff916", "comment": "Malware payload (Mirai)", "value": "25288cad794b24493591a62e4749849f0a7f9f003c42b6c0976a9099ca95d1a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772287182, "uuid": "09e15ff2-32a1-4a6c-a6b0-9a8ad1c98919", "comment": "Malware payload (Mirai)", "value": "97f47ebc562b0382840220e8f39d18ccdc851023", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772287182, "uuid": "365ba3cb-fa2a-4502-abb0-3b9716ada1b6", "comment": "Malware payload (Mirai)", "value": "ef37e96dc2cbb9951a835d653f3e02095411d63bb32153028250aeddd60149428ee2bb41a21a24faf01af17085af0ceb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772287182, "uuid": "c8e2541a-9f29-43c1-82fe-897698bbc072", "value": "T146E33B06731C0907C1A32EB43A3F67E193FFAAC121E4F644255FAB8A9571E361486ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772287182, "uuid": "4a5409e8-29ae-49a9-a302-e136d147c2d5", "value": "1536:vUDTFLKa1RvU1IWkPdxfTIrEPXuZGOtu7B74D3vAqjtzzuoeNDqKBNHko9C2:vUtRNWkPdxwE/067x4Eq6Eg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772287182, "uuid": "87b85eb7-6156-4803-bff5-54887e9bd087", "value": 146356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772287182, "uuid": "d3ceffee-de98-4c14-82e6-b537de5fdbb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772287182, "uuid": "bc015248-bf21-4520-9481-98a6c2294ee3", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fae86e58-1476-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772263667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772263667, "uuid": "493c060e-99ae-4cec-a53a-821481dd75a5", "comment": "Malware payload", "value": "ddddbd2c9e25af8e3ab8262b801e0b7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772263667, "uuid": "5c7c3f0c-b66e-46cb-82ba-723d1f16325c", "comment": "Malware payload", "value": "2530500848d9e217c175dd2329370a9bc3a2f69ba3f1d5c436594a6221279cf5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772263667, "uuid": "00ad427e-7ce1-427f-a4a9-f0972015316b", "comment": "Malware payload", "value": "a74382654be9cf9fd96168fa65f7385df9c85f77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772263667, "uuid": "0bb93223-4cf8-410c-9a87-b68f17aa6b75", "comment": "Malware payload", "value": "d8937102e37ca32db391ba5eca35375baef4fdbd59c0994b6c5ae74161441585247b0db4d89a6d18afb86e65e1c285dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772263667, "uuid": "631d4a8c-36f4-43f5-a9a8-c3e21284c77b", "value": "T13A32093FD168E8C8C4E587389D76D6B81BA2B18682322E7B5EC408E50413D78FB167E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772263667, "uuid": "24e3fbca-5a28-42d8-b862-3862a48f0c6c", "value": "192:ctmaecLXX05Z00NnaCfrauMZi7Kq5nISwFyX8YO5GsT0QmDSuJcj:9aFDEX1bfrkZipIS96a/cj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772263667, "uuid": "439b8506-f24c-470c-96c8-ca2368f1dde1", "value": 11916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772263667, "uuid": "6c73fdae-6321-4e5d-9afa-8aa35a985b0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772263667, "uuid": "af3e9cd6-14e3-4d81-a42a-707e15ad368e", "value": "bin.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d6acc1-14c8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772298553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772298553, "uuid": "5c05b48c-c48c-4af5-9528-249d4a154a38", "comment": "Malware payload (Mirai)", "value": "1f32880200db2b10f0c649086d95d025", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772298553, "uuid": "3c1e6dc8-c21f-4c15-b425-b5722b702f43", "comment": "Malware payload (Mirai)", "value": "25d1cfe16ffa3f9107b5aa906fa23123a0e3035747cf8a070f83a9597b05147e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772298553, "uuid": "c65aa1cb-4ad6-4ec3-bda9-3eae4a519f38", "comment": "Malware payload (Mirai)", "value": "2ff4d03b06decf1af367d9d5432a0dbf5b577bae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772298553, "uuid": "4e81c5e0-a5d7-4457-b35c-7f455a2f9844", "comment": "Malware payload (Mirai)", "value": "3c9352dbddd3bf5a65279a8794f48bc789ed71cb08ad5839b53ad5ec912a0e32e188dbef08b56f921bb819417de51860", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772298553, "uuid": "821652cb-9d58-41e3-bca8-64adf110d122", "value": "T1DF133AC1A643D1F2EC5212F5147B67628F76E4364A7DFA92EBA92531FC03B10960B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772298553, "uuid": "baa22025-da8e-4f0b-b5a6-0cfbf61e5208", "value": "768:QQaiSup66OkEgy5oD5YQuj4JsUTeU4wQOnsspVI/4bOGd7nX:QQaiSuptOkEX6D5YQ/JsUeUDtsspDbOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772298553, "uuid": "0b291164-5c98-4d7d-a2ab-40844030eac9", "value": 41840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772298553, "uuid": "ceb8655c-bb20-4957-82b2-690c484579b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772298553, "uuid": "d8fcec1c-8803-47bf-ab4e-551e982517b5", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9092ac-14e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772312659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312659, "uuid": "993fe197-03e3-4578-92f7-991dcad05fb6", "comment": "Malware payload", "value": "48eaa821dd460130835ef8c0d6176825", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312659, "uuid": "5652d041-da5d-481a-9592-ee8879e8c8e5", "comment": "Malware payload", "value": "26121f3c39d6ea0c1c67e8c0dfd24c296ddf5f49a670af8f939367c04f269495", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312659, "uuid": "0e84e0b4-e1ed-4a2a-b94f-4989bfeefffe", "comment": "Malware payload", "value": "501f7aa80daaae048ebbb8c88304a35954c0802b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312659, "uuid": "ce0264c4-e384-403c-b1b2-5c0c799d8c02", "comment": "Malware payload", "value": "40fc74b63477b897a3cca2837a4cacc86c0bc00f52e610577462def41c2ac3f3bb4f972ff6e527940ae170b12e3f0922", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312659, "uuid": "9341a0a4-02df-4062-9839-38ec775b3d99", "value": "T126963907ECA544A8C4EDD67086768653BE717C895B3027D32B60F7682F77BD06ABA340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312659, "uuid": "12dca7f7-0c2a-43bc-a2ac-5378a7c1c2d5", "value": "98304:Xg8a7vUA4t3qCgZdWNJIaE57PiQZi/goelbKdm:U4t3qCtNJIH5jO/gKm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772312659, "uuid": "93813d1e-1051-4595-af03-789327f894a6", "value": 8945816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772312659, "uuid": "2545cc72-19ae-4a78-a99a-cd1d11cde6c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312659, "uuid": "2523b612-8335-4fd6-a8b3-07326ef09f46", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdff0afb-14b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772290730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290730, "uuid": "cee68363-3222-4143-890c-37104f4b8de0", "comment": "Malware payload (Mirai)", "value": "449fa7f428c8c8f938fc2633adf9037d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290730, "uuid": "405c3941-5a83-455e-a471-100f6d3b1150", "comment": "Malware payload (Mirai)", "value": "269712c263285a50fc6b065e2d6f77a889456f75eb6f067810a0989aec56fef0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290730, "uuid": "5ea2cee8-67f5-4085-98a9-d7ef1fdccdfc", "comment": "Malware payload (Mirai)", "value": "bda48619caba98af01359524d32a2d6cb1bfa213", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290730, "uuid": "9fdccf4d-f555-4436-972c-4959b456f193", "comment": "Malware payload (Mirai)", "value": "9fb52d3d221b7af97d2f0af32b9a1cd67e443263edd4742f9879ad4ee292cad009d3fe7960096a7178fbfa60b2b78eba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290730, "uuid": "3f6b3ea3-e002-426d-9e60-b39cf8829359", "value": "T16B234BD6B401AE3CF95EEBBE80564E09F5303354A4930B2752A7FD93AC330985E56E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290730, "uuid": "524e1ca1-15f6-4cad-a3f7-464efc67ef49", "value": "768:uEeh9nqjz2yCIF0sF2JHRnHyyuiWesEXpCP+JT7BNN2g18yi:xq9nq32/c0tnyLip1CP+JfBNN2s81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772290730, "uuid": "352e05be-eee4-45b8-9672-938d9854dfe8", "value": 47468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772290730, "uuid": "b684500d-aa6c-4990-bf87-91621f397e1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290730, "uuid": "740d123f-c974-497c-8956-8e41b1c0305d", "value": "hoho.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a1db81-14e6-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyNote)", "timestamp": 1772311606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772311606, "uuid": "483304b4-856f-4220-adf1-35a6122c22e2", "comment": "Malware payload (SpyNote)", "value": "e4a0a141f026ef5160521e8483c2fe77", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeTelegram", "colour": "#FF4C93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772311606, "uuid": "78890ae3-5425-4dbb-a9b8-17f8b015e0f5", "comment": "Malware payload (SpyNote)", "value": "2b6d20746ed11f62b35a7c29d1912de18248e9e10247c29a6ee0929877a57d77", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeTelegram", "colour": "#FF4C93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772311606, "uuid": "aa1ee3c3-7b32-46be-9bdf-51051149470a", "comment": "Malware payload (SpyNote)", "value": "da27bda158a85f6973a67430d3914037a8084660", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeTelegram", "colour": "#FF4C93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772311606, "uuid": "ff1be7bd-565f-4eca-8f5a-a14358d1e2da", "comment": "Malware payload (SpyNote)", "value": "1b8df10465458eabb9f870a0ad26477c85cd58ce9b83fd8082506dca151f84bc4e58fce67f7b46de6d77c79ba5d15068", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeTelegram", "colour": "#FF4C93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772311606, "uuid": "8d26ce9b-ec17-452a-abee-29235dda5508", "value": "T1A566E003FD09CB9AE6B98374D63B558237437F07C880466B0608B26F6B739D937D9989", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772311606, "uuid": "c34d201b-4ff9-491b-99ec-e16f41396c72", "value": "98304:dsWIuYaD+LG45XVS+RJfLXo1MmBolvfzkmzBzBFTI0tpnNwzrx9y:dsWIuj45p4M4+fz5zxEN9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772311606, "uuid": "5a240463-3582-450e-9660-98368563f3c0", "value": 6562703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772311606, "uuid": "d687911f-a92d-4220-a764-d9cb7d780eed", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772311606, "uuid": "b9899320-80a0-4f77-bef5-eb1d8f48a0d8", "value": "Encrypted_Signed (2).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4801e6bd-1450-11f1-a769-42010a9c0008", "comment": "Malware payload (MuckStealer)", "timestamp": 1772247046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772247046, "uuid": "fc27622d-a47e-43fc-b25a-01f88de288d2", "comment": "Malware payload (MuckStealer)", "value": "62c207d866ecc21ecfeaf2cbd12680ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MuckStealer", "colour": "#B883E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772247046, "uuid": "c53169da-37bd-42b3-bba8-a9b477ec65fc", "comment": "Malware payload (MuckStealer)", "value": "2bbc785956c3eeaad2baa46b9b75998dca8d8dec106d28cedce99baa16474850", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MuckStealer", "colour": "#B883E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772247046, "uuid": "2ad75f9a-5235-45a6-b1f4-ce6f238850c4", "comment": "Malware payload (MuckStealer)", "value": "f01874a8e57ebd48bd0174f86506176400b40063", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MuckStealer", "colour": "#B883E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772247046, "uuid": "48a6d99e-3f4c-437c-a5fa-82442b36d886", "comment": "Malware payload (MuckStealer)", "value": "43b0c47f491b136a2544a159aa488a084592815a85dc1abc90dec382f18c2123acb97eddea63d22b05610f6c37721248", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MuckStealer", "colour": "#B883E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772247046, "uuid": "e62964f3-9b01-4e40-82e3-030f997e6129", "value": "T11F17335042D20A37D9D7F23A11BA46A3E2B2B4840F72995F1F98572A3F771E14D3BB90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772247046, "uuid": "92bc3c2d-8c66-4928-a575-c7462a54e0a2", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772247046, "uuid": "85346782-fdf1-439e-9986-3aabd3600050", "value": "393216:Tqw+gtb5eorxD51yUdq1B7fRYgwEHsn4qSwB0pifgw4:Tqw+0HrxD51yUg1RJgzSo0ph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772247046, "uuid": "08b6b0b4-a184-49de-b260-e9029f26e5bc", "value": 18801212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772247046, "uuid": "0416d104-3228-4a6c-98f5-b74afdd82bc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772247046, "uuid": "4e68b545-3cb0-4eaa-b2b0-d7d9e43d3bd7", "value": "yo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b27186ab-14e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772309501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772309501, "uuid": "5e975609-7f53-44a7-8269-80da5a3153a7", "comment": "Malware payload (Mirai)", "value": "c13cfddd3cd48dab65fd92ef96c342c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772309501, "uuid": "9ccf1607-1a1b-4dd8-857d-6bb90493a4cc", "comment": "Malware payload (Mirai)", "value": "2e6c6f5a0532054eea876c6d225f1e70d8d24d9952d6aecef799cb6948bc9c0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772309501, "uuid": "7ff895b3-fa51-41f1-96e3-29d0189a4b31", "comment": "Malware payload (Mirai)", "value": "91d600a9754f9753bfedfaf719c2bd09953e9673", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772309501, "uuid": "b289bcad-6e3d-4754-8fbe-c98261056505", "comment": "Malware payload (Mirai)", "value": "5a1ed19e6c8644c9627fde62e95f8e49f33478f2afcbe5581e15a12061c5c3782e341f192a3e4f3cdf4b6745c6f5195a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772309501, "uuid": "349e15bd-ff7c-450d-86ae-f28822608974", "value": "T11583951A3E21CFBEF75D863047F78D21968537962AE1C545F15CEE080E6028E785FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772309501, "uuid": "bfbb0e01-afa2-4a07-9377-c3f28fe78726", "value": "1536:tIMhWvMSZHQjDNLbL6A4Tnl/Fjk83m/48k0:t9kebL6nl/h8wQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772309501, "uuid": "6e7c6120-fa82-4e61-bb87-7bb6982eeddd", "value": 82272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772309501, "uuid": "25138640-c8ee-4cc8-8ba0-1d61a0600f03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772309501, "uuid": "ce3706d9-05e0-40c0-bc58-55f1efa06dee", "value": "Hilix.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0daef3-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772289303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289303, "uuid": "451f062e-4f37-44c4-a362-edbb532441d2", "comment": "Malware payload (Mirai)", "value": "67b0d778a0671a6b37f8d021159be0b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289303, "uuid": "bfe8e4a4-8fed-4107-b855-81c92cb3e56d", "comment": "Malware payload (Mirai)", "value": "2eb0c2cfe2445b23a7640a09b4fec6c504bceee46b9bb9a869ff6eecfa0d10e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289303, "uuid": "8ef27392-fcfc-43f6-a2ea-0406ad674362", "comment": "Malware payload (Mirai)", "value": "28d3c89b154447eea1e20f70fb88cee1af0c9cea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289303, "uuid": "3786683b-e112-452f-8859-4ac3180a5698", "comment": "Malware payload (Mirai)", "value": "9c40940b41ca80c99a6139286375527a1fa59d4df199581a0abaa81e8c6a4cf9101b495bab14608364e6cd62ccc58d5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289303, "uuid": "07f1e75c-7461-4759-8296-89222148ba1c", "value": "T1B4736CC2B643D0F1E92606726277FB324633E13E0069DE42D7A9D836ED53A41E2663DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289303, "uuid": "d84d9843-d667-4f7b-85f7-826a8992ba91", "value": "1536:ANWiaOh1gL4rLIGYljOznfEVm5QR3f9T2ZA9rEZsS4BRSTALdB9:KNsL4rMdjKcVKQR3YZAJgtaLdB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289303, "uuid": "1db937a1-d700-4670-a7ab-dd187b970785", "value": 80272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289303, "uuid": "cf16fa7b-5024-42a4-898d-370efb549040", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289303, "uuid": "603d6a61-14ea-40e0-ad66-151ab8a23f67", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df2e48f4-14f8-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772319455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772319455, "uuid": "30cfdcb6-3f7f-4c83-a338-ab4dffe61792", "comment": "Malware payload (Smoke Loader)", "value": "d28083b3fadecfb785f2324c68aa8aaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772319455, "uuid": "ea417437-2cfd-4daf-b2eb-28dd5a8bdf43", "comment": "Malware payload (Smoke Loader)", "value": "2ec0617f5b338d415fb6d28744f68e0f19304e24860f7b77c180b09af10b3834", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772319455, "uuid": "8238f218-3c4d-4b36-97ab-b28b0a5bfda7", "comment": "Malware payload (Smoke Loader)", "value": "256abbd105f2b0d4abbdd3b29504af38079029f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772319455, "uuid": "ac8493db-ee18-4513-8761-309579231056", "comment": "Malware payload (Smoke Loader)", "value": "25d2dec2f4c6de0f8d1f6a1adfc6f02852dcf65b177f091c6edb481ed647dfaa68e18b592b536cf999bf468ca1eac282", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772319455, "uuid": "2689a2d3-6478-40bc-9f44-be376d7487c8", "value": "T16687BE17B7E84061D0BB9234897B9756E775BC21073092CF2250BA6E6F73BD05E3A722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772319455, "uuid": "1b4214a7-77f6-43a3-a5e4-e6716a6d35d3", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772319455, "uuid": "b5acb95d-e24f-4617-87d2-1e5eb0b46ec7", "value": "786432:dfFXZm62jWXolo/73NkkUOaA+D49c6aLT:zXE62oo+/D+iaXmc6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772319455, "uuid": "09c2323a-23ef-4088-af24-5c6303068297", "value": 38806576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772319455, "uuid": "84f78a98-a5f0-4896-b38e-c55164242e9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772319455, "uuid": "735acd9f-ed74-4aff-a318-fcf55c1cb27d", "value": "2ec0617f5b338d415fb6d28744f68e0f19304e24860f7b77c180b09af10b3834", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a102d0-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772289240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289240, "uuid": "f7a71db7-3706-4bcc-92c4-366887e3e286", "comment": "Malware payload (Mirai)", "value": "d27f558130b3cd6e1db5fe4ea0088f11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289240, "uuid": "52ed06d2-a323-4e95-8b23-63ca2343727d", "comment": "Malware payload (Mirai)", "value": "2fb7cb98eab2f6445437455ca13b4a24f212ccf81cebb3ade7551c5a7de8d2bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289240, "uuid": "23a47c43-cab2-498b-b691-353ca2d2d1db", "comment": "Malware payload (Mirai)", "value": "4c7bb9b79145aa1fbf14ac9d835e19f40e75533f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289240, "uuid": "23acb0fa-8b77-466c-85fe-bfe8c5975629", "comment": "Malware payload (Mirai)", "value": "11958abe0377a0157f50a2b805bf367bfd23d6d2a65cd0a7f42ac78f3737e55fa0b0df754049a512d5b630b866288630", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289240, "uuid": "b920151d-613e-4b02-be68-8b0ab434d145", "value": "T19583AD73C86A0D28D44844F0B0A4AF3597A3E116C5972FF69896C679E08BEDCF6423F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289240, "uuid": "209ae163-6760-42d5-87cf-b6314db50087", "value": "1536:CDJrwx2Pvotqaezv70GjKeB2np24ybCn8FH/SmpC:CxwxtizDLGe024yb1paF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289240, "uuid": "bc7ee9d6-5d3f-43bb-8346-1ec3350d0296", "value": 81160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289240, "uuid": "ba5e4746-bf1d-4eeb-a65e-959b10e0af80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289240, "uuid": "59051304-1a90-46c9-948a-3586fdfc6dbb", "value": "nwfaiehg4ewijfgriehgirehaughrarg.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f279d1-1467-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772256860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772256860, "uuid": "d22cb7af-4788-45ba-b184-9af8442abaae", "comment": "Malware payload (AsyncRAT)", "value": "6ccf23fa5355e185ff5bd1d41a45d4f7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772256860, "uuid": "8445d5de-9922-4bea-851b-25ecadd15d3b", "comment": "Malware payload (AsyncRAT)", "value": "30cb6693ed01e12ab1d22e04315f1020f89c4e99ce7c5c5d9aab36487108c9e1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772256860, "uuid": "392feef0-d4c0-4633-9f14-383ee94c4466", "comment": "Malware payload (AsyncRAT)", "value": "9c423976054c5f0c35d2311a2788d03aac8c6feb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772256860, "uuid": "05564466-96c4-432a-8c0f-9c9c897417ee", "comment": "Malware payload (AsyncRAT)", "value": "7863d15dd7de41a54d2ca6adaf6217df9ec11aa7220257886807375bdc540d2794ace57abf2d84b3f971618acbac0a9c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772256860, "uuid": "b5aae0ed-1baf-48de-88b7-0d7824ad038f", "value": "T146D24A08B3D48561E1FD57B94D7293048775EE4BA963DB9E1FC440AE2623B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772256860, "uuid": "46a54e53-4048-4f81-9b78-10dbd9a5d9c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772256860, "uuid": "341aa1d9-8204-4b5d-89a7-d2d85c704235", "value": "768:RzCiRXbBJYMgsg/cIRGqou/Rb7fB/dTR/+:R+iRXFJYMgN1igRbN/P/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772256860, "uuid": "fb1ea56c-883b-4cce-880b-e51bc51f0673", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772256860, "uuid": "4d412fb5-470c-4727-a492-3cbc4c2af2e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772256860, "uuid": "cb6b3d84-1c9c-4dbd-a853-e7aa86ddb33a", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf67f33a-14a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772282921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772282921, "uuid": "cb04310c-127c-4129-bf42-d5565f2604da", "comment": "Malware payload (Vidar)", "value": "033e856ab3f3cb8a12e4b89c6b5891f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772282921, "uuid": "d173eb53-bb91-41e4-bc21-99a6d5a452fb", "comment": "Malware payload (Vidar)", "value": "3111fce31bbf05392b16fe620d01ce4c49661cde33682d2a8a277eefffca1c49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772282921, "uuid": "13af97e8-99aa-43b6-86be-4b517af317a7", "comment": "Malware payload (Vidar)", "value": "e4878cb294e6a8ca4594442e7f2afd735aab4135", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772282921, "uuid": "b7f68b4f-4153-4b01-a2fc-1bfc1214e76d", "comment": "Malware payload (Vidar)", "value": "669286cb1995ac7d1784f3f554e6c9f66bfa68d4b8ab9dab4b7e12c836bf12a76cfb4d89125eda5371b647eb729ae81e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772282921, "uuid": "ec950183-e06e-4e7a-aa40-e6b2ff12ff9b", "value": "T137B58C0B7DD558E6D86EA372DCBB11863774BC180B3233D31A58BA782E726D19C79708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772282921, "uuid": "903f84b1-160e-4532-b273-2573264cd9b4", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772282921, "uuid": "a5191251-d6e0-4c6e-afcc-c722520692f9", "value": "49152:eEv8MyJi1ccHw2IwHP5qszQP/lhYEtpoMPUnh:eE5u7hwHP5qszQnLYEtpoM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772282921, "uuid": "4b7584ce-2fa5-4630-ba7d-d983c45f03b3", "value": 2375328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772282921, "uuid": "d7d7f834-0cdb-43b8-b07a-84157126f17d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772282921, "uuid": "f2980747-43e5-4ac9-af46-1f0082ae4801", "value": "S\u0435t_u\u0440 [U\u0420D].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a8acfa-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772289233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289233, "uuid": "97b37813-f716-4110-b850-4e93854c6e90", "comment": "Malware payload (Mirai)", "value": "a160ea6b7318bff2f1db5ccf7fd36daf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289233, "uuid": "48fed435-236f-4895-bdf2-5f6b5913bfe1", "comment": "Malware payload (Mirai)", "value": "314f44fa3879fd01ec61eea36b7aa02d9753339bb607072260596892b3f85966", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289233, "uuid": "66d32d9e-2be7-48f2-93c8-847ee40413fe", "comment": "Malware payload (Mirai)", "value": "2e69b18447c53ebc18e98f36423c4eb801ed44e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289233, "uuid": "6ef031ac-79b2-4db3-9ab6-d1bcdfe824bf", "comment": "Malware payload (Mirai)", "value": "2bef452d75e63e2157c42e31107db3df9063dc42dc12987019d59ae5799b78577005a3dc5e92f1391f330059b6f0f086", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289233, "uuid": "c626e34e-85d9-46f4-950b-e91681e0df26", "value": "T1B8A338D7B801DD7DF84EDBB744530506F131E3A219830F76626BB9A7ED351A81826EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289233, "uuid": "e5e32d37-8e25-4670-8c47-71267c40c14b", "value": "1536:UTkppk4+e92b1AvxtY1XY7og+8IxDTyi2lbYqdbfCb4lKemRsaqkYf:fl2R24XY7ogekbldLFmRsFRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289233, "uuid": "878092d6-c07a-46ad-a85a-ff540f183fe0", "value": 98700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289233, "uuid": "14a78b5f-4ab5-4d6f-aca3-0b23624e6df9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289233, "uuid": "eb58add9-bbaa-4672-a409-f2a5e32568bd", "value": "nwfaiehg4ewijfgriehgirehaughrarg.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2edd48b8-14d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772303268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303268, "uuid": "f79c79e9-e651-4f2c-8119-9e0b9047e27e", "comment": "Malware payload (Mirai)", "value": "509e7114d45ffbdd999a8e2257cb4f4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303268, "uuid": "de1be827-20e9-47c2-af53-480035d64385", "comment": "Malware payload (Mirai)", "value": "31af34400c260dbb02de00f976709cce410de17dbc66123cfb11f42f4a3beb08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303268, "uuid": "ee80744b-4d7b-40b9-b214-354cfaca96b3", "comment": "Malware payload (Mirai)", "value": "6f5e10974306b485a5a5753af31a94c590c0dcef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303268, "uuid": "b2383651-e898-42c4-81d3-b6a1f96f315a", "comment": "Malware payload (Mirai)", "value": "be265899024a20d0b8b9d98fad60cfc6540827eb6237d3bb2f114ea1011b212e47330322f1103042c850ae547c52245c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303268, "uuid": "3780c3ea-8deb-47ec-9e2d-06ae124d00e6", "value": "T1CF2329035491C0FDC955C270AB3FA636C922F47E123AB59D73E0BE226E4AE311F5A589", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303268, "uuid": "e5e29449-1c34-4d80-afc8-4de1014728a7", "value": "768:FkrR8ysZAY+OGZZRw4xywPtKOojvHjKRDACGyjltp4B6gC:6d8y2+OOpyrDckCGyp4B6gC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772303268, "uuid": "3c3e4808-a51f-464d-80e5-4711328c4605", "value": 46400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772303268, "uuid": "648da98b-1a19-4f2b-85c6-6cacdd9f9170", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303268, "uuid": "2a53a18b-914d-4765-bda3-8f205e4da656", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8907be39-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772289246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289246, "uuid": "3ea7bc14-5e3b-4e68-9661-98810d9adf2d", "comment": "Malware payload (Mirai)", "value": "ed927733ff3c4d7840c3f39b687b333b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289246, "uuid": "b8860fa9-a150-4eb7-909d-1c03460a6d27", "comment": "Malware payload (Mirai)", "value": "3256c835e73b163a6cfabc8d9bd25f589bfeaae780af4acb89f57cb163bb7ef8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289246, "uuid": "b73fb74c-3cd6-4e19-8e03-ecc1883c2c91", "comment": "Malware payload (Mirai)", "value": "45c9dc8a4ed4323779ee5d0b305b49ac7de465f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289246, "uuid": "f1e4e4da-86c7-4061-92af-09cde0e6498d", "comment": "Malware payload (Mirai)", "value": "bba07c33b8b2e85417015549b93d4e8cdd678e3a22d763400e54ec258e840865f630e23d7dfc39d7af56222a5ee7fb7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289246, "uuid": "3c2efbe6-0b81-443d-8255-3d5ca07cd772", "value": "T15303F207FD7DCFC0E43622B46A7DF22E01D8E60D26EAD9555BD0D40F64D6FA90E28889", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289246, "uuid": "712802bc-6b4b-4ccc-acad-7b7c9ed7990c", "value": "768:/2mC2QJ/9tQZnzu9JDVVQ0jTnhbkWeaXvKwZWKLk+D62KwdqqJCPJnbcuyD7UtQq:kJFy5zq/nhAWeaSwZWKLDJgnouy8tyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289246, "uuid": "36a26397-c4d2-45cb-99b0-9be4af7473d5", "value": 39348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289246, "uuid": "4cc90b4b-e903-43f2-9c7e-7e26b6e2c3ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289246, "uuid": "5c3f31cc-a688-41ed-ae95-c2ea80331099", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c890ab-1498-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772277934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772277934, "uuid": "baf1187b-a5fc-40a5-9ea3-69089dce7786", "comment": "Malware payload (QuasarRAT)", "value": "6cdc1131f1f4de668c93dbda6d946428", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772277934, "uuid": "9cb863b7-967d-43ac-afa5-558b5e5bc187", "comment": "Malware payload (QuasarRAT)", "value": "36604beade276848704a2d980d46402eb2bd3e2465eb9ee3a3bf93dd3bbc905a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772277934, "uuid": "c322cfa2-d032-40ee-a401-ceb24c1d1cb3", "comment": "Malware payload (QuasarRAT)", "value": "6f2e9a87f1a1de7418e2bc96a240a92b6de6c277", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772277934, "uuid": "6744cb27-c245-4812-baa1-240a0e266894", "comment": "Malware payload (QuasarRAT)", "value": "6ec1eb8afc1174c9fd42009330e51d5ac4ef9b60ce2c929e7a3060895b63bbe242d4e4d277851185c0bcfe7e10a0b4d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772277934, "uuid": "e6f58c52-30cf-4cbf-a852-4a477385487d", "value": "T107138D4A9B9CC62FDA6F4E3D74A2191156B2E3912503DBC62DCCA5FEEDC7300061678B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772277934, "uuid": "a2f8ad3e-2e07-4704-81b1-49c074dc9849", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772277934, "uuid": "72ff6c3a-fd16-41f5-8f9a-c7fff5db8e28", "value": "768:1mQZqx1lYcTYbFiAnSSfafH9pRXbYC1vkAsFr1Vhn5ALA:10lY4eRfafH9ptbWAszr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772277934, "uuid": "63bb2b23-2133-4f31-8970-2f17e8ab086a", "value": 42600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772277934, "uuid": "055853be-703d-454c-a105-f307f499d3ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772277934, "uuid": "e4d8ec68-2b27-407b-b5c2-4cb663f65b4d", "value": "cs2external.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04199758-144d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772245643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245643, "uuid": "76e6bb23-05ab-4197-86b5-f893d7a6ca57", "comment": "Malware payload (Mirai)", "value": "e8d6f001b29b139e099b462318ebee42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245643, "uuid": "0d187786-1b5f-421b-83b6-b44841a4b4b5", "comment": "Malware payload (Mirai)", "value": "36c7b3f0929578f7d3f7753d5c2f9e5e2ed306bdccfc21e5f733519c505874cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245643, "uuid": "971da3e9-7d8e-49e3-8484-42dfa6d3d538", "comment": "Malware payload (Mirai)", "value": "b0d3d4b75afc541b258400872c3c5c44a0b432f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245643, "uuid": "216cdd5c-4f54-4739-bb69-08a09d4da0c8", "comment": "Malware payload (Mirai)", "value": "d87cc1b99681ebffafac55b22e86c97a399002ba3020a8ad2e7ecfc157d60e3775819178ea989a9f06d51cf5603e90f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772245643, "uuid": "37450340-286f-45c8-91c0-7c6b99625097", "value": "T13CE33B06731C0907C1A32EB43A3F67E193FFAAC121E4F644255FAB8A9571E361486ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772245643, "uuid": "47624578-69ff-4dfa-ad03-4145894d2f88", "value": "1536:vUDTFLKa1R9U1IWkPdxfTIrEPXuZGOtu7B74D3vAqjtzzuoeNDqKBNHko9C2:vUtR/WkPdxwE/067x4Eq6Eg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772245643, "uuid": "7c4f415b-f0a0-4b2a-8c14-b5b1482decd2", "value": 146356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772245643, "uuid": "a6373c23-bcb2-4dcb-b553-596df23743a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772245643, "uuid": "b0cd696d-3071-4358-b83c-451afcb93fcc", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559a4e08-148f-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772274127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274127, "uuid": "bd49ed9f-8777-4573-8b3a-2ae67c7dfe9b", "comment": "Malware payload (PhantomStealer)", "value": "7d3775fa6ab4f262764297ed4e757a94", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274127, "uuid": "1adb6c05-99f8-4b25-939c-2e80317f3208", "comment": "Malware payload (PhantomStealer)", "value": "376ced6fd4de2d9ddb03fb555b76aea4aa5fa69f5872edf25227ec05b88f021f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274127, "uuid": "527f67de-89a8-4d80-86cd-3293c8939e40", "comment": "Malware payload (PhantomStealer)", "value": "54a4b0348f166fc409ad654f968caadfd5afd136", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274127, "uuid": "bb8d997b-1567-4d8b-9562-648a5e55394a", "comment": "Malware payload (PhantomStealer)", "value": "201864ea7bce2303e7dfdc99e8b0c0e638a86ed072db65e7d02efb7176c7d82374d3948d334d39ce70817de664293cd6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274127, "uuid": "bcc67c05-3d76-4851-a988-3f4e60149200", "value": "T106969FB5C649BA30CEC53A2A5CE4E84B03B1E0D79AF4B01E75A379459EEFE1C914F844", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274127, "uuid": "5a1fe900-2388-44b8-b4ab-30c49c0a3871", "value": "49152:tXd1YuRuJ6mgk7Iqr9Z6SRFSNx0Q1sMgjoK3APL6ejMy/6Xd1YuRuJ6mgk7Iqr94:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772274127, "uuid": "bceaa34a-ddce-47e1-8011-58d9f253550d", "value": 9261976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772274127, "uuid": "cce3af04-ef55-442b-b9d4-d2af5da0eaa6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274127, "uuid": "5f8015a1-60aa-4fe0-b7c1-7d14f5848af0", "value": "7d3775fa6ab4f262764297ed4e757a94.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17100074-14de-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772307952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772307952, "uuid": "2b9dfc87-5db5-4f81-bca1-47a797e408d1", "comment": "Malware payload", "value": "332ab71873c8884e98d1cd7f606851c6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772307952, "uuid": "5987937e-0fe5-45fa-b1b4-6b9cc420fb43", "comment": "Malware payload", "value": "37b9cf8e5db0c70ea36c63f6ca3bc0eaa5a15365153c30e4707759026d38ccb6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772307952, "uuid": "0b93aadd-b2c2-4fab-926c-8c119a6aa906", "comment": "Malware payload", "value": "2569138575f47d69eef7af5ba425419352dfb285", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772307952, "uuid": "4f7a5fbe-cd04-47b5-b15c-d0204876b8b9", "comment": "Malware payload", "value": "5e1f51eada91435fe9d8f582d2fbc35fe9d779132323362c008ee51c54ee8554be7f30690bb4a1d3f00c61dda578dd0e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772307952, "uuid": "4d93c853-7d77-4e08-b7a4-07607163cd44", "value": "T1D1F0DD02EA022E9053308D0E83E23B5A436003F1F45D3E6982E58DEA0FAD8823557EF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772307952, "uuid": "52072399-34ba-4644-93c7-9e04d215bed0", "value": "12:8q0HsOt1VvhsSsXG+nsqz4jGOXtlp8kYV0VyVIVs6X:8RHsOt1xhYXoqz4jGimJmYCS6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772307952, "uuid": "d767d9fa-f650-4e5b-8633-3f2bbb6e0144", "value": 609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772307952, "uuid": "f687b180-2fe1-45e7-98f1-b23874533e33", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772307952, "uuid": "2f21dec7-bc7f-480d-a8f0-8345495c9fe6", "value": "l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "040f5c3c-1450-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772246932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772246932, "uuid": "c749fc8d-b096-4fe7-8ff6-174240978670", "comment": "Malware payload (Vidar)", "value": "c3e6861b181ed8a82f287a77bb22f1ed", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772246932, "uuid": "412931f2-c8fd-496c-a49a-a94c954fc9c6", "comment": "Malware payload (Vidar)", "value": "3c18322820fbc1360a52c9df7c3fbc35012a5d76f38c5d51169609e5cc529f83", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772246932, "uuid": "afed768f-3a06-4d6e-bc3e-f1ee3b0aca4d", "comment": "Malware payload (Vidar)", "value": "d03c33e118cbafb281f0ddd811549544d28b5093", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772246932, "uuid": "30d5fe91-d32d-49bd-a4d8-330a7e967893", "comment": "Malware payload (Vidar)", "value": "d50f3b6ff2ef256b1b29e15f8178ff54ed50f8dba023c3e84d9295a44b3ecfbd39e791d8fb9cfab8bb83dea5847f1585", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772246932, "uuid": "60dbe3c5-d65d-4c59-aaa1-35a40298f4cc", "value": "T1B8D42BBDAC60E376F60CD0BAE286D3538F2139011236AA9319BD97241245473DB677FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772246932, "uuid": "48065053-4bea-4c6a-a6b2-0af464e77dd3", "value": "32235cfbe2c6b05c5b53af4a209e0eaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772246932, "uuid": "91324b45-a665-47ed-81c4-c7f2bea8b3b7", "value": "12288:WPyurkSSu5EkPm8b7k4ao/CXjp4JgtU8F6CmSYw2g:WPTrk5u5EkPb7jgjp4JS36UYw2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772246932, "uuid": "c6ffe996-8006-4bec-b37c-f14a3e5f5617", "value": 629760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772246932, "uuid": "78281b7b-c28a-40ce-97a0-b40881d01197", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772246932, "uuid": "69fa5395-6c55-4a6f-9749-4e0ef09d870b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16122bb0-1499-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772278315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772278315, "uuid": "faf596ef-2c66-4acf-be73-1b20d321dc10", "comment": "Malware payload", "value": "41e12b427da1714e4cb1d10c27aad484", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772278315, "uuid": "0f98dfe1-d65d-4896-be8f-ffcd29fef833", "comment": "Malware payload", "value": "3e283ed7c49c4e18c5cae999770030bb5a0c67a16eea1b88bfb5192f5a9218b1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772278315, "uuid": "738a36b4-faa8-48ca-a952-bcb31a93be48", "comment": "Malware payload", "value": "6da95702a5bd20398257cd22ec5a00d6811bf288", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772278315, "uuid": "1ae3724f-23fb-4f47-97d3-f7a1ab2cc841", "comment": "Malware payload", "value": "343b497c924295b114ba14e90cc0569689f5d380da67896923bd637413d8c6a1206b9591652b712498b8af1089680b39", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772278315, "uuid": "986aebd5-497f-4d16-b121-bf82c8b681bf", "value": "T1B3266C16FDC718B6E50627F38AA6529E3334D8062B769B83A9103B3DE9F72C55C36305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772278315, "uuid": "078aa871-c4f1-42fa-a967-3f68ea61b17f", "value": "e1ae426c19805cb24163e22ba620a0cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772278315, "uuid": "b9555995-8675-44ba-a0f2-d05ac82563fc", "value": "49152:noWyChf6FLTLU9ivMGkEYUQNF+h2qkMowUy9HX3guoTZYa6cr1RN2:ochSLTLuhNF++RwTQuoTZYa6O1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772278315, "uuid": "f0f48729-f0fd-4935-a1c2-c13bc68fd298", "value": 4468740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772278315, "uuid": "f6e37617-fc23-46ba-93c8-8293ac876346", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772278315, "uuid": "55be58a1-c128-4bcc-9f8b-29519c789a3e", "value": "LightShot.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead050c3-14e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772312173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312173, "uuid": "2b9bb456-4f41-4663-a993-a0f105b939c1", "comment": "Malware payload (Mirai)", "value": "7cc63b64ca23ecb5b4492d51853b39b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312173, "uuid": "9f6eca0f-9856-482b-b60e-c36e4cc3428e", "comment": "Malware payload (Mirai)", "value": "3ef96e6c900626eb01a3b9984c9cf31356805d36b6076cb530aff301cc17e088", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312173, "uuid": "f2662f16-69aa-4d65-907d-5ea5887024cb", "comment": "Malware payload (Mirai)", "value": "73c6fdf43f5e1e0646fa68a3434747dd0ae190ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312173, "uuid": "06e0af83-c103-4f4d-9aa4-3948e6ed0df3", "comment": "Malware payload (Mirai)", "value": "03d153ebd7a375b699bcf776b0dc96c115ff015e4174774c31b3e72f7e51271b0baaeed5fcb92f76bf1ec3124bee0191", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312173, "uuid": "2b2864f7-f444-448b-b198-9ebcf7963bee", "value": "T18E834B9AF400DDBDF44BDAFA41230919B532A2204EA30F27B767FC97BC721E48916D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312173, "uuid": "541ec1a1-e66f-42cc-a845-165e33ec3d02", "value": "1536:U9OZKLtAYfCo5kqdZR7YrHcaarLmEzKx8jq3JZyb2auq/CTXeFog9s2T:U6KxAYfkqhYHaPPzKHi2Hq64VT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772312173, "uuid": "eb280b6e-40d1-4c01-bb66-ba3b5c1fd3dd", "value": 84684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772312173, "uuid": "913b7e56-b727-459e-b10d-1e1aae8da770", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312173, "uuid": "502d48de-8053-44da-9d91-8bd7ee84f64c", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf033d1-14b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772290727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290727, "uuid": "3037a24f-495e-46a5-b6d4-eec1b4c6af63", "comment": "Malware payload (Mirai)", "value": "c7453dbd75a035f498872687f9d387c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290727, "uuid": "da2e3747-8f5c-44cb-9246-3f75bc8e771f", "comment": "Malware payload (Mirai)", "value": "3f3ca2f0a45689ce1e328b85c75adfc80134890fc81fbc7edc3b4e86f8847c43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290727, "uuid": "b6043cf0-bc7c-4d6b-a455-2ec152d05e99", "comment": "Malware payload (Mirai)", "value": "bed966ffa4da8aef766830adff6aa305555e1062", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290727, "uuid": "b14eaea1-3d0c-4886-be39-450c51632da3", "comment": "Malware payload (Mirai)", "value": "0a12488d974c25abbc0e56e3ba68d389a651cc954552dbbc76e2e27deb89cffb2475d593a3f748674107d8070bc2038e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290727, "uuid": "4f2ad370-9c87-413c-84ed-9e2526578a15", "value": "T17A430945B8818A15C9D413BAFE2E118E331767ACD3DFB2129D106F147BCA92F0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290727, "uuid": "1de1a582-8f97-4e99-853a-b45b9857ac02", "value": "1536:QdnCi3yBAtV5YaQQCB+fjOMCdKrBLtIbiQzeZKWH:CCBM7YHmvCd3zeZKWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772290727, "uuid": "29900cba-b9f0-4f91-8d59-11bbec9556b2", "value": 58496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772290727, "uuid": "c57eb1c4-68d2-4946-85de-b8731e8db3f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290727, "uuid": "09df10f5-3930-4dcf-876c-2a3a6b94815f", "value": "hoho.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "344658fc-1466-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772256462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772256462, "uuid": "4313af63-f154-44c8-a8e3-8b53c3fe1814", "comment": "Malware payload", "value": "636fe5d8ed1ad92b490854cfc2c11b86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772256462, "uuid": "1a764075-bba8-4b93-9c09-6418ab80e96c", "comment": "Malware payload", "value": "403ed4b0217fa0092e9e7ad8cb0f8cacfe9a501f35470e446136e7ca4d475b29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772256462, "uuid": "b4737549-47a5-4dc6-9a05-e14815b60096", "comment": "Malware payload", "value": "b189dffb2daf5ef72ed682597ab467e0ae0a7d00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772256462, "uuid": "9448a4a4-33f0-4594-bd61-59107af4d64f", "comment": "Malware payload", "value": "0d6b37d032b4a09d84bc8190ea6905acfbbdb534423511fddf026747b48e491af0c9a4910f598833e0e6ba547e3b6941", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772256462, "uuid": "a9f68c87-5b76-445f-ab8d-327933db0671", "value": "T186F7594262EA04C4F9F7DA359AE65217D673BC166F3081CF325C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772256462, "uuid": "aca6d279-f0be-4f8b-893a-6755e06d30a9", "value": "772ec87d3452991a9933a3ba0d9963a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772256462, "uuid": "9d9cd471-e8ee-4c3d-9ae5-58a82aaaa7b6", "value": "393216:1n1XQgPR2k3m5C507G9ITEc5eAlkLbQurxMWhAsIyNOPS0B4AycWsCYaxFzwW/tL:11XR7AsxYqt2oRGj5rs3wb8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772256462, "uuid": "5d03d103-f453-44b8-bc80-c3fbe45bf8be", "value": 71438848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772256462, "uuid": "a235fbbd-dc52-4ac9-98b1-f2dffbf2da80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772256462, "uuid": "e2d6ab12-af5d-4d73-a7fe-ec0df1f8e930", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac992ead-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772289305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289305, "uuid": "87c1e658-ad71-406e-b255-1cb30dc4edd0", "comment": "Malware payload", "value": "6de492c6c271d8f6a87be72c0f865257", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289305, "uuid": "0192b5ac-7b88-459a-99a8-5767874684cf", "comment": "Malware payload", "value": "40a4ddaef1437100f38dd74f3b401f8fce1f83d0bf78110e9156cce7147eb420", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289305, "uuid": "e17626b2-930d-41d9-b2db-0d29f31c7f96", "comment": "Malware payload", "value": "01b94bb8ab5cb728c6806816ecb1ae1c68b70f44", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289305, "uuid": "aa6058a5-fd9c-42f4-826a-dfe244cc667d", "comment": "Malware payload", "value": "829e36d9580c42dd858a65cd5e68a0deb145d900185c404c026e2096692c2e0110f2090c7a3143c5ea6702b20b830495", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289305, "uuid": "ee5a913e-22be-49ca-9339-29717596ecd3", "value": "T16D23855725FB10222E5398F22BA247473661D103D406C9693EED468C8FCAFD5FCA7B98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289305, "uuid": "46c76aac-de68-4c52-ac3a-20b933e05266", "value": "768:dqrztX2QfXqLVZjFRFWaFg8TXajV30NuHLpxA299+:d2plXeZjDDm30ULpC299+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289305, "uuid": "66410cab-d9ce-46bb-a57e-25ba3e924fcd", "value": 47717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289305, "uuid": "81327d24-00b0-4123-8d9b-ef2c22e7fbe7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289305, "uuid": "6c8838d3-4ea4-449b-aa1c-cac1fddbb110", "value": "index.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9522df47-14ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772322337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772322337, "uuid": "c0321973-117f-4cf2-a2ab-ad223ffd6804", "comment": "Malware payload", "value": "3dab4333e68469a06b9aec498141f022", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772322337, "uuid": "44206df1-a090-41dd-aee8-1d3e3cf5eb93", "comment": "Malware payload", "value": "40afec60143f9c9941e2696d2113124d2eef801b92ef855b46b216cdd552d32d", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772322337, "uuid": "8f9fb752-db5b-4369-a52d-492f1e934c44", "comment": "Malware payload", "value": "38df33573c55b9c9e4b408664a7df8e67428b270", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772322337, "uuid": "d4f8576a-99fc-4796-97b2-c06489801132", "comment": "Malware payload", "value": "3359b6e9a61f200ebc17f7d30433a72f5555fb14c4185f0da3d0f6ee0107845a8bcd80f9e44517397e1d65dbc802c5d5", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772322337, "uuid": "26e917fb-5be9-48fc-a98c-2a86c9b302d2", "value": "T170F05C4194E08915933047256ED1F5145993E7878385AE0472ABA0BE1F84782CEDF8FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772322337, "uuid": "2dfd1803-1187-4679-a643-6e32d64a0cf0", "value": "6:qTIuJzhqIwGiY6GLBrAMMJApAogN3fAbplilAl+m/AqIbR2AWHwlrvV4LKTjawli:qTp0JzMALNYygFIqsPWKvVBqAEd2QL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772322337, "uuid": "c29ec351-f94b-4e9b-bbfc-b76caa279cd3", "value": 457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772322337, "uuid": "ed419bf3-3d68-4c31-bf55-4a1f7a6b2f9a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772322337, "uuid": "84261fbe-7a88-4db1-ba5e-25255dfcbd23", "value": "Captcha.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "133ea4bc-1445-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772242233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242233, "uuid": "4b35f91a-0904-491c-a46a-f2ef4233dbc6", "comment": "Malware payload (SalatStealer)", "value": "0364dddb457c494df866e8d134d7fdd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242233, "uuid": "5dbb644a-d6cc-45e0-ac32-3568fa62b443", "comment": "Malware payload (SalatStealer)", "value": "4134574fc763534539f6dd3653a9d7083a548baf28acb662c7a3e40d7fc80885", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242233, "uuid": "a7deeb68-a10e-49f2-a5c3-b7ef48a72fbb", "comment": "Malware payload (SalatStealer)", "value": "be7c9b19af37c85e89bd45974cc80c2b0b63c793", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242233, "uuid": "aadeda83-bf08-41c8-ad44-4e7f1f8dcd73", "comment": "Malware payload (SalatStealer)", "value": "27f8868b54b34c68e4413076d66658e19f3af64b91fe2a942a4454366676b83ac25609ef500e3e835f15e0d1a2388155", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242233, "uuid": "f502209f-460c-4921-a6a4-63c847e8dbd3", "value": "T1CBC64A51FA8B54F5E9031831416BB23F63315E048B68DBEBFB547F6AFC7B681192A204", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242233, "uuid": "b50f43be-07f6-4006-81a6-876198a9eb5b", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242233, "uuid": "c4af3098-ae4f-42b0-bb73-d8880a199753", "value": "49152:5txktkFkPWLDl01NLE1UcQpYjS6x167Du0jKKDDcv0YJNo+CeOr0HPQoqJdWdwPV:rCtkFllZflv0R+C3eqvS+pmV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772242233, "uuid": "78aa34e2-79fd-4dcd-b0f8-ea2af726def9", "value": 11670528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772242233, "uuid": "37740afa-bcbb-4a36-9f1b-019748482464", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242233, "uuid": "da454d61-b3e6-4f67-b11e-db81045976c2", "value": "4134574fc763534539f6dd3653a9d7083a548baf28acb662c7a3e40d7fc80885.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e5d4ab-14e0-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1772308831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772308831, "uuid": "e29db4c3-ee22-4493-b187-9dbb2404370a", "comment": "Malware payload (Gh0stRAT)", "value": "fbd96b45de900a8d4f8725ed581e7d60", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772308831, "uuid": "3ab15ae3-4e34-493f-82ee-9987af629ece", "comment": "Malware payload (Gh0stRAT)", "value": "41a10c3abe7aa5a4993f9114ddd409ae50f361917826b7f3d8bd91109d91cc89", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772308831, "uuid": "0ac3c62d-6500-4103-8367-7739bb685d26", "comment": "Malware payload (Gh0stRAT)", "value": "9184cb0ccfb6030525cbc93784fae94d0f90fad8", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772308831, "uuid": "a20cd0a6-eea6-4dc3-9062-5b8f82324294", "comment": "Malware payload (Gh0stRAT)", "value": "cbfc90b41f087717e4c4d4b5609bf9ae72bc9b09b812756fb23ad4e2aa6672a4cf40559836ae67f787c6c74a1668da05", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772308831, "uuid": "169182cc-a6ec-41b3-931e-bd2a88698b84", "value": "T1D5273322B6CBC536D51E0177EA68FE1D0178BEB3473101E7B7F4B9AA84B48C29675702", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772308831, "uuid": "415d15cb-36c4-4a77-8eda-e6a926caa776", "value": "393216:1tTIpYu/3cM31KS6ckRN95Ki9HMW/F04166MFvyI0:1VGt31KSvkp5/V+b65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772308831, "uuid": "187f515d-62d5-47dd-8a10-5e52d62c0fe7", "value": 20993536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772308831, "uuid": "c1d315bf-1b37-46ec-82a8-23edc928dd69", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772308831, "uuid": "c34983ba-f713-4bae-b62e-94b5380fefa5", "value": "DeepL2.27A-4995.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a165d3-1444-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772242014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242014, "uuid": "6cc3890e-c03f-4d4d-aee4-f9149d0c91d1", "comment": "Malware payload (Mirai)", "value": "73ed08768a08932f8a45388fb8ba27ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242014, "uuid": "b9944b34-a943-446a-aea7-c53a71211c0f", "comment": "Malware payload (Mirai)", "value": "4320598f3314b69df9db11e8841f3f20347da1d2e0dfcbfc3f602a657261bbc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242014, "uuid": "42e42119-9006-4d70-be39-c43a2456ecbb", "comment": "Malware payload (Mirai)", "value": "78535f46a99bbb2288ba6e9324117bf261daab81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242014, "uuid": "a15c58ee-51cf-403a-a8ff-b2e52e59a9a4", "comment": "Malware payload (Mirai)", "value": "309aef9ce61e9518fcb4c2ff408fb782bbe75625455133f22e9413046b1ec46f98b87f9736037385a18ea5f87205508f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242014, "uuid": "d7f5336c-4c06-4479-aa2f-dfd4338eac15", "value": "T1F1932B95BC918B12C5D522BAFA2D158D331253E8E3DFB2139E205F743B8A52B0E3BD45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242014, "uuid": "acb2795b-c206-4115-9632-e7245199e86b", "value": "1536:skn4nnYdoLxiynL3vwGmVdCAMFaDBqWowOvUyH7s3WMv5dkvY85KD/QGMaiEyhUS:iyoNioAM4AWowOso63vwvNIyhUaaxqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772242014, "uuid": "9b8c78f2-600b-4451-8944-403d2a5e70b0", "value": 95484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772242014, "uuid": "80785314-4fd7-4473-84ac-04430ad7b7c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242014, "uuid": "bbc42d9a-f07a-4f11-8f29-1abe09344c44", "value": "bin.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5d19c8-144a-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772244427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244427, "uuid": "4861b4a2-3856-45f9-a9de-55f583c05131", "comment": "Malware payload (AsyncRAT)", "value": "aa4b6f6668c8d0d4a90edf4387465850", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244427, "uuid": "8024b2fc-f107-465b-9e3e-6fdde1454e5c", "comment": "Malware payload (AsyncRAT)", "value": "43c3b30872f76dbff6759c2d335276629a665f91953db1b02c2dc5d972a1d242", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244427, "uuid": "3b306790-1dd4-4b7e-bae7-278b405c8c98", "comment": "Malware payload (AsyncRAT)", "value": "6375a556999ec72ba310fa6f7a15897e8a278562", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244427, "uuid": "7841998d-2677-4239-903e-a4201401dd64", "comment": "Malware payload (AsyncRAT)", "value": "4c9fd7cc46c7aa974f4fdf0b0e378c4a097b855f2b7ea2966a337d8c158b991c813d0fc01b155cf7255df0c8d82c8692", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244427, "uuid": "8e400b40-3266-43cf-aa2b-66546a5c71d9", "value": "T17A052331D097BC3AC71B90306A57C7BBAB36D3E27649881A131DE5323FEDA42367A415", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244427, "uuid": "97577cda-1f0d-480f-8596-fb69f71ba3de", "value": "bf3327fc9f37a3cdc374f0a1cbdcea9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244427, "uuid": "c8ea0f97-3e60-44f3-8ce1-491bb2d20d83", "value": "12288:y/3+qAPN9rU82uRpSHKJaLzaMuOKRiUTHHof8DLNIf2lbLAW23rewE0TeIdjjr6+:4qPN6YRY5yMuoNf82eNkW2benXSjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772244427, "uuid": "9d710508-fed6-431e-bb99-1445ca16b221", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772244427, "uuid": "7ba31119-87bb-473a-8a7c-2c4dd264dd97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244427, "uuid": "2ed4b2e7-3d80-4e9c-bd39-b66d48eda5f1", "value": "stego_loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9dc6087-14b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772290723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290723, "uuid": "7a5e1015-5f58-4079-b68e-e828aba1a7bb", "comment": "Malware payload (Mirai)", "value": "46023069a7e3966edf719d45ecaff8ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290723, "uuid": "5187619b-252c-4b42-a34b-eb753d10bd22", "comment": "Malware payload (Mirai)", "value": "446c0ef8d2d5eb974d5abd74edede9104bd88bb17be80a5eb7b3b8f81becbc85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290723, "uuid": "1524d928-da7c-47b8-b032-00fa70c86d0c", "comment": "Malware payload (Mirai)", "value": "61b50915397fc79b8fbacc20df3afcf930cc1234", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290723, "uuid": "8da0373f-8c6c-4582-bb94-b08498e22eb9", "comment": "Malware payload (Mirai)", "value": "79219b7b8daf32b711ca42d16b1f9617ff442de84e97567efac0bb06a6e8a5b7c4a03295a3303a34f7436d28db4d6a2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290723, "uuid": "57f3807f-972f-44a2-87ac-2951d9141f9a", "value": "T1EB53941E2E218FBCFB6D873447B74E319658339626E1C644E15CEA011E7074E786FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290723, "uuid": "d2737bcb-4fd9-4377-a23f-22543346a1ad", "value": "1536:TMardYCtILv/maJehaAXsS7mzpL3c8cGS4/D:TxYkKGXYRc8cGpL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772290723, "uuid": "43cb03d1-0a34-464c-813c-13161b12fcbe", "value": 63388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772290723, "uuid": "23bdf89a-d29b-42a5-94f1-3d6797744248", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290723, "uuid": "527d723b-c5ec-4f6f-b5ad-b26350d3beeb", "value": "hoho.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa9c414-148f-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772274323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274323, "uuid": "4c51dd4b-53bc-4fd4-8d75-973366b500b0", "comment": "Malware payload (RemcosRAT)", "value": "42f4f19ba4f7d25c766e28f3f0a3d48b", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274323, "uuid": "2c001d78-c937-402c-bbf0-85bc56fcad31", "comment": "Malware payload (RemcosRAT)", "value": "457ce298b2b36aba99ce04072e8dd1388c374a8d1fab4234ef009f01cd49a656", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274323, "uuid": "d1579e68-acfa-4e6f-8f97-4bfa7d713104", "comment": "Malware payload (RemcosRAT)", "value": "820377c320d0e6fc3ebd644e98139feaed8c4ee0", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274323, "uuid": "97d6ea63-d826-41e6-ac46-3192b5efd2c2", "comment": "Malware payload (RemcosRAT)", "value": "35866a3bcfe768d324ccbaa6104df0b3490fc445432f51d24231f5e087e27231b90efe2072f6e7b23d9314e35283eada", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274323, "uuid": "94c1b3db-fd28-426b-bbdf-26538ecb7bfe", "value": "T164A21E3EC9859FF40B6A31A5A66F791665140367B9383A4D79CFC09D3B35680CBF00EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274323, "uuid": "cf420672-eb1f-4af1-98c1-6dba6466c74c", "value": "384:K77cY0CRB/8Nag4UAGcKO+LdqJhvXmdlyTRCFbKsncg8BcrNT+OfI5SZ8FtwL/bW:K/KEgGZGM7TRUkJxokEzwQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772274323, "uuid": "4546d933-8039-445d-8072-abdb17e51521", "value": 22045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772274323, "uuid": "8132507a-f462-451b-8ca0-057c439d62ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274323, "uuid": "2aba8e97-f914-4500-9af1-7f33fd8f1aea", "value": "42f4f19ba4f7d25c766e28f3f0a3d48b.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cca56c11-143f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772239967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772239967, "uuid": "36463388-1ac4-41a9-a46d-a44f33601506", "comment": "Malware payload", "value": "6aa231d08ce9419c558e290554a33dd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772239967, "uuid": "b3fcf477-0551-4d23-ad9c-da8671a60854", "comment": "Malware payload", "value": "45ade0b37c90f5fe18e8defa1b41d39419cf7d8313b9dfeafb8a2066310ac9b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772239967, "uuid": "6ee15070-ca20-44b7-bb24-f843a61fe883", "comment": "Malware payload", "value": "3e78f08e833f5177171dc62e0c3bd0f306994df4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772239967, "uuid": "f24ec074-1be5-4b14-997b-a77553f06626", "comment": "Malware payload", "value": "407851f105bb1e6d1baa7b0d4c320fbff8ea4732eb4faeecdac1e6e445b5fb8d84ffa4e1e24920c89eb144f298b1683f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772239967, "uuid": "8d5aa224-eca8-48bb-8f10-a86e6e7c11c2", "value": "T18B854907BC9555B9C4AAD2318A665292BB70BC980F3123D73B50B3F82FB27D45E3A354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772239967, "uuid": "bd37fc6c-fd0c-43bb-8db4-6dc66ecbc5bd", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772239967, "uuid": "ae84f5d7-387e-46ce-b29b-460039d5a33c", "value": "49152:00MDpF0egrb/TxvO90d7HjmAFd4A64nsfJCew2r5gCYPCBgwiz15:vean1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772239967, "uuid": "83fccbae-ed65-477a-a36a-2dcd1bb1e402", "value": 1811980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772239967, "uuid": "07973f2d-d25a-4579-8ac3-f89ac8708bee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772239967, "uuid": "abaef30e-8ce4-4d0e-8e44-88568d3a868b", "value": "Update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d08f5f-1447-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772243230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772243230, "uuid": "d84413af-9c50-4862-bde2-4a46422733d3", "comment": "Malware payload (Mirai)", "value": "375db1f7958dcbce2a733539190d2290", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772243230, "uuid": "f970c154-3335-4a60-89d6-58e875e3820c", "comment": "Malware payload (Mirai)", "value": "45bebff8cd1cd076228191fe6fed59d40e9230591fb0957ba262b87063db6a99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772243230, "uuid": "5bda08ae-7b09-4d83-bbdf-6a416658aa2b", "comment": "Malware payload (Mirai)", "value": "a81d873b2bac0be35c0de933747649561e66b91c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772243230, "uuid": "dfe730e8-e252-47a4-a177-448c086a6036", "comment": "Malware payload (Mirai)", "value": "b546bf4dc84dc665820d324f0964a772561eb0a244d991ea531fd548b5f5b708bb8ed6bf0978370727a5ffe92e1518f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772243230, "uuid": "234eeeca-d6b5-4034-ac89-d15cc689e099", "value": "T1FAE34B55B8828A22C9D513BEF92D018E331327A8E2DF7213DD105F2577C7A6B0D77A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772243230, "uuid": "427455d8-a902-46a9-98fb-81c99047185f", "value": "3072:MNkU+vbx7obbywHU2ADFut18CaMd7zyE6+GCoekY:o+RobbyuU27tqCagY+GkkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772243230, "uuid": "7e986748-0e8b-4e0b-bc05-d170b0fd7486", "value": 145528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772243230, "uuid": "b8b4be44-0696-4b36-9561-e388e60a6394", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772243230, "uuid": "8cc8ee99-ae22-4167-affd-2ca1371db98d", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350fb002-144e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772246155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772246155, "uuid": "727fdb7e-d1a3-4a3e-9843-ed0005e08c29", "comment": "Malware payload (Mirai)", "value": "17b22db5ae0210e24636eefa92540f5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772246155, "uuid": "6a9cc0a4-cdb2-4f5a-bc65-6281ee9472ef", "comment": "Malware payload (Mirai)", "value": "46e65c51c4f06735e84761e8a20cac7b83cfe384fc13700dd1b21d2dbbd92f1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772246155, "uuid": "a50b80e9-2c70-4fad-ade3-c6d48b75f588", "comment": "Malware payload (Mirai)", "value": "c45886f88d0318f42ae97c66cb0f92853b290f30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772246155, "uuid": "82a1c4dd-db9e-4ed9-b065-6caa5ef53c5c", "comment": "Malware payload (Mirai)", "value": "6ff95f7b4a5720f04a8f43ef8f3fe83ac49b16649a2af874a8ecd24a81905d8789589907285af53ab90ad2b2ae784068", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772246155, "uuid": "79c60896-66d3-4abe-a119-ee434de47170", "value": "T121E31A45B8405B23C6D622BBFB5E42CD372A17E8D3EF720399216F21378695B0D3B646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772246155, "uuid": "22ac6e20-a326-4fe8-912e-2cc02a8e7ac2", "value": "1536:e451+mp2YK6lmoTu3mbMAF9vWMf338uApPm4VKpraTWzqsN/OVCOk8q2lEWKr+g+:e451NtMEPOwn8ub4mG2qsN2zsWMBMLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772246155, "uuid": "c15b85e2-f74f-4bc1-914d-4bf22c906883", "value": 150304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772246155, "uuid": "693c540b-7aa4-4dce-810d-cd604ca401ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772246155, "uuid": "31c19165-5758-4cc4-97c7-831fa9af1cda", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b955d9-14e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772312191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312191, "uuid": "6a3a024e-ed8f-439e-b9ae-5b7a3b7a5d3d", "comment": "Malware payload (Mirai)", "value": "673f1627971709ab9581bc247fd0585f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312191, "uuid": "9cbe6cec-6907-48a8-8253-3169135c09a2", "comment": "Malware payload (Mirai)", "value": "46fc54d651998671c7c7a07a0f126e0f73fd21a4e3a7579c6dbc4e62e32c1a3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312191, "uuid": "e0c56920-da7c-4307-905b-3b2d6e473cbf", "comment": "Malware payload (Mirai)", "value": "98ed6eee05887aa1ad8e4727d3e431a8bffd7ba0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312191, "uuid": "9b7f7e5b-18ff-44ce-91d2-cdfd0f1704f9", "comment": "Malware payload (Mirai)", "value": "91d26449893e876a1ecc6c88a3b7accf824c75fba74bc965c9ded9efd6306b38d7056d887b9d045f1852343df52cbc8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312191, "uuid": "715c9e0f-e098-4ec1-ade8-1e53d5ed9581", "value": "T12FE2F22FD1BD1F06C977E2B144CA7BE86D28E05C86DCC6938E4AB0665FB4F272D00155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312191, "uuid": "1c3dade1-1742-4415-a53d-27d5d790dd7a", "value": "768:71ViUoq0LgSY3xdKz3AcElR78XMnbcuyD7UHQRjB:71wqwlYhdKzQcEr8XMnouy8Hyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772312191, "uuid": "85aacd21-726d-49ca-b256-c28e41469276", "value": 33540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772312191, "uuid": "13564a4f-a053-44b1-ad6b-00d9c764f237", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312191, "uuid": "01900412-b83c-4dfd-864f-0829aa03fb5a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef809723-14c5-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772297578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772297578, "uuid": "6fd349db-f53b-4fc7-b5b7-88a415099a51", "comment": "Malware payload (Gafgyt)", "value": "52905d4184cac97c552844fcfe39472c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772297578, "uuid": "02ea4f1c-45d4-45e3-a012-27bdca6915a8", "comment": "Malware payload (Gafgyt)", "value": "4725da7cba1776e1e67297318988f98b222a338628e0eb3c4803df3012fb1f61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772297578, "uuid": "2c052547-5e79-4b8d-96bd-f15b5c90ca5a", "comment": "Malware payload (Gafgyt)", "value": "5d65b8f4c71ebbfade00a0d19ba758656268467c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772297578, "uuid": "ff487661-9cd5-47c8-836b-87779695ff00", "comment": "Malware payload (Gafgyt)", "value": "0606c917a0fee9214b1aee4c199430285397575fe9f862777a468d919119d12b0ac42861175cbc47ac03df6978333654", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772297578, "uuid": "56e02746-758e-4f39-9a22-563e15872f0e", "value": "T1D3C3F185E5C2D7F1E28344BA105B9BB2AB30DE540048D6E7F79CBF21ACA2769D45F21C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772297578, "uuid": "e565644e-97bf-4371-a6d1-0cc6918facad", "value": "3072:qa3z5a9yc6D/gfAw0KS5CxHm8TUaGSAM5KuOF+TpPssYtq:qqm10BdKS81jX5bPMtq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772297578, "uuid": "dcecd748-f0f0-43cb-a541-cf0623026cb9", "value": 127076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772297578, "uuid": "70954bd4-c005-4b17-bfba-be09a6015464", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772297578, "uuid": "e1c16584-17a7-4c1a-a619-6cb12b5db3b3", "value": "8iwks17l9s", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd5469cc-14b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772290729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290729, "uuid": "40e0b437-3d2e-4df9-ba49-2114d82b951e", "comment": "Malware payload (Mirai)", "value": "6f1ab134f2739e71ee8890d740296028", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290729, "uuid": "23bbc2b6-f33b-47b0-be8a-4d8db62345c2", "comment": "Malware payload (Mirai)", "value": "47ddeab26f58aff46534ddac4316fceebf30bdf8af574e6a75dad403d7c169d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290729, "uuid": "f8baaa72-7d08-4746-8075-679f497ce8b3", "comment": "Malware payload (Mirai)", "value": "304c1799c370f334dc0c075a8688b7cbb799b4fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290729, "uuid": "843c1b4b-a1a5-4a06-84e2-837429bfb66c", "comment": "Malware payload (Mirai)", "value": "d3491312e73c2cc0fce863ab7ee9fdd2f364cf6af02ace3b277075b694f3f9e867b896232c3d3c772de541367610ed78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290729, "uuid": "86212d9e-cc4c-44b3-a96e-bac011ed7715", "value": "T1F5233936B97A2E17C8C4A47E22F74734B2F5524E25B8CA2E3D720E4EFF10944A5136B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290729, "uuid": "08a3f46e-5a58-4e09-b73d-6498ba3a465d", "value": "1536:6nJJnLVSRf53SjfTvxCrDwjaGPBH0oKai:QEB5CjLwrLalKai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772290729, "uuid": "89f25ec1-ff2c-4dc6-a44e-71a2b3413169", "value": 49996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772290729, "uuid": "84893e1a-f05f-4b21-9579-7bdfe952a7c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290729, "uuid": "469e2060-4f56-4fac-96fa-c5b6b4a5e501", "value": "hoho.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a930ec0a-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772289300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289300, "uuid": "79264dc6-6d6b-4edb-85ea-34066fb35664", "comment": "Malware payload (Mirai)", "value": "0c409da06319c1dd4ce25e1cb69f5e70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289300, "uuid": "6d8d3eb3-6019-420a-bf6f-a538ff3e6949", "comment": "Malware payload (Mirai)", "value": "48dd01dc968b3c7b9c7529acbbb1a9cfef6303c27c28bb1a89ec54ed0f3de5b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289300, "uuid": "2fb94335-2cb2-4065-bba9-0640bb771f25", "comment": "Malware payload (Mirai)", "value": "631924c9fa0ddf3a6a9a9690d057bc6c3a5d6afe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289300, "uuid": "8076fd83-b5ae-4fde-ac30-5fd1ce385e74", "comment": "Malware payload (Mirai)", "value": "22bfc1e7fd7be041a41636eed87a5540230f9839a137650428bdc4ad0d54e931f80869010bfd91003d1fd6e98d97c4a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289300, "uuid": "1445460c-7c92-4170-8f2e-307ef760cd3c", "value": "T1C1330692FC82859AC5C067B6A72E5A8A73B263A4C1DF3313DC584F1037C965F4E67E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289300, "uuid": "bb21a240-11ed-4bfb-a5b8-cd83a24e704c", "value": "768:mzAoX1VpcB95q5fRgQR/po5R7lJqR39BxsqP2ch/URIFoKUsMuFRNFd0nFzKD:sVCBTKJgkBOR7lJqR39vP2ch/4IRhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289300, "uuid": "b94a0f9d-fdb3-4cc1-a6e3-6ac58d366f58", "value": 53852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289300, "uuid": "d690b125-4ca6-43d5-9a2b-f0bd125ab69c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289300, "uuid": "4e56e48f-7d03-409a-a093-3676f8deb3f1", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0def29a-1451-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772247624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772247624, "uuid": "f801d77f-e592-4e89-a506-519700d24f6b", "comment": "Malware payload", "value": "c771fd903b818c65e7de743e7ddd461c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772247624, "uuid": "3c75f71d-2d7c-40d4-a5b1-65cb4e74f51d", "comment": "Malware payload", "value": "49660527c1c910ad2d3c5625c1b44682e465e45b65883dfc8d7d229d1bd0ebd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772247624, "uuid": "1a6c05e1-a506-4a3b-bfb3-6512b3b11015", "comment": "Malware payload", "value": "f6b9cb4a8b01a84d4771f663c0d135ef033e1a73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772247624, "uuid": "ebe2791f-5524-4117-83a7-112fbd337837", "comment": "Malware payload", "value": "21675f2a6451cb1e14753281ad12f95c082d729d7da6e25785aa89114b2b863344d182af614e6b9534a3ff19a75e42b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772247624, "uuid": "327d4adc-6cf7-4302-8a3c-177d1605f1c5", "value": "T1E108D01663A116AAD97BD1388AAB6503EB73B4071330C7DF329C43712F63AE45D7A760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772247624, "uuid": "d092fa25-7b66-4dc6-b99d-b264b617feb8", "value": "957d237db44af201299a1e8ffc6df035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772247624, "uuid": "ffd1dd15-a3a6-4260-9714-2f6f47333630", "value": "786432:a5EosxTUU8XOkBKgP2tURVQqWV1CVuEwoz3fPSbDBRWYF3eKyaYpvH:a6oslbkJIURVQqK1CLP6bnOuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772247624, "uuid": "54ffc5c2-eb43-429f-ab08-2871eec2b958", "value": 80834863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772247624, "uuid": "95ed0f65-8966-4ba3-8aa8-3cdd6e434e8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772247624, "uuid": "59cb9d89-e8f2-48d3-87da-50f2cef3300d", "value": "49660527c1c910ad2d3c5625c1b44682e465e45b65883dfc8d7d229d1bd0ebd8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ae6e35-148d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772273479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772273479, "uuid": "b85142dd-2b0f-4ee0-b722-56beacb30428", "comment": "Malware payload", "value": "6b6fee2c5e2bdbff3d56362c72f5b2ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772273479, "uuid": "a6830eb8-3849-43ea-b400-d86cd2eda695", "comment": "Malware payload", "value": "4b16baf674e02084875303e4ae72066d7b6431340efe58a37b7840eb36b6a026", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772273479, "uuid": "b09ca54a-c0c1-4193-9704-aff7094e7865", "comment": "Malware payload", "value": "9cc5b87c025b4a6416c40b63504902fd7ba5b41d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772273479, "uuid": "20564229-ffe1-4ed9-a4b6-f9a46f1490a8", "comment": "Malware payload", "value": "9d97198c71625fdf51510ea57602b7393aa7fd7ef44f1c7e9a7746fdc2097fb9e262263567fd6547bba7b74de5a1f0c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772273479, "uuid": "af1d96c6-0e3a-42c2-9cca-089bc8e6e917", "value": "T181D533DCF0ADBCEAF0E25033A80BCDD508857D1965BB4BD769B31ECD17A900A31364A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772273479, "uuid": "6e60f54a-b786-40ff-bca4-9f1fa46ee890", "value": "a50e815adb2cfe3e58d388c791946db8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772273479, "uuid": "1febd0d8-190e-48eb-a003-eef7e2513b2b", "value": "49152:RImZHN4WVRUW0NCtUnDjl2KGSYfqZcx9O0+TmUydov1tp3U5QkNmRY3mWjYFJGUY:RImZHN4WTJ0NCt6lafqyxU7TmIvbpEZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772273479, "uuid": "57b2764e-bea6-4d36-9e23-44132fc2acaa", "value": 2753024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772273479, "uuid": "6da458c3-3eb5-4d3c-90eb-b9b4226ea14f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772273479, "uuid": "adb56961-c4b8-4d6a-90aa-e838aff4993a", "value": "run.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e72895d1-148f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772274371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274371, "uuid": "a26fdcba-2244-4884-98d6-f81538e4ef5b", "comment": "Malware payload", "value": "e99744f5965888958260ee46a18c141e", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274371, "uuid": "448b615b-8364-45a4-901d-caff63add11b", "comment": "Malware payload", "value": "4b20f09c6b75f6f38834367c7bdab930b4f02c7bb06c68943d29499169517ccf", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274371, "uuid": "465cb9f1-c1e7-4d9b-83be-68871d030461", "comment": "Malware payload", "value": "4808be7350d38c29993fecfcca96f6ddaddedce3", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274371, "uuid": "596436ad-fca5-4e87-b2c0-643a370956c1", "comment": "Malware payload", "value": "8c819115cedfcca2f73dd32bb28a7718fb3d8a14a7b3c11528905f4d135f15d116742910b705108675ea63a64f774422", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274371, "uuid": "0e32ea88-c130-4f2f-a350-4b8a8a5ec61d", "value": "T10862A51A8805DFF0092E3550B6AB68166D100366B4393D4E7D8FC6AD3F3A650CFD55ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274371, "uuid": "2f019ccb-1d4d-4729-b21f-e9e8270b43a5", "value": "384:KDuyFO3ir4i25y0pZUobfMH8chu8k5XVYFraG/rfWZFjLqjr:KqEgA0vjCCQZWZFjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772274371, "uuid": "cad3a992-817f-410c-b225-e757d345fa84", "value": 15751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772274371, "uuid": "eb16c056-6294-4e3a-ad66-d98695ee8b9a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274371, "uuid": "4635bbc5-c400-48ab-ae48-db75b0a001b6", "value": "e99744f5965888958260ee46a18c141e.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ed96852-148b-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1772272290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772272290, "uuid": "a116fcf7-bfaa-49f5-943a-c9ddfa6391a5", "comment": "Malware payload (RatonRAT)", "value": "42f0956497e42518a1d0b32c27cf1653", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772272290, "uuid": "c0fb905e-8c31-40ba-add4-791308af3fd8", "comment": "Malware payload (RatonRAT)", "value": "4ea16583fea8b113427a8ef69ffd8b40839cc6fa4e1332904465e0e83930dbd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772272290, "uuid": "dd6dd2c1-94a4-4816-aaa2-feabdea675ed", "comment": "Malware payload (RatonRAT)", "value": "61376cdf268c9b3880b5307d484a35d2946eb0df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772272290, "uuid": "9c83e2a8-3ad9-413d-8c1d-4904ed9feb44", "comment": "Malware payload (RatonRAT)", "value": "7b3463b840cd55efeb0a75259862fe4e73cec2e17f1e4a6d9e2988cc47ff2a102c5ac05f5ef0f0298d6ae672451434f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772272290, "uuid": "51a24004-c41d-4d64-8fe3-8faa70074176", "value": "T1E8934C0073FD5526E67F8BBDA87625088FB27917AE71F64D8C47506D0A70B81A920F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772272290, "uuid": "8a4a5c5f-61ce-4760-a5b3-ee68fc32a0e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772272290, "uuid": "28a9255b-e0d0-4f79-a1f7-19f745d963cd", "value": "1536:nr/cICn3TR7Oz7bzm/04nFTsqa4tsi5gj50Elb+KvCm1s9G2:nDcx3TRSj8nFAX4tnCt0Elb+KKm1CG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772272290, "uuid": "92c9898c-fd95-4dc2-8803-c27f8588f9c2", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772272290, "uuid": "0226d199-bd79-4b91-b94d-59c6a2afcb8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772272290, "uuid": "e58b6c3b-90ea-4eef-ad22-427d81f72013", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db8660b2-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772289384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289384, "uuid": "7e8708ba-1afa-4c57-babd-37caf3da582d", "comment": "Malware payload (Mirai)", "value": "bf12c15e726b1d46eddfbaefdf028685", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289384, "uuid": "c1381d27-f2a1-4a99-8e0b-ae414b4680d3", "comment": "Malware payload (Mirai)", "value": "4f424be0353c60fda7efccac20e54a098a150328688f2a40adf0901bae75219a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289384, "uuid": "258ec9f6-b0db-4e9c-bbb8-6363810a73e8", "comment": "Malware payload (Mirai)", "value": "a7b21859c7e1326d329ed5dbf94afc53b60f1d90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289384, "uuid": "d550a4b2-dd15-414f-af8a-779155a5f89c", "comment": "Malware payload (Mirai)", "value": "4803fabc9007e3bd7791261624164de540ab7836f13517c7492f38ce3095444914a5e10b92b61be12a9ab056c7557f69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289384, "uuid": "13b53b27-3348-4005-94f6-9a16362cee56", "value": "T1F203F1A0D4555882D9DF6E3199D2E3C273F24AA86320D6ED30D5DA1A263E67F2821FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289384, "uuid": "1139c78c-39de-4faf-a601-14ccfa50ef93", "value": "768:Lv0Nww/oWDDsCXP61Dq4YTMwaFwoD3jXHJq+4uVcqgw0I4:LM/oWvsy61DqpTMweHA+4u+qgw0I4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289384, "uuid": "700226da-e592-40d8-936f-2b1d3112f876", "value": 39976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289384, "uuid": "972b7420-436a-4705-8f50-40409a571cb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289384, "uuid": "d8de1986-c505-4fb9-8c4b-be73bc667427", "value": "nwfaiehg4ewijfgriehgirehaughrarg.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fc370da-149c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772279808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772279808, "uuid": "3ce80023-b31d-4911-8e97-c76d039fd747", "comment": "Malware payload", "value": "1042848d03ab7fe5a5741e30cce786f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772279808, "uuid": "2b8b9079-8628-4120-9d15-1857b933d442", "comment": "Malware payload", "value": "4f57cfd1cbad0a0d57c3c7ec52d601ec06043de029d208e6d4f78df5399b85f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772279808, "uuid": "e735e153-7eb8-4aad-9fe4-755fab93814c", "comment": "Malware payload", "value": "9470cadd2cf45dad6c4a50cd387649c39e483b6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772279808, "uuid": "2817c3f4-ed76-4c24-b1f9-ff6316731366", "comment": "Malware payload", "value": "9e7af0139bbcf6a209c48f192675ee31722dda3b13289f8f26f07db2387c54f4c08f333503d08d83671106de830f9846", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772279808, "uuid": "c5bb11e2-5652-4df8-be56-cc9f31c8c2da", "value": "T1A1F7594262EA04C4F9F7DA359AE65217D673BC166F3081CF325C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772279808, "uuid": "da2ae55c-7752-45ef-b370-b3ed86dc1333", "value": "772ec87d3452991a9933a3ba0d9963a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772279808, "uuid": "547569ec-5f2e-4e85-9813-3a2052586b64", "value": "393216:xn1XQgPR2k3m5C507G9ITEc5eAlkLbQurxMWhAsIyNOPS0B4AycWsCYaxFzwW/tL:x1XR7AsxYqt2oRGj5rs3wb8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772279808, "uuid": "02359b32-77c5-49d5-bbe5-6ec387c0f65e", "value": 71373312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772279808, "uuid": "c2fc7ba4-bdf2-4a46-8e0a-b99a6bdb21d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772279808, "uuid": "e1853f24-748e-48d0-b3d7-8f6066ecc01b", "value": "CrimsonLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b43657-148b-11f1-a769-42010a9c0008", "comment": "Malware payload (AmateraStealer)", "timestamp": 1772272349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772272349, "uuid": "f4e79ac9-d343-46e7-a578-7937cc03bc7a", "comment": "Malware payload (AmateraStealer)", "value": "02c0b897cf5fbd8a6bc2db316c40fd43", "object_relation": "md5", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772272349, "uuid": "3b46e77c-3782-49de-9df5-2a9a9f6eb86f", "comment": "Malware payload (AmateraStealer)", "value": "4fd1b4d687a1ae686bfef4cb3dc09c96c4d4e12f22e7f46d2eadd24903a44888", "object_relation": "sha256", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772272349, "uuid": "8c706c03-ea60-4cfd-91a3-aec1dc18944d", "comment": "Malware payload (AmateraStealer)", "value": "39bb68d134fa39b1d295917c7730f7b0569a1fa4", "object_relation": "sha1", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772272349, "uuid": "a9624217-61a2-43a1-8bea-dfc44862a330", "comment": "Malware payload (AmateraStealer)", "value": "41c17f7b151eca51203b4d60bd7025ff18e4706e3e5b3f9cf8392fe82f76887dc5ed1154d9f124bd9c5aba81d8be60af", "object_relation": "sha3-384", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772272349, "uuid": "5bee2d90-624a-4a01-a6e4-ae2f95947f3f", "value": "T13D777B42A29D48B1D0EED1BAC11E869FE6A57D005321A6EF0195F579AF333C06EF9730", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772272349, "uuid": "0033e7e1-e48f-4b2a-847c-21d7c7c675a8", "value": "492a5d3560401c2811de048088bf91d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772272349, "uuid": "77309a50-26bf-4733-9343-bf370a1e9b0e", "value": "393216:hCOAgxozLO6KYyqshhvSHtkeZU4iC4eU1Ubjg4oU3MihAH4KzdfngwCXpbVidaJu:r/rde4xyd3dQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772272349, "uuid": "b9a4d3b7-d308-41a1-b8ec-0dc92d977387", "value": 33481492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772272349, "uuid": "1881a228-2d67-4e41-85bb-6c10afdb0614", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772272349, "uuid": "9e7c8d78-bf71-4b90-80d8-99c1e0459c04", "value": "02c0b897cf5fbd8a6bc2db316c40fd43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65792aff-148f-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1772274154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274154, "uuid": "cb453e69-5e77-4fe9-a20e-4cbbe68a8703", "comment": "Malware payload (a310Logger)", "value": "f1bcbc53e406cdb380b54cb11cf37371", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274154, "uuid": "b6751033-8b0e-4afc-a154-f1d6e9cc4962", "comment": "Malware payload (a310Logger)", "value": "50fe98208ec5bc37b5300cc089fb7103c1c6318bf76ac800c31206975406b8a1", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274154, "uuid": "40077eac-8540-4cec-94c9-8d7c2aee0660", "comment": "Malware payload (a310Logger)", "value": "61409278a0e6ff4570c8c40c019afc4060d6bde9", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274154, "uuid": "1c5b0d01-b108-42e5-b3d4-a11d5a3748d0", "comment": "Malware payload (a310Logger)", "value": "3a747ba9e15e5e51f241e51d573b78eba322dbedf377024fdc3003814f0e84e2e022e02df99cb0c7a2fa3aafe938aa8d", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274154, "uuid": "45207330-465b-4469-91b5-6a5570c3f2c1", "value": "T1A9D5BF1D17D35B63C4AB8BB240CDAA6FA7B4CE0F21D610D9AE217D4CF8AA500535F99C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274154, "uuid": "b16af76b-a6fb-46d2-9160-e04e131f8ebf", "value": "49152:nFnfpl/jPCirW/N6O0Mo92YqhNrcaSFzRaFMGZmZFQAP:T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772274154, "uuid": "cd07c0bb-a2c6-4743-a3ec-e092bcf163d2", "value": 2777675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772274154, "uuid": "510e66d0-c7ac-4b86-b809-098f144c745d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274154, "uuid": "dd59e748-dc32-48ce-921c-e092413a8dc9", "value": "f1bcbc53e406cdb380b54cb11cf37371.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4180a696-1477-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772263785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772263785, "uuid": "b0355b4d-9fdc-45f5-a36f-3fa65649be5f", "comment": "Malware payload (Mirai)", "value": "696ff2a4f17c275e57328824e72cd0da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772263785, "uuid": "f8c10f73-4318-44de-a3fc-d9732a215adc", "comment": "Malware payload (Mirai)", "value": "5129128cd799d618ad8d201cecf15a06b01fe191110369be7d77af267c8b3249", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772263785, "uuid": "7c66281f-67c8-4052-a1db-8652bbbd1fbd", "comment": "Malware payload (Mirai)", "value": "1e322ce0af82145e9c600331363eaf8fc861fe95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772263785, "uuid": "ad41e479-3de0-405c-80e2-700a81a3b871", "comment": "Malware payload (Mirai)", "value": "b9003d17d9fc1fa66794cbd1067c276009494ff2a366ee3bbc5265c4297e95355484147440ea75aea6c94f70b545983b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772263785, "uuid": "681675f7-9385-4f6a-9afb-25f44d8b5617", "value": "T17914961E6E228F7DF668873447B78E25975C23D627E1D641E2ACC2105F6028E641FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772263785, "uuid": "92f7fca2-ac8e-462b-a18b-09d003f937f8", "value": "3072:3c2nXadriWo222fLLTwMif6md0gM3eDBilA+OEuoz:s2Xgo2XfsMo6eMSBp+OEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772263785, "uuid": "063ec741-abce-4687-971b-96a2f4611385", "value": 194176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772263785, "uuid": "3cb6d2a3-8b54-4081-a359-a01657888863", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772263785, "uuid": "dfbac726-dbc8-470b-b118-05c5e84da9a0", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10afc20e-14b5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772290332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290332, "uuid": "a519694e-bd06-4550-915d-acf1cdb0df9e", "comment": "Malware payload", "value": "13b10d8ffd6f035c92ea18a3d025dc2a", "object_relation": "md5", "Tag": [ { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290332, "uuid": "1a8f9630-f28f-45d2-ac2c-d017532bddc5", "comment": "Malware payload", "value": "5228446007c92989151fbb027e6d887c4c985e4524d6e8c065488095c896e6d3", "object_relation": "sha256", "Tag": [ { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290332, "uuid": "23dae421-b2fe-4a37-ae9e-5a7a7402c049", "comment": "Malware payload", "value": "44bf1a059590f258c7c615ee746a583bffeaec4a", "object_relation": "sha1", "Tag": [ { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290332, "uuid": "47cbd372-76fa-4895-b425-96b94938821b", "comment": "Malware payload", "value": "2598725273d61ae055037dba1d448dae533b7b0a769dbcd844078b2207d504758b0f5ebbfa24eb62b35c977325c27df0", "object_relation": "sha3-384", "Tag": [ { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290332, "uuid": "5bafd4bf-241f-4ec3-9db1-8ce824e7184f", "value": "T1C223855725FB10222E5398F22BA247473661D103D406C9693EED468C8FCAFD5FCA7B98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290332, "uuid": "2f7cd336-8df8-4205-8921-04772e6797db", "value": "768:dqrztX2QfXqLVZjFRFWaFg8TXajV30NupLpx429m+:d2plXeZjDDm30ULpW29m+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772290332, "uuid": "eb4bca4a-94bb-4696-8905-36f95c33478c", "value": 47719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772290332, "uuid": "30a621f3-48c1-40be-ba5e-cdb073de1b27", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290332, "uuid": "756bda5e-a098-4166-bc59-982db5c7e9ba", "value": "5228446007c92989151fbb027e6d887c4c985e4524d6e8c065488095c896e6d3.htm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2e0861-14d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772303267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303267, "uuid": "30d1269d-f97b-47bf-a639-213b8244e16f", "comment": "Malware payload (Mirai)", "value": "587acc6befe949c61153254849061017", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303267, "uuid": "bc42ead6-bd8d-46d8-bc19-9c1b0e616758", "comment": "Malware payload (Mirai)", "value": "52817af1b60452736b419cfc629f3e2c493ca07b952093c0817be6f118dbabf1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303267, "uuid": "e53467ae-292e-43ad-a261-5faf9445d1e9", "comment": "Malware payload (Mirai)", "value": "aaec2b4297a98b7ac33f0ee6e0dd54f102c00f0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303267, "uuid": "a0e193b3-ce7b-4def-8ad4-845fc18bc36f", "comment": "Malware payload (Mirai)", "value": "0de4bb8d88361026133f3a348ec120cda1caeeb8957c3a6ca3110faf7e1a5257d77143bd1e4d472af9647366b6735777", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303267, "uuid": "fa0a5d27-4aeb-479f-bd2b-e8b133df74ed", "value": "T182133A92B400AD7DF85EE73EC093090AF131A79551821A3763A3FD776C322A85E76E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303267, "uuid": "0515d3a9-0f8b-4b9d-ac54-4cc546007ecf", "value": "768:0xqFTD4t0MoBjFwWEw0Cmk+3o+6WluD811JtTRHGtHwl5bsW71:COaWV2WLHVk6WkD811bRHGtwlXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772303267, "uuid": "869079ca-871a-48f0-a825-fdc15e5b948b", "value": 45516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772303267, "uuid": "2a15b9ec-b3b0-4963-b2b4-760da7384a88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303267, "uuid": "4f609598-e7d8-48e7-8fab-9f1447fc6b39", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f30d9b4c-14e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772312187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312187, "uuid": "96574f96-de39-4991-9932-1a12b5d077e0", "comment": "Malware payload (Mirai)", "value": "574f9ea93412970090055f1c9160caf5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312187, "uuid": "3ce6facf-e65c-41c9-8e2f-e62c8bf8d952", "comment": "Malware payload (Mirai)", "value": "53df5003797d3b72668355dfe75699a9a685da1346d77731e4123555b2e2a112", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312187, "uuid": "718246a8-9572-4453-a44d-91bff0422678", "comment": "Malware payload (Mirai)", "value": "5db515f5e26057b1ba18681e5976ec6f0af31154", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312187, "uuid": "622d33f4-4320-415d-a0f3-e515ea848045", "comment": "Malware payload (Mirai)", "value": "13b80d7ed977e20665de555e53a565d8bc84292dc475c9533e2026055e3ca9ac397bbf909e01568c517c5dd7b3ecbcfe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312187, "uuid": "343c8c3e-abc8-4137-bc9c-6b9e1d4b642d", "value": "T136834B36BD762E27C0E4643A63F38366B1F9574E20B49A2D3E750F8EBF50980B11A574", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312187, "uuid": "72391541-1b8e-4f6f-b1a7-53480bd53b07", "value": "1536:DhvfMOnM10P5rkNbsnaj1y3gP/pA75Bt5C9G:dvfMrbsq1y3gXpAV6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772312187, "uuid": "8fd5fb90-6f03-4033-91ee-534acdb63f5f", "value": 83312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772312187, "uuid": "cbd72d3f-6947-4d53-99ed-b04b4d8cb90e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312187, "uuid": "fd015c02-3b67-4f62-b71d-fd9381f99784", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0215e2e-148d-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772273473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772273473, "uuid": "d6db2ec3-09d5-41c1-9192-10dc1362f062", "comment": "Malware payload (Vidar)", "value": "af53dc21b28997e6e381c7370bb00a73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772273473, "uuid": "fb6d2a5a-137c-4b70-9024-2150db4438ba", "comment": "Malware payload (Vidar)", "value": "540019cc2f6a7f48d484f14cc37cee2e24a5abe59af0d41b522b1455f529fea9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772273473, "uuid": "ff6e5c4b-d882-4914-935b-9644a238abb4", "comment": "Malware payload (Vidar)", "value": "f3adb7208e00ade222fa52e8b3316dfc0e058997", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772273473, "uuid": "084d04eb-a76b-4b0b-b44b-3b80a7714359", "comment": "Malware payload (Vidar)", "value": "c0206d2f10e3361aec3109072773bf981abd72428b3d376bbee0885d59f9a986721467ffc17b0be2fa4be3b01158c5f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772273473, "uuid": "56e931d0-22ac-42a6-8eae-51fe16f4fc3c", "value": "T1C3D42BBDAC60E376F60CD0BAE286D3538F2139011236AAA319BD97241245473DB577FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772273473, "uuid": "95feb713-a480-44c2-b1f2-6b842f48a8f4", "value": "e6a9ea00f059c8f148d2aaa9d51e3613", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772273473, "uuid": "592b668d-b89f-4313-a2db-f4ee9337a044", "value": "12288:BEyurkSSu5EkPm8b7k4ao/CXjp4JgtU8F6CmSYw2g:BETrk5u5EkPb7jgjp4JS36UYw2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772273473, "uuid": "cd9e3b44-d11b-490e-92a9-7aba6652ad9f", "value": 629760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772273473, "uuid": "5b34d122-4940-4d5b-bc57-f2f140c915ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772273473, "uuid": "b98c9b59-6416-4b40-85b2-554871c563d5", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb40a394-14b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772290726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290726, "uuid": "83a4599e-27ed-4e40-9e0f-2cb4001cabca", "comment": "Malware payload (Mirai)", "value": "97765dc084d4962175b19d20f4c44d5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290726, "uuid": "d6d842fd-1d14-447a-b528-13c538926668", "comment": "Malware payload (Mirai)", "value": "5404ecfd3325d8ad5f90387ac8563aacc8a39dc3ce4203731af9af2244b84c8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290726, "uuid": "6ce421fa-b4ca-4299-9511-9656b5c82e85", "comment": "Malware payload (Mirai)", "value": "14f2d82cc38b8d22b96b1239aa0283abce35e97b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290726, "uuid": "b72111df-968a-4e2b-91a5-7d95de191e57", "comment": "Malware payload (Mirai)", "value": "a59e89cc09a981eccd580c7db92fdd437d16da9eb531d741f42f08ca009ca91f928e9f5d3e3c28af71c333e1ad0288e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290726, "uuid": "db375b11-89b1-4314-8935-ca0b74f75e5c", "value": "T148231A50B8929A17C5E423B7FA2E42CD331623A8D1DF72139C226F5477CA92F0E7B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290726, "uuid": "8e79e045-c24f-422c-b7f9-661396f36407", "value": "768:bWWfYRgqSoQ0uwqMPZomnHsmYjyqbR1EqXWLQtb3A0xrICnFFhP5HOX1Qv9mQMjU:EhSJY/Yjyqvs0xrlnFP5HOyTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772290726, "uuid": "edfe4ed7-a234-49ca-bf54-4a891cd10433", "value": 47676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772290726, "uuid": "78a35bea-27cb-4b59-8488-ad0605133008", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290726, "uuid": "b36acb94-165d-4146-bb86-d60614d2d1e5", "value": "hoho.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b78fd0c-14d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772303262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303262, "uuid": "bafffa8e-b6ee-40e6-935b-5776f727f963", "comment": "Malware payload (Mirai)", "value": "152120545eee85e6120ab838886bab7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303262, "uuid": "9c6ab64d-aa7a-4911-b70e-2c6ed316ea03", "comment": "Malware payload (Mirai)", "value": "54a790f11f64b2f4a0649f61acd006cefe63147c6d4c122bcbe732fa4c49e320", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303262, "uuid": "20c7fef5-6cc4-435b-ab72-a4000266d66c", "comment": "Malware payload (Mirai)", "value": "32f8e3637223bd0fb0e20718dcfc5ce9533acf10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303262, "uuid": "cca5c7af-3e72-4cbe-87e3-29b1983b02f6", "comment": "Malware payload (Mirai)", "value": "9b71c8a1ed852482a47bb523bf6eab2e6f59384b048a10336936f49b218e44544bbe3371e70ee992ae35174c8131df38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303262, "uuid": "fab36977-e621-4c1c-a497-b97e3275d9af", "value": "T14C53941A2A258FADF76C873487B74E229799379727E1C644D15CEE001F7038E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303262, "uuid": "27ec3abd-5ec2-43a7-9c47-36650697de58", "value": "1536:dMBsSfxI6HdeKImzB1M156Bc2ueZqf3J3J9:afHHdeKFB14eZEZZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772303262, "uuid": "ddbbc5c2-4c06-46f0-9260-a4c1175912e1", "value": 63660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772303262, "uuid": "3a620d76-d501-40cd-b899-d29522dba318", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303262, "uuid": "6e40e136-4e70-483e-b681-dfd119a545a7", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f7f057-143d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772239070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772239070, "uuid": "e4ffa92f-5acd-44e3-842f-872a4e5521f9", "comment": "Malware payload", "value": "be803c207dcc47b101f09f19ae8a73fe", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772239070, "uuid": "6d09b4f3-0424-4076-8c1f-5e9da6335ab8", "comment": "Malware payload", "value": "5578930b4bfca163b6d82f37447ed63964f62ea354fed80878aedbae8ffdcd9f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772239070, "uuid": "dca44a0f-e53b-4d20-86fb-0999f630c975", "comment": "Malware payload", "value": "dc0a418d9291cfd633f6352ec5e3f166b1019aca", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772239070, "uuid": "65b1e88e-0ae6-432e-843e-dd6a6fa4c777", "comment": "Malware payload", "value": "62f23bb709463fddba828565332bd78165942e8e8adb34927c6695f8074eb746b0386106f40f3fa691e9a5e4563f0031", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772239070, "uuid": "dd26cfb2-31ec-49c7-af7c-e9030bfacb35", "value": "T10573B51577FC4609F2FF6B34A9B185041BB2B9672A33C75D1982509E1E36BC0DA21FB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772239070, "uuid": "850d2f65-af08-43ad-b626-ba7bb0e77843", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772239070, "uuid": "1c1f6261-c9ec-4a2e-a366-265e75388f9c", "value": "1536:d+5hkB5KkcyGgoeE2EpmBdCWJVzZO1A5/k4u94QFVR+Gw:dYhS5KkcyG+BBVMuuKQDUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772239070, "uuid": "241c14da-7785-4511-aed5-ef5e755190fe", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772239070, "uuid": "a6d3859f-3303-490d-98ef-2e6db89d89ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772239070, "uuid": "04999b2e-1faa-4794-9215-c1846bb983ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec0d5102-14e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772312175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312175, "uuid": "15bd7032-68e0-470e-89ba-21710f69984e", "comment": "Malware payload (Mirai)", "value": "49efb8e0bfc81c8eae04bf21bebde12a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312175, "uuid": "9a00e5b5-0a80-4873-902d-7e15851d7466", "comment": "Malware payload (Mirai)", "value": "557ff907fb7b490f44577aecca1bfac899aa704f7bb8a91ec3ab9c8c5d5f83aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312175, "uuid": "76bb0126-495c-4889-81a8-aee8be35940b", "comment": "Malware payload (Mirai)", "value": "933fcb765cf71747e71349d487c2086b5c51d3eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312175, "uuid": "d275fd47-b7bd-45a1-9f49-a45c52fbdbe7", "comment": "Malware payload (Mirai)", "value": "de9e8ad49e37b2ed2a7a72afc6d64838131f087d72ac93b787398d5cceff52dc72a499127de8e529a49af784483caf30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312175, "uuid": "69abaa6b-7036-4c08-bee6-91b4fe282def", "value": "T109F2F1FF27279C37D64690778AC31B517EB41F3A91062E193467F683C88485431A75DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312175, "uuid": "6d7b6d22-5c58-46ea-8f83-fcb04a635948", "value": "768:mJdC4xeq0dLaRDaotGW9yeJNL3mqZW0EUlJlGFW3u6lJgGlzDpbuR1JtP:KU42h7otGhe7L3mqQcScVJuPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772312175, "uuid": "d5781cbb-7dbf-4f97-b190-8323e1bd9e86", "value": 36284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772312175, "uuid": "76f51572-3292-479f-8010-669d2414f102", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312175, "uuid": "1a6e4594-a51b-4b96-8be8-142414f1808b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f10116c-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772289229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289229, "uuid": "289c452b-d354-40df-9082-9a656d4e8239", "comment": "Malware payload", "value": "3991c9fe78603ef5860a8dce601e1fb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289229, "uuid": "15b56c53-1c3d-48e6-8964-776e68f22da2", "comment": "Malware payload", "value": "580abe752398f55edb5371fe66492e02790bc6cf8dd56b78fef984bfb76e7d6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289229, "uuid": "c6e11408-6adb-4d74-b509-96613e81315a", "comment": "Malware payload", "value": "6c68c6b9e4076600973e9056268cfbf472b3b93a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289229, "uuid": "3e6f577f-c415-42cc-bb79-830c6a7a1b21", "comment": "Malware payload", "value": "f938acf0fb27d14e9561e26ed5e1a838a5882907b803ac764b85837be3eb92ab6fdf6f067a915425ec20059b4e005a6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289229, "uuid": "fa1af0cd-d7a5-48c9-8909-c9f895f224cd", "value": "T1E393D08FF567A0A8D074F33276B3D63BB5B17422A242EE3091F0EB349F40558176DA69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289229, "uuid": "21f3ae42-8d95-4f02-a713-56344ee8a034", "value": "7d6d61763cedec0b7ae8d03722a406f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289229, "uuid": "f8584180-aec5-4001-8e71-0e9c3ddcc630", "value": "1536:a/UpoNZfM8xDPfKgm91fFvNknsJHsb4m3h80C0UbkSVYXwoPpK8U6v:Z6NZE8t6F77tRsb/SXVj8U4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289229, "uuid": "95068742-db9d-415c-bb11-a3c897d16c55", "value": 97328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289229, "uuid": "c21c944c-ed20-41ea-8761-80bd3815705e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289229, "uuid": "959593ba-0df3-4b1f-aff3-507c077e508c", "value": "580abe752398f55edb5371fe66492e02790bc6cf8dd56b78fef984bfb76e7d6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96559e90-148d-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772273377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772273377, "uuid": "2a2dd087-6516-443f-ae8b-51d7a3c1b33e", "comment": "Malware payload (RemcosRAT)", "value": "8cb7133f023bf9cf62c060cc61c847b1", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772273377, "uuid": "ff405461-e75a-41b9-8e68-68cbebf3858a", "comment": "Malware payload (RemcosRAT)", "value": "58b325dd99d79e625832bc2ba64d90ff7ae33d3bded6cb54ebc1e67d46c0f9ab", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772273377, "uuid": "de4dd14a-857e-4b31-b672-ca82eb733966", "comment": "Malware payload (RemcosRAT)", "value": "c9d68f5c1e57f84144da42012a03d70c40e80d11", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772273377, "uuid": "c247edab-b6b9-4336-a4a0-e2dbec262b25", "comment": "Malware payload (RemcosRAT)", "value": "54f6933af4c9ebb89050c8cd1c0463755102b128d85e2d7702e56cca0ad9ee26f2f056559640f7832c5211eb15023d99", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772273377, "uuid": "3e1af737-84a3-495a-b1a5-709bbf75a6f0", "value": "T1F2E184B9D5A5F8D4822B73913CE6EDC31083D123CF779AA4E14D08E11BA9275AFB4648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772273377, "uuid": "cd7ffee5-c96d-4edc-b660-a9c41fb10a5b", "value": "192:4wOhMb1lGbQmQ1r2TUnJDVqsknC9xfD+qfRfEINlE:4wOhMplcunJhzSCr7d1N2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772273377, "uuid": "957438ee-e9b4-4fed-ae99-9f5f56f8263e", "value": 7271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772273377, "uuid": "fd5f7dd1-cf4f-4d11-9af7-baefb1320790", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772273377, "uuid": "a60cef57-d7fe-4f23-b6d6-6a5446529220", "value": "SOSTENER.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08af4aec-14b1-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772288601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772288601, "uuid": "cc9347aa-6465-4ad3-aa9c-9ecb220f2511", "comment": "Malware payload (SalatStealer)", "value": "8516b052c0f2a0546c42d09d33e5a965", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772288601, "uuid": "5d837da5-1ce0-4b4c-ae3a-ab63f7776267", "comment": "Malware payload (SalatStealer)", "value": "5b0598f5e1fe4bcaade50aac59c6943b6df093f8ba3e410f268dcb1102ad91d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772288601, "uuid": "97653d0d-6de4-4d0b-ab5f-4a79060104d2", "comment": "Malware payload (SalatStealer)", "value": "904af6208419c7ad3f2720469831fb52e950404d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772288601, "uuid": "875df2ba-f02b-40e3-ba82-51f108710f53", "comment": "Malware payload (SalatStealer)", "value": "9a19820c41548b22cfdd4876b64b5013c7740389a1445d7d1b07a48b5ffd4491fc48d96ea389891201953c2df17b9824", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772288601, "uuid": "9e0eb7e5-73ec-4a7b-b27d-ecc6bbe22e4e", "value": "T12FC66B51FA8B54FAE9031835805BB23F63345E048B28CBD7EB547F6EFC77691192A209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772288601, "uuid": "f8281667-a83b-49c9-af7f-39dacfcc0ddf", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772288601, "uuid": "32d8f754-b50c-446f-9395-cb4a1fa84a10", "value": "49152:+3O7kX/Rzxhicujmvhi7rqkqt3MAF6n0EN7nO30Ytbt8NZ3768HAjcrqU/LgVi/F:IikvR7u6vJ/5s+UkVcnEmAOGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772288601, "uuid": "e88ec939-a1d7-478c-adfb-96e5193948cf", "value": 11659264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772288601, "uuid": "75e61120-cda0-45cb-bae4-d9464a7f6211", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772288601, "uuid": "6121b6c3-145d-4730-a5f6-f8e2b1c4bcf3", "value": "webrat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b981a09-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772289223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289223, "uuid": "35a34a79-7e12-4c7b-b744-03b113f00b32", "comment": "Malware payload", "value": "105b55d226f26a7d6e9c1a6dc3df419b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289223, "uuid": "1ead4c1b-c75d-4d32-b114-c479be5860b9", "comment": "Malware payload", "value": "5b5023005a59d1baeedcc3cfaaee1474111c2ac53e359bb24bcdc0d634cf40c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289223, "uuid": "2ec9f40c-081a-485d-bc24-738cbacbf12b", "comment": "Malware payload", "value": "73a5bfa7a4e4af4872009e509266379a6882468e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289223, "uuid": "dda178f9-2c02-4746-b795-45a77696e61d", "comment": "Malware payload", "value": "da2eb5944f160daf6467d6b447100bc59f7af129c130643de666702fda3224be4cc985298b129ccc1251ee0c17d7947e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289223, "uuid": "f83ab469-2225-4207-843c-0e29a9b35a2c", "value": "T1D5D3D04F7063507CC025E2B0AAB3C933AB7174661436BF6D6256EB344D20B51AF9DE2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289223, "uuid": "3e7c9655-e56f-4c24-bd4b-8c23eca56c9b", "value": "d0211f71ed6994a21532e888c12d1098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289223, "uuid": "e7400bff-24b0-4e8d-b99f-1ee89e039932", "value": "3072:UnfCFSw4tYanhKJfd6BgSHkHw6U9Pg1XWX9TNZNeYL3J:UnaowtNJfd4W4g1GX9TnNXL3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289223, "uuid": "074f4fdb-e4e7-4c89-9d9c-a25cfbb5c0d1", "value": 139824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289223, "uuid": "f03cdc69-c801-4352-80c3-b59a98969586", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289223, "uuid": "f07e1846-42ac-4dc9-9ee7-50bf3edb3f27", "value": "5b5023005a59d1baeedcc3cfaaee1474111c2ac53e359bb24bcdc0d634cf40c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f696ad5e-14e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772312193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312193, "uuid": "4a684f22-ab3f-4c94-98c3-f6ece0263dc2", "comment": "Malware payload (Mirai)", "value": "b032c8c398ff473e2853341955ff718d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312193, "uuid": "e645c0fd-4748-4273-b8e9-698a4deb56c8", "comment": "Malware payload (Mirai)", "value": "5ceacfa96cddb621662f8761c463ccfb1bec2a11683ec9faf12bea35261c1d51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312193, "uuid": "e0c8d36a-ebb2-4f25-ab41-6f2fcdde69c0", "comment": "Malware payload (Mirai)", "value": "394e4de9567039fc4469156b3be6031e2fbfb1a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312193, "uuid": "4a33bea9-1e25-4341-bc60-5f71f64d4ad6", "comment": "Malware payload (Mirai)", "value": "4ca7e7b08a021aa05b18d5769a61ffde9269d1026fa116a720f0a23361f8515b5579ee7beeb2b3cadf3ef6e5f6735293", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312193, "uuid": "56d151e9-7f09-41d4-aaa0-af63aebb1e69", "value": "T140735C86BD819A02CAC412BBFF1F118D371663D8D2EA7303EC255F2577DA91A0E7B611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312193, "uuid": "50933c5b-f74f-47eb-8c91-00933ff5f04e", "value": "1536:oHhxE9Y5XeB53x+cEw20LyygCv9QdCllrdeuJFHjXi2lLk7ZAXSRU:4hQckL57vyolddeuJl/NkZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772312193, "uuid": "d3e7168d-07d9-495b-8585-208ad812d9df", "value": 79204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772312193, "uuid": "78c641ce-f679-481d-913c-6cd8c3715314", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312193, "uuid": "dbf89476-6e2a-48b9-9667-0a560a773c4b", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b83426c-144a-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1772244394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244394, "uuid": "c050fd37-1ab2-452a-b8bb-a9d31a8da825", "comment": "Malware payload (DCRat)", "value": "da28bdbc85f6205ec27e15ac6c77715a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244394, "uuid": "9cebe8c3-6f72-461c-9f92-f00fb606541a", "comment": "Malware payload (DCRat)", "value": "5d3d41bb883bc29040f1ac52731dcdd287ca069caa720493a956d7ed635b2383", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244394, "uuid": "477d1a65-08b4-4556-92f5-ae8e877e7a19", "comment": "Malware payload (DCRat)", "value": "d901fcc4e12debb1e821a29e692d4fa6251cef85", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244394, "uuid": "5c78467f-4b27-49d6-a433-2c280f4b95c8", "comment": "Malware payload (DCRat)", "value": "22283f3c1052c0cc0a555dd4257c409d434ae94e9d539e2a785f188b22263301b4282c4bd47d8cc1a592994586565beb", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244394, "uuid": "31207b4d-2b6c-4df4-9d0d-edb2f48a6eaa", "value": "T10D232C007BD5C17BF3BE5F7858E2630545B9E9A32503EB8D1C8005EB0A17BC59F52AEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244394, "uuid": "5cb10657-65d6-477e-a591-b2afaff512f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244394, "uuid": "043a9a89-edb5-4d2a-98d2-2807b4d35720", "value": "768:SU1oSQG4oOxI0E6Wlv9/XN0M28KDrgydQ8ekAZVH+:SUWoOVylFfN1wDrgr8elTH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772244394, "uuid": "789e2fc0-d3cc-4a35-97ba-78f91191088f", "value": 45568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772244394, "uuid": "45d144be-dc3b-4c6a-abf4-066105e8e6f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244394, "uuid": "9b32205d-a7ea-41ee-9fb5-dca21c24680e", "value": "5d3d41bb883bc29040f1ac52731dcdd287ca069caa720493a956d7ed635b2383.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ecd867e-149f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772280987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772280987, "uuid": "2439d139-ce9f-438f-8d50-e837bf925c2b", "comment": "Malware payload", "value": "d915cbf584f3fac508a626b2b461d556", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772280987, "uuid": "7714b728-6699-4e10-b108-2ed17f86967a", "comment": "Malware payload", "value": "5e79bf224441e7892090bb9c54fca3e264377202b1c79fde91c8d762a0aafe9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772280987, "uuid": "22e4c1da-654e-4d91-beb9-e43df21aa415", "comment": "Malware payload", "value": "3008b913799ddbf3ccf0ea8b51821800fde165f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772280987, "uuid": "14ddbc2b-4667-43db-ae27-d5c47780ceb2", "comment": "Malware payload", "value": "b28ef823e55a81afbf0f7cd7db4560bfbd2b84c049c5ed2fd162cdabc47d0b1a1f1962cea3e276bdb0d57fd8f19f435b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772280987, "uuid": "e4c032c5-2f35-4c03-a80c-eaf2bb82c3bc", "value": "T1D2F7594262EA05C4F9F7DA358AE65217D673BC166F3081CF325C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772280987, "uuid": "215d4922-a640-430c-8d66-d2ac00d202d6", "value": "772ec87d3452991a9933a3ba0d9963a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772280987, "uuid": "fd371de1-aa30-46cf-873c-9396174b2d87", "value": "393216:jn1XQgPR2k3m5C507G9ITEc5eAlkLbQurxMWhAsIyNOPS0B4AycWsCYaxFzwW/tJ:j1XR7AsxYqt2oRGj5rs3wb8/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772280987, "uuid": "a236216e-3721-4d66-8066-9e9460b8bee9", "value": 71450112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772280987, "uuid": "b58dba03-3527-4f38-9516-e0c15ff65056", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772280987, "uuid": "f4f402b2-8b8d-4b48-9822-6c2125dc821f", "value": "Nexora.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a328df1-14a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772285275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772285275, "uuid": "59a8dc59-b32f-4aae-8b83-3c369db6e160", "comment": "Malware payload (Mirai)", "value": "fff4c62211b72fe48eac7802ca0b6c0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772285275, "uuid": "0e9218ba-4db7-4b1e-abe1-0e2330e6ed35", "comment": "Malware payload (Mirai)", "value": "5f8431274ea95602832321195e6cbd0dd594966b8218e836d1a9d50d1fd2c681", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772285275, "uuid": "1022a2ef-5a19-4ec1-bb38-5d4e20d3128b", "comment": "Malware payload (Mirai)", "value": "90c4c4dc8ed6fe07e4799e4ea311366b8439eeae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772285275, "uuid": "37b85103-71b3-4880-8247-8c4413bffb8f", "comment": "Malware payload (Mirai)", "value": "808b0f91250c50a88d87b994513f7c94e90b7e12d1277d12d635484dea63a9fa1ea16e92bf1ec5986a904fada613c303", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772285275, "uuid": "35c3b3e1-6a13-43e1-baa1-70297387a483", "value": "T15EA34AC4F743D4F1EC5701B16137FB36AB32E1B5212DE943D3699A33ACA2541DA0AB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772285275, "uuid": "b2d41df7-d077-4865-b90c-99a61f47a542", "value": "3072:hkAFVLsS9EYiWZgs3b5HLHyKXBcu6JL+B:hkAHLs6EL2gs3tOxL+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772285275, "uuid": "8ea249bc-7491-4e38-b7e9-1dfdc30bb0d2", "value": 103404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772285275, "uuid": "cf8c13c9-b9e9-4e66-a1ff-af038fe336e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772285275, "uuid": "e064f8cd-7c5c-46ad-9adf-6b30c11870f8", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0abea2be-147f-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772267129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267129, "uuid": "6cda4853-24b3-45b7-a7eb-5424b850c21c", "comment": "Malware payload (SalatStealer)", "value": "fed2454b6ea71dd261474e64db4a9a56", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267129, "uuid": "d4c2674e-78a5-48cc-903a-b521823c2491", "comment": "Malware payload (SalatStealer)", "value": "60118ba6124480d1c28b3d30f380aa64030418ba1774e8437f9cfae5ea191271", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267129, "uuid": "c488aeff-cf7b-4483-9b53-deb23ac93cec", "comment": "Malware payload (SalatStealer)", "value": "f3cf86fa2dbd488b9c8910e91718151de1fbe0d7", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267129, "uuid": "f4ad1b42-e8c3-4874-adab-cc6bd0abc73b", "comment": "Malware payload (SalatStealer)", "value": "48d053255e6ba5bc6b3ca46fa2472ea30ff81b749b8120a369ab737d1ee0bba67eb14a1aa84fcfdbd2cfa62d84f32a8a", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772267129, "uuid": "66042702-0647-4c9a-b610-e23759de8dea", "value": "T13DA206A977B608BB2007E3D685D7553DEF2F1A832D22E9FC69C5B2C1CB066521D03366", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772267129, "uuid": "b2381d6c-97b1-4db0-9496-f5838373d4c9", "value": "384:+3OSE6tSpbkzZfzrGIXf/dJ0zbYiAc96NAYNLObAS+SesCEzt:+3OSELZktBfFybSo6NDLO1vesb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772267129, "uuid": "6455f4fd-1633-4c50-926a-cdbf268b3988", "value": 21261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772267129, "uuid": "aaeb93aa-7170-4b81-a1c4-12f3c0dc4eec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772267129, "uuid": "d124f493-f712-4c51-93ba-10e8291f10e9", "value": "aywbbg.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "536c7989-1451-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772247494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772247494, "uuid": "7bd52492-c25e-4e5d-a0d6-f033c16e29e1", "comment": "Malware payload (Mirai)", "value": "5c4ddb8b3c5c12bed41a1e4f52e66302", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772247494, "uuid": "3427f68f-8147-40fd-a117-b5f58b329cb6", "comment": "Malware payload (Mirai)", "value": "613c37ea0e7c68d7381ee12b2821affd2e3bad47a8d4babfb61f9443923537d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772247494, "uuid": "ca944bcd-b930-4423-86ec-4782a14794a0", "comment": "Malware payload (Mirai)", "value": "446e9af788e9e300d17969b0b5cc8277e4066c22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772247494, "uuid": "4dff6fbb-e9da-47e8-a380-2230ac564c31", "comment": "Malware payload (Mirai)", "value": "fca5dfb76c157a2126d4fc166b11ffab5e190bdc6a782171d747df895956234e8f980e92c2461708d4e438978b387600", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772247494, "uuid": "e5a78c8b-c754-4c06-abca-3ca98c3460e5", "value": "T173041905BF110EFBD89BCC3B45F9270529CC581A62EA6B36B934C858B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772247494, "uuid": "81e40c7d-a4e2-4754-8e99-5ec7bfb005cf", "value": "3072:t60NrtUpT/5dltGgXGGP9M4S8lrXwU2woriErou0fCtZ1SD39rsJz30s9fx49SY5:t3nEr5dfHPq7UTo2Ecw3K9X0161", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772247494, "uuid": "f417d0ff-059f-4a5b-9f31-79a481585b48", "value": 179916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772247494, "uuid": "8c36bc09-d142-4997-93df-af318d13f333", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772247494, "uuid": "7eefc9a6-ae8a-4324-8cb7-202bbf08d2ba", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20441031-14e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772311833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772311833, "uuid": "18912d87-caa0-4b0c-b733-95330feb5d81", "comment": "Malware payload (Mirai)", "value": "9658da5a8f2db98cfce333a91212cf65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772311833, "uuid": "03d919e5-6342-4185-bf6d-a53e6bd98011", "comment": "Malware payload (Mirai)", "value": "61aaad25aaaf41bc1c8cff42643ed55330b3af416be0ec347680bf56a7fc1777", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772311833, "uuid": "899125c5-ab09-4594-b755-7bb9799d7105", "comment": "Malware payload (Mirai)", "value": "e16a190efd0445388f9e94522113308896e86a7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772311833, "uuid": "19ddcfb5-7191-4654-bc4c-d8e5f8332d1c", "comment": "Malware payload (Mirai)", "value": "01e84acb1ab11ae79d02c90f385931676ed2dd62cfbd4e0f266215c3a93c4436b42abf7c802e8e542d023ec59c130b26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772311833, "uuid": "c3bdfd46-9022-48e7-8ad7-1c7079b41f59", "value": "T1F804F104FF0D0853D0426DB44E7B0776D72D4A7A14FCE5AC6248B7970E62A7A829B7E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772311833, "uuid": "df6faad4-a088-4d88-9ef6-f6e12a27afea", "value": "3072:ozdurayQy5HEcMf3o8OLfz0t8vPwlzaPSZS56IzE/jVtG0ZbehOahWFYiqBQK:ozdurafekcMw8OLfz0yvPwhISs6l/jVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772311833, "uuid": "f2796625-6ad3-4aec-a3a9-20364f24a128", "value": 186176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772311833, "uuid": "163f4383-9ab0-492f-8f1e-eb3b2da993e0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772311833, "uuid": "2fc6a2d8-ea67-428b-bbc1-05115c5d66cc", "value": "5z1bep0pjw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f755f08-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772289122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289122, "uuid": "b33e2b38-1fe0-4338-ba61-b2f5386ee6b3", "comment": "Malware payload", "value": "4f565834b117706beb37df582fbed790", "object_relation": "md5", "Tag": [ { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289122, "uuid": "579951a9-4674-416e-a722-1bb20129fd73", "comment": "Malware payload", "value": "62a20262d938e165231053ab5549369276c93cf868a2ab42faf3df03af903fec", "object_relation": "sha256", "Tag": [ { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289122, "uuid": "ece7389b-aef7-45cb-8056-df4489e09d2e", "comment": "Malware payload", "value": "7560406969ba88a6bcfd86c451033f39ab472044", "object_relation": "sha1", "Tag": [ { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289122, "uuid": "d548a59d-bbf7-44d3-8a9c-406be763449b", "comment": "Malware payload", "value": "ec0ad64f935d3a17b403dc4c39d817a369032859d2b4d36a453621ddf6b7fc27fbcde6bc51c3ec08316b333cad7ee295", "object_relation": "sha3-384", "Tag": [ { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289122, "uuid": "0e203337-ac1e-4d41-84c7-c3d875cc0938", "value": "T185253385EC75C87ED8DB7568BC246C026439A2E6A907F2A5FF053DC3D8A90EECD44E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289122, "uuid": "061d9091-f1aa-4a92-8e32-4dfc9fd98c72", "value": "24576:nU3P4JOi3Ap1AQuHukXfmv42o2vjhC5NZ2/yjpPyPXlBq:CPsOCAp1sOkPm4+k5D2/SPUXlBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289122, "uuid": "b1ba5876-54ac-4a8d-af07-93c0702fd350", "value": 984660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289122, "uuid": "f40c7776-6e1d-4491-8d08-cbeeb22d18c0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289122, "uuid": "3bb7833e-4f9a-40db-abf9-a06385f91d17", "value": "update.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "136927a8-144c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772245240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245240, "uuid": "82cd3353-e2f4-42b2-b7a4-9d342ff7bc13", "comment": "Malware payload (Mirai)", "value": "871c2f611968dc6995dd96b06309c4c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245240, "uuid": "db67308e-f476-4699-bf46-eb9b39b1c6bc", "comment": "Malware payload (Mirai)", "value": "63533591cd3a43974e01ac57ece3d293f874dd03498435f3bae1311de15f5cc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245240, "uuid": "03218d7b-8f78-4a52-98bc-adcf08e3060a", "comment": "Malware payload (Mirai)", "value": "46447cf25d5e81038da0e0470a00ec12db898f5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245240, "uuid": "d5160281-d6e1-4448-a953-2432c5b804b2", "comment": "Malware payload (Mirai)", "value": "0ac555a30508ea829af95f5fdac7bc9b17b189115d980231eb466c78026988561c1ddb605510513023124b37876dc158", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772245240, "uuid": "5c5248b2-2992-4f53-b930-a48e33d94317", "value": "T133D33845B9829A27C5E523BBFA6E018D332563E4D2DF71178C215F217BC681F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772245240, "uuid": "f19cc361-a5ab-4aaa-9e47-b9c06ff98963", "value": "3072:snFif7apx6XS+kUgpjWXlsCM48GWoEqRziQSI:sn8ZS+dQWXlsCFEobOQSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772245240, "uuid": "a07f1ffb-d8ed-459d-84d1-898ee6c19088", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772245240, "uuid": "7ecc1022-7476-44fd-940e-e2aa4807a363", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772245240, "uuid": "963ccbf3-d405-464f-b85a-69ac6014f28f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd90cc5-143e-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772239271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772239271, "uuid": "85544840-9235-4c1f-a5ff-df5c2de99623", "comment": "Malware payload (SalatStealer)", "value": "f4b6dd79c4e62dd6be04159c372ed8ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772239271, "uuid": "37d34b83-0cac-4f2f-a778-bce8270ff9f8", "comment": "Malware payload (SalatStealer)", "value": "63678b8d16271e4e02a7eba9e152646db7d1382edfa4b251d9d609514eb1fa50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772239271, "uuid": "f846a8b6-44a9-4a9c-9254-6a368c6f9908", "comment": "Malware payload (SalatStealer)", "value": "c5c1d44809e816c6243122f2819b8213edf2d1eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772239271, "uuid": "531797b2-af6d-41a3-8931-0497dc508671", "comment": "Malware payload (SalatStealer)", "value": "7874f6f843fb4157affa111dd03ab87dfa43e142aeabdeb7617044135b3c484919aef03a82429d08088ae4225cfc1bd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772239271, "uuid": "32d88c4a-a1d2-499f-acaf-89d7cfddc34e", "value": "T1D3C65C51F98BA5F5EA035831409BE23F23316D048B28DB97EB547A2FFC7B781187A605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772239271, "uuid": "129b85b4-196b-4fce-a913-b0741bec2abd", "value": "49152:9TXP0w53auryy5MdmPMb1rAnryCZKBNn8Xau/6LZEiPzNUtghvuLyR7rHpaAxH9r:Vf0w53D5fcvCiutgQ8Baa9yort5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772239271, "uuid": "2d0e2aaf-c51a-47a5-ab52-bf2507377ae3", "value": 12255744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772239271, "uuid": "6b7cc8f8-84c0-41af-b947-561b311c10c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772239271, "uuid": "027249b9-5e0c-4831-b9fe-cfabc41caccc", "value": "x63678b8d16271e4e02a7eba9e152646db7d1382edfa4b251d9d609514eb1fa50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03513857-144d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772245642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245642, "uuid": "5203e5ac-bf89-4bc8-acf7-bb27476591d2", "comment": "Malware payload (Mirai)", "value": "68204f99259b519d7727eb25da8a137d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245642, "uuid": "a3288b86-097f-4cc9-890b-7962559dd09b", "comment": "Malware payload (Mirai)", "value": "649bb24ebbfe22488795beb9e0e4a59e1f5294d13895f69df4c8aa4eaa027f38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245642, "uuid": "1ad82c48-4ede-43f3-baca-508d560a2cb8", "comment": "Malware payload (Mirai)", "value": "0a0440d16089184725305321d65635c142fbb3d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245642, "uuid": "3150b1c1-f208-4dcc-8aee-9106b00b2996", "comment": "Malware payload (Mirai)", "value": "adf77cf785cef0e54c83b6dbad8a78a8aa4e899deccb2450ee3983d2132d3a365c6c11c620a3c26eb1d798aa74cfc6fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772245642, "uuid": "f146736b-526d-4c9b-ad57-21e1fd1553c4", "value": "T18FE33A17B5C194FDC4DAC1744FAEF53AAD36B19D1238B16B2BC8AA221E4DE305E1DA04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772245642, "uuid": "6e9a40ba-683f-420d-9583-1bd7d9634745", "value": "3072:8qyoG7VMD+5T27M/eu7AC0EFGGXGxgUFCu2g5FY03lpF:8qyoG7VMD+5T27M/pR44iPpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772245642, "uuid": "0495ef18-5bb3-4cd9-a0f1-5533b6dac8ba", "value": 152424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772245642, "uuid": "e106ee74-1195-49e0-bf06-eb8eb9578be5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772245642, "uuid": "b0de3281-7788-4432-bbe6-748b88c306bb", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a23f9e4c-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772289288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289288, "uuid": "ed20504a-4a49-41c6-987c-315835dd018a", "comment": "Malware payload (Mirai)", "value": "4130907f636061c1c2a325a360975bf6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289288, "uuid": "8886e988-c7e2-49c1-b4c6-c1cc9fc4d975", "comment": "Malware payload (Mirai)", "value": "655200842dd9c9e6a297e68e2d2e320fe56ed995322ce1f8e7bbbae9f8d7a92b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289288, "uuid": "b4713ddb-92b4-4c71-a63f-78204dd298a8", "comment": "Malware payload (Mirai)", "value": "16f66a092f96181f43d2e8139738381e3e761c56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289288, "uuid": "303548e3-f9cd-4445-bc0c-e026cbf4f1ca", "comment": "Malware payload (Mirai)", "value": "b148fb74d5130a93bbad587be95c0830564e61b04a4917f5fe05c3a2998f39cc31b125e6664e49eefd0cd57aa7e8addf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289288, "uuid": "926553d3-23e0-4048-bcb7-a534a84baa7f", "value": "T12C835C03B5C080FDC899C17157AFB536C863F07D1279B15A27D8EE16BD8DE502E6AAC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289288, "uuid": "1c29908f-4744-40c8-909f-5e6a4b72b00a", "value": "1536:IhXIV00j2FkcfTyWF4dg8/Y91GS32SgVN6kgYEzYgXNO:mXSj2RfTyW4xc1GS32tN6kgtPXNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289288, "uuid": "d17fe6b5-ffdc-47bc-8be8-09268b35ba5f", "value": 85792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289288, "uuid": "1aac48de-aefd-4fa2-aa2a-61799d8f2150", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289288, "uuid": "a38e248f-24d9-433c-b0dc-10fc0883de94", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b323c89-148f-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772274163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274163, "uuid": "6e06bc33-f732-4f2a-90dd-31ba09646e07", "comment": "Malware payload (RemcosRAT)", "value": "8320ec51992979707d82fdba1eb4f806", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274163, "uuid": "a6ea5186-ee87-4cf7-bc0f-fc7372bb9e0a", "comment": "Malware payload (RemcosRAT)", "value": "670b67c5cbba724c8ed85893bb866f7c4dd3fab133266f4f2c1aa7a3575622bc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274163, "uuid": "89f7473c-cc73-48a0-8208-3cef739f7fc9", "comment": "Malware payload (RemcosRAT)", "value": "0d86aa56724b2d882a67020991340d34ebc1e692", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274163, "uuid": "ce359043-d6a2-46ee-88ac-250d0f5e8f2a", "comment": "Malware payload (RemcosRAT)", "value": "0e2b657b5cd59f5f9371516ae139e5888e567d0baa1ab557b18ef723ec6ae42866d9daa46a19fae092145c6cbc4e6bad", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274163, "uuid": "5d042169-e42d-4292-8c1c-0b8dfd0c9d39", "value": "T105D5BF47ED701B9E4EC64E07B06B84FF30510AF562CBB937B6B5962141E4295FA3A3E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274163, "uuid": "5305c3cf-0639-4268-9c28-c814cf54b339", "value": "24576:0fKRDEMHeS8BARjWYHW+WBmJMoROmi7+3wKo:tE8bRSyWUJMoROmFwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772274163, "uuid": "0908ecfe-ab5b-45a9-b173-297bd19c6a61", "value": 3017264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772274163, "uuid": "d13a329f-7fe1-4ce1-bd81-3acd54afb718", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274163, "uuid": "f2663e90-44ea-49b9-86a9-8c7814ad0517", "value": "8320ec51992979707d82fdba1eb4f806.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1edd3c53-144a-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1772244400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244400, "uuid": "5e047161-9999-45e5-9504-3354d606c3fb", "comment": "Malware payload (DCRat)", "value": "401c002f4e6b7655659bef7ae5c8f571", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244400, "uuid": "f1c45a0d-c82d-425d-b512-fa09d369c70e", "comment": "Malware payload (DCRat)", "value": "67186d0ccd31b956512895b5bf79a7d85ce840c1979aac66b06cd55cef281b7a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244400, "uuid": "f89cc7ec-08e5-4c0a-aa66-f9a650d29e29", "comment": "Malware payload (DCRat)", "value": "3e0286b7cf7e6ed54c507f70b4d8b89782d96f31", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244400, "uuid": "70cb102d-1ace-47ae-999f-a3da1e4d76a8", "comment": "Malware payload (DCRat)", "value": "5537b20109d7f0cc95e53388b943d6eddd6f3d20f4f2bdb09bfba2a80c20a7d6b0e0146515296550d5f112233534910f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244400, "uuid": "711303cf-3fde-4003-bc6b-d279325d489e", "value": "T196133C00BBE9C57BE3BE4F7854B3630545B5E5A32503EB4D1CC404EA1A17FC98A526EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244400, "uuid": "785d05d2-05ce-4da9-8b9f-63a9d8d32084", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244400, "uuid": "a71f7171-3940-489a-8301-dc05353caa8b", "value": "768:2UoSQWtTxI0Uvlv4/XNpMsIDrgJdQ8ekAZF0+:24TVQlwfNCsIDrgc8elz0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772244400, "uuid": "a83e20e4-c6de-4dbb-99b1-df11faa9caf7", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772244400, "uuid": "6b5418d2-91c0-44c5-9c2f-4a181d6a5e89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244400, "uuid": "d666b6bd-60c4-4eaa-9cf7-cbd4e8185ebf", "value": "67186d0ccd31b956512895b5bf79a7d85ce840c1979aac66b06cd55cef281b7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c6563d-14b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772291601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772291601, "uuid": "5d1de364-ec09-4d87-82fb-af8aba1d0af2", "comment": "Malware payload (Mirai)", "value": "fd0b0cb0e96312a179ec8d9eade98051", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772291601, "uuid": "9d1a3bde-1449-4fc8-9df5-c22cbbd71c05", "comment": "Malware payload (Mirai)", "value": "6739043920394fc148b5649e08c9783fc9c354df442f9126bd43ad8588649e05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772291601, "uuid": "9fc432fb-79b3-4e70-b3f8-1e731d742ed2", "comment": "Malware payload (Mirai)", "value": "5ced4f72a3bdc90456635430f7cabc0b8caf0570", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772291601, "uuid": "9cfd3c3c-c7a5-47fc-9429-33794ce56882", "comment": "Malware payload (Mirai)", "value": "095498d0e2ec06fa0b5ebd03e5cdc64d803ca5f7bc725a2fa1b2a07e9e2654fedf7139f72cbbda908af3e0992e601c1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772291601, "uuid": "865979a0-3dc7-40ef-9dac-f489bde8e811", "value": "T148132986FCC24A3FC2C013B9A66E5A4E3761E3E4D2CB76079E54577136C620F1D6AD84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772291601, "uuid": "d69ea46d-d70b-4c5d-b93d-f3b6f7927432", "value": "768:XG2/l2Q2SsD3pDi9ZbyE2hk4G+6ZQ+QVgOJUCmJdtBNCwioOM:X3+SsDUJn2hPq8VgOdGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772291601, "uuid": "6109541e-7e44-48ec-8701-33ab2ea72edc", "value": 42788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772291601, "uuid": "ee5880a3-b7cd-4f5a-a64c-cb16ab405f07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772291601, "uuid": "1bcebce0-5849-4b5e-82c9-99aa17a31f1a", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "608014ae-14a8-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1772284883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772284883, "uuid": "2fce5887-6d57-4dc2-80e7-e91bb29a07bc", "comment": "Malware payload (ConnectWise)", "value": "636f6ac01d42061f5c1b11c46676e252", "object_relation": "md5", "Tag": [ { "name": "95-216-63-67", "colour": "#FBC290", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772284883, "uuid": "e51e35d7-d3ad-425d-9d14-abca2eeea6f3", "comment": "Malware payload (ConnectWise)", "value": "6756bfeb1428ffa48ea6d86c46b48a5e530d97390c52fb7f3819bbd8baba4301", "object_relation": "sha256", "Tag": [ { "name": "95-216-63-67", "colour": "#FBC290", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772284883, "uuid": "49424ef1-66bb-4d2a-a86f-0157a88bc736", "comment": "Malware payload (ConnectWise)", "value": "f7153362f6950cb6eec39e3f7d8ff89733353f94", "object_relation": "sha1", "Tag": [ { "name": "95-216-63-67", "colour": "#FBC290", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772284883, "uuid": "02f914e3-56f3-4143-bbd0-d3fc9dd92200", "comment": "Malware payload (ConnectWise)", "value": "cc99224f876916fc9b56b7eb4f99534a0b26413e36ec793153a317b2337719b495ab496dca4ff7b5f82528f9c26fe632", "object_relation": "sha3-384", "Tag": [ { "name": "95-216-63-67", "colour": "#FBC290", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772284883, "uuid": "6d7249fb-56f1-4fd5-b298-d1ffa36f2e59", "value": "T1B43623317AA0D139E2B4293DC83AA6F1A56ABD21D673452BA3747E1D3C70DC04A73736", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772284883, "uuid": "28308908-b223-44ff-9426-4b6cd1811e09", "value": "98304:CIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlVIdoaxcp8wy5c3teIw:LHxcp9ym3nltDUJVUHxcp9ym3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772284883, "uuid": "ebd37544-f6c9-4e61-8196-132e7e6299ce", "value": 5003433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772284883, "uuid": "ce0c9f6d-8388-481f-ba61-62a0120a38e7", "value": "application/x-ole-storage", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772284883, "uuid": "01de257e-ae65-4992-b97f-13173f09d962", "value": "6756bfeb1428ffa48ea6d86c46b48a5e530d97390c52fb7f3819bbd8baba4301", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62926c57-14b3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772289611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289611, "uuid": "699315f8-7c12-498e-b835-68f0cd0d4bb1", "comment": "Malware payload (Mirai)", "value": "e134e8cda45cf202254eb7641e747d8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289611, "uuid": "e20d3761-1c89-483f-8f61-1b0abf3d5032", "comment": "Malware payload (Mirai)", "value": "6856d9075a032de9f5c4565ed4fbd699634e86e6001599a0b61bc88a18b050f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289611, "uuid": "3c8c774d-07ed-4e38-99b8-8bbd7137470c", "comment": "Malware payload (Mirai)", "value": "11cfe681730955b9ba2336179a17ba25c64cf9be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289611, "uuid": "0d5e821b-d3eb-49f5-b368-b4e4c3797cda", "comment": "Malware payload (Mirai)", "value": "24a8a78a2f6569349aad06952be0beff164136b678f43826c1dcffd18fccd20b4fe92af685602f521ad98f9fec8b235d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289611, "uuid": "a760ee27-2bb1-4aef-82a4-1ab0d494fc06", "value": "T185F31B45F8814B12D5D112BEFE1D128E37231BB8E2DE72129D245F647B8A97F0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289611, "uuid": "f7fafe79-5cef-41c6-be18-c24ef8fda409", "value": "3072:ZcLaYzU6hhoTXubj7I4XaO7PGJ8VGYvDYbY:ZuaYzpQTXuv7IyaIXGYvDYbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289611, "uuid": "1c0cf39d-b169-4ab5-abba-fc51c1294a61", "value": 157596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289611, "uuid": "02e8b7e9-4764-4dbe-8a1c-e1fda364505c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289611, "uuid": "dcffafd4-8e67-4d53-b924-abbf6dbb55b8", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0fae77-14ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772287476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772287476, "uuid": "ce9da5c8-8fb6-48f0-a42f-c958943b0132", "comment": "Malware payload", "value": "e682d391bfe09de423506a25c0f89cca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772287476, "uuid": "326371a9-41bd-464d-830e-851872bd15be", "comment": "Malware payload", "value": "685ff0285801079f046098d371f482dbf8bb6a3a5bd5c4ed937e5251f6b0c54b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772287476, "uuid": "40c839bd-dd76-4332-b629-5ae316317c34", "comment": "Malware payload", "value": "d748ff4c47b5a8b489c0c0613683385d63932a68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772287476, "uuid": "3465adcb-0137-46a1-badb-7fe30744115d", "comment": "Malware payload", "value": "8947f3c71ab533e7c5c9857c60dacea6f4e00d0ef90972f0ec8124c997b188b79d820eb47f616ebb281e0169485268e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772287476, "uuid": "88a52339-4754-4335-829d-fbf7dff2210d", "value": "T153934D29737C8E55F7BE0A7834B1116503F0E18E6151F39B8EC174EA2FA57825A18EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772287476, "uuid": "1d655e82-9912-494c-9600-2fdf70c3204b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772287476, "uuid": "94b80fc0-a1c1-4503-85e9-60f7aef4a6c0", "value": "1536:nAMmZ4ncANxGG7WY3YnOkmjixBml2kV3IIYY+BdabRgAoucOIyMYdau6vwxnSE/j:A5ZMT/RYODSA3I4+GWucry/d4vKF/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772287476, "uuid": "2a00749f-2a61-4a2f-9b4f-690ea1c0d0ed", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772287476, "uuid": "a1cf800f-696b-4102-b009-15d962525737", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772287476, "uuid": "09621144-9fde-4f94-adae-0a4de5c05841", "value": "Vernicle.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fd2e3d1-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772289203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289203, "uuid": "09811db4-ab66-4cda-8670-bcf45b0f568b", "comment": "Malware payload", "value": "d12ae38189c1e8276eab980d83ed0724", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289203, "uuid": "812c8ba0-7bb4-49a5-bb8c-30ecfea1197b", "comment": "Malware payload", "value": "69671ffff22adbf6d5f63aab67a49f5a3900df89d9a3a43050085fce448ba329", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289203, "uuid": "ce8e69b2-1256-4a05-81b3-c4513220c87f", "comment": "Malware payload", "value": "70564c2f017cf98ba3eeba78cfc0c7a7960ad139", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289203, "uuid": "e10e4510-6234-4d7a-8847-50bd1ff8a5eb", "comment": "Malware payload", "value": "36711afaad9f0502a21cc0ec194281a31855a91b0f17c93d769724141dcd1cbf0dec0eb9fa5f289c645ef61bf7c25225", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289203, "uuid": "23c417eb-d587-4e65-9895-6f660fafc4b8", "value": "T166D3D10BB16354A8C011E275B773897B5B72B46A0531FB3EA2A4EB358E30E911F5CD2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289203, "uuid": "3c4a61f8-18ee-46ff-8001-f2662626dbab", "value": "d0211f71ed6994a21532e888c12d1098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289203, "uuid": "81b040ba-47c7-4d3b-99df-85926a48812f", "value": "3072:TnfCFSw4tYanhKJcW99JZlUv4+S+jbPjCTGGJalJqPrP:TnaowtNJcgJZlUgPcbPj3qT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289203, "uuid": "3d8e655e-e0f4-4b5e-9297-4ddd9389360c", "value": 139824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289203, "uuid": "6c544072-2193-4712-ab29-fc932826cf93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289203, "uuid": "13c571e9-1380-44d1-a435-3665c75d8226", "value": "69671ffff22adbf6d5f63aab67a49f5a3900df89d9a3a43050085fce448ba329", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf7649b-14ca-11f1-a769-42010a9c0008", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1772299614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772299614, "uuid": "7859d010-8102-47ef-8b5f-5fd1ac864319", "comment": "Malware payload (AveMariaRAT)", "value": "5d9dfa462f373d1079dc473f6158b5f2", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772299614, "uuid": "2bf7b989-3529-4a33-8612-297dd22b17d0", "comment": "Malware payload (AveMariaRAT)", "value": "6b12108eba790d754b14512dbdd0d9902e9390f68c8a07ed8fa33057dcc8ffee", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772299614, "uuid": "a9d119fa-fb8e-43b0-a517-03afc3cd2dcd", "comment": "Malware payload (AveMariaRAT)", "value": "ba8879f4047184fa077db902200ec12fc9e3bde0", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772299614, "uuid": "38765367-7b9e-43e3-8b1f-692d2d288e74", "comment": "Malware payload (AveMariaRAT)", "value": "3580fa27a591ddb2e123a5092a2fc0e3e7839ef059b5d329012eed751fb90769a147705742e63376933207b4cbd2bbe0", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772299614, "uuid": "49218f55-5e87-4da9-9402-d9f5891b10a1", "value": "T1FFB6337312290154E1E0C939C737FED173F726A6CE81AC7D45E799CA352A9AAE113E03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772299614, "uuid": "0b6e46c3-a787-4bce-91df-e7edaf0aecd9", "value": "7947afc80163311e3e5d832fdc2f505a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772299614, "uuid": "ed191f4f-4927-429e-afc6-4b52c5fbd53d", "value": "196608:cX3kMlK32MZ5DSc9LNjGRE/Bue3uVTCLNNskYGVyXEIMoVTAyUXU:20MFMZ5Gc9LQS/BuAKuUkY3XEIMoV0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772299614, "uuid": "72079251-eba9-4d78-aaf2-0a21bd59dc52", "value": 10463744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772299614, "uuid": "e82c7a65-4095-4663-9a6c-10adddf698f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772299614, "uuid": "d573ae72-748a-4be0-8261-d3452d9f257d", "value": "builder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ead6d4b-14c2-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1772295912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772295912, "uuid": "1b5a5abf-b3e4-4034-8548-bf82bc2785cf", "comment": "Malware payload (ValleyRAT)", "value": "42b6bdb3c88d5558033bc31e8b963ceb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772295912, "uuid": "da30d4b0-ca20-49d0-8202-2ee65d18d395", "comment": "Malware payload (ValleyRAT)", "value": "6b3e74d8e282f097bb57d372dd9641248c46221878bdab19fff75f3f3de37950", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772295912, "uuid": "62a393d5-2ebd-4d7c-825d-60e671e03446", "comment": "Malware payload (ValleyRAT)", "value": "56bea48c8ac79cb7aae69a46af83b6555a5a0457", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772295912, "uuid": "6077e74d-d71b-4541-bb54-56611eec621e", "comment": "Malware payload (ValleyRAT)", "value": "39edb766ffd007b70a6d87e5ff176c1586a95b48bc4c3a1937842dcd791d05d5ee274515568c9dda6b7d57aaddc83b9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772295912, "uuid": "866a1f74-8915-4ee5-acf5-541bd6477d5e", "value": "T18C53F722AD0800E1EA74A170187E337FC6B3A5B64B154BE75BE8DC2D59650C1BD3A3ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772295912, "uuid": "6e09aded-a47f-473c-9286-e0044bf99701", "value": "350b36b2e878e28352bfcb596eeb41c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772295912, "uuid": "17f3cd88-3357-402a-9d30-f34a55bead32", "value": "768:wC1TW0Zwz2/xJp3SKxA93J+5i4DS8FM4nLBYwKjv+Ps:Y0qyZPSye05PvFlLBLPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772295912, "uuid": "3aac3995-e863-4c63-82c0-44fa812cad6a", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772295912, "uuid": "c3324f8f-8b97-4073-a0c0-9a222d5f38f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772295912, "uuid": "6e3b6839-7c3e-4ed2-8c74-98af1d787361", "value": "6b3e74d8e282f097bb57d372dd9641248c46221878bda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee9ea91f-14e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772312179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312179, "uuid": "90746468-ce9c-4fbe-8b3b-1a9cba307e26", "comment": "Malware payload (Mirai)", "value": "9e63537435466a724f3f95fc27b1b823", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312179, "uuid": "194cda02-b249-446c-ad73-d93a0d6b2c2a", "comment": "Malware payload (Mirai)", "value": "6b57867bf395c70c37fcb41483d0adf4c3a152cf343bce8b036bcc16f3537404", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312179, "uuid": "53742f46-5c99-4432-825b-28ea0219bf29", "comment": "Malware payload (Mirai)", "value": "766f3d8b4724a458af77586c0d19813cbcc5234d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312179, "uuid": "af8ac120-fa4e-49c5-bb49-c7c93bc84f8e", "comment": "Malware payload (Mirai)", "value": "29dceba5dd23388dde59b1e5e4dace11fb1d62a3f85156ae14d6afe2fa8002df842d56d99453fba7290a643f1bcbee13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312179, "uuid": "3d867b27-3356-4be9-af6c-858e9f7a0f02", "value": "T1F7E2E1E0CDE1CE95DC0FF4F0ACE8D7C2B3650E895691D4E164D4CF4326161BBAA86AC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312179, "uuid": "3f3c4920-0ee6-4fee-90a1-c13b8857e7ac", "value": "768:E1c3NKX+nqaw0Ivjp9Dl6EB1eQ2lCq5wp24uVcqgw0z/:E1c3NKunqH9bpVl6EBir4u+qgw0z/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772312179, "uuid": "772d0cdf-3619-4922-a059-814cbd4ad86d", "value": 33536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772312179, "uuid": "c28b3823-dbff-4161-a427-ab89bb7166ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312179, "uuid": "64a5673d-e112-4366-8e3d-b0b7c56b70c8", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a70cfd-145c-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1772252122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772252122, "uuid": "e978da1e-8573-4d4a-b9fb-4332511d3e9f", "comment": "Malware payload (Joker)", "value": "ace24cebff97e7d2d7446db33fb1cd09", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772252122, "uuid": "8c4522de-7138-415b-acbd-0373b862ab21", "comment": "Malware payload (Joker)", "value": "6b841074a9ee076547e68be969e73fc309a9a594a48718625efb0b2d1c34bee4", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772252122, "uuid": "eb60d215-9a25-41ec-a8d0-a3be5999a619", "comment": "Malware payload (Joker)", "value": "e1dc871e292f9ce7c0a49846ef6d15d06f28f46c", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772252122, "uuid": "f69f402e-9592-4206-9947-6c739d7d7908", "comment": "Malware payload (Joker)", "value": "386b8db8e74d9a53b0fa80441f00bbaf96cf72881195b2c5d756ca0d927baaba42aa33ae25a34326822ba24e502a264f", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772252122, "uuid": "7ffb5928-fcea-4fd5-9df1-0c0c127df8f4", "value": "T131271206FB0D9D2BCDD3B438A997039172166C9C5250C3975912F228BFF76D89E2ABC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772252122, "uuid": "317ccd51-9f83-4ab1-a540-28617ab85f47", "value": "393216:unHpmRPLgXUbLxkqIlNdECv68niytU+DZYQ32eEn:MpkLNbFkqUzECvLVtZ32eEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772252122, "uuid": "7e532e5b-d9f5-4329-9590-e4775ea7cc36", "value": 22252889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772252122, "uuid": "ad74b181-1c74-401c-bcbc-23aefab19fca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772252122, "uuid": "ee3c0002-0d0f-42d0-af1c-5c75e771c86f", "value": "com.heyigu.device.cleantool_1.0.2.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e45bb3e2-14e7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772312162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312162, "uuid": "d5208138-e967-45cf-a418-3f5025354053", "comment": "Malware payload", "value": "4e59d13e4642682090df785da239242a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312162, "uuid": "83888d33-e33b-43eb-b00f-ff1111424658", "comment": "Malware payload", "value": "6bb8455de14a091e5922b0bbad3d69d0e5ecfda2bd3f81d8bb73d5a5d3f400e8", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312162, "uuid": "a76ae735-364e-4ea7-be49-57bf74ef2e6e", "comment": "Malware payload", "value": "effec1c57a1de8206f77711f8fceda0e1c72be88", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312162, "uuid": "995ce38d-3f27-46d8-9b31-3d15ab7acc8d", "comment": "Malware payload", "value": "46f5105aef2eb7533351e24b650b24dedb6eee30cde3bd3b48ff02046e1992fd98d92b4a062fabdf1b77b443aa05e2ef", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312162, "uuid": "804d887e-012b-4817-a4d1-5a864a735e8b", "value": "T1F746F1C6F7D8A92FC8775072C9BE52B141874C028A839F836D18760C69BB5D46F5AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312162, "uuid": "5607904e-ef5e-41bc-97e3-d53dc5f8adea", "value": "98304:cWPNMoTwrYBKOfsros5OrsbxYfc0D1BWoz5qPvrEZC0vPqmYZnXrfLR/mpCltk:79KOfyaIbaciAFvrEZpXqmY9XrF/mpCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772312162, "uuid": "a1a47329-5609-404e-aaa8-e0d1539a9a79", "value": 5860555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772312162, "uuid": "6b0bc4fd-3a73-4d93-8397-8ae7573668e8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312162, "uuid": "16ddbe02-ac54-4874-beb3-a6684995c936", "value": "Hunian138.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb73bc47-1474-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772262809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772262809, "uuid": "9334abaa-fb77-408c-a26a-c544664c6ddf", "comment": "Malware payload (Mirai)", "value": "657654bb881b119918e418cd68e73ba2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772262809, "uuid": "912c85c9-8509-4c14-958c-cd02aa2cdfad", "comment": "Malware payload (Mirai)", "value": "6bba94ed6f459d480ddb5ccf6862465dbdc4a35c7ea31bf66b3e6074d06fbbb0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772262809, "uuid": "e94428aa-d415-44af-bc07-77d0fa1a1028", "comment": "Malware payload (Mirai)", "value": "b88f27de6858a8a04a9cf9bf346512a847a07de2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772262809, "uuid": "f8a97abc-de34-48df-aada-3072ffcf332a", "comment": "Malware payload (Mirai)", "value": "8a990cbf88bde70f1149efb74d5458ca5abe286d4c855e6cd45a427ab50fb76e340121ab5bb2633d2255d13ef09f8aab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772262809, "uuid": "800bf354-a4fb-41d9-875f-2674fabe7912", "value": "T1F6142A46EA404B13C4D627B9F6DF42463333979493E773069528AFB43F8679E4F12A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772262809, "uuid": "ba6c91d9-d05c-4627-902c-92f80719f99c", "value": "6144:2R1a6BqbNragXnDWS24eLlBOIA0rM/RuRw:o1arbNraInDWS2DFA0A/cW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772262809, "uuid": "48dd3236-dc4c-4f01-9362-cb7440b0e45b", "value": 198026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772262809, "uuid": "19cdbf4e-ff1f-41c8-8380-2ed71bec1eb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772262809, "uuid": "dc0fa870-74c7-4809-abe9-cdbbcbfe2517", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "392293c6-14e7-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyNote)", "timestamp": 1772311875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772311875, "uuid": "e88e5395-4766-449a-b49f-255732229bcd", "comment": "Malware payload (SpyNote)", "value": "3ed5d51c0de69913571138b2b9617729", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772311875, "uuid": "3867c88a-dc9b-4839-b640-ebf83052fa44", "comment": "Malware payload (SpyNote)", "value": "6c1aeaeb5786f3632f0a02356b26bdde2ccf77e1e8c6d3f8f6b88e9458f7839f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772311875, "uuid": "081348af-e067-4473-bb3e-00746aa662eb", "comment": "Malware payload (SpyNote)", "value": "64fb57126c243ef980a1254bf165585d3ed8f51a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772311875, "uuid": "6986098f-e9ab-47e5-b1f3-f8871a2096c8", "comment": "Malware payload (SpyNote)", "value": "57d43f0ac1b6c53f746f8f62eab452f8dc02c99e28fd3f0b3eeaaf7b8469a6fce70ff00688a13cd7ab9e2721429c59bb", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772311875, "uuid": "62a4ccdc-2d30-4cd4-afe5-c2314151b3c6", "value": "T1CB96F007BD42CAC7C56C92F5BA134FA82A371F49C5426EEB00253A6E3E361E64DD65CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772311875, "uuid": "35660cb5-beb4-4fcf-874c-9dbb04948671", "value": "98304:uioW49DJNHxL8e3IA5E0OqmzBzB8TN0tE1:uC41JZxxj5IFz0CQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772311875, "uuid": "d6475d69-eea3-4d51-8ea0-c69730dace49", "value": 8927923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772311875, "uuid": "09b9bc8c-ac86-4b93-8090-b704b96f93d1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772311875, "uuid": "2c31ac20-e0ad-4331-85a0-65b3a321c762", "value": "ready.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091b5ca2-147e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772266697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772266697, "uuid": "841f2991-1a91-458f-acbc-b47a59c2fbe6", "comment": "Malware payload (Mirai)", "value": "922b8adcd4a2c530c5208173c2e6c0cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772266697, "uuid": "52618aca-fd45-480e-8ea3-728cfcf3f13c", "comment": "Malware payload (Mirai)", "value": "6cd891f2430fd1043671b25cf0c26355b46e7c60d1a529eacff724d413821aa7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772266697, "uuid": "b9e9c1ed-b99c-4a4e-9bcf-df8a7c922134", "comment": "Malware payload (Mirai)", "value": "ee54383a07db00881797fb0a827d42595d47b4b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772266697, "uuid": "6ccd8a38-133b-42f8-8e92-9ed098704840", "comment": "Malware payload (Mirai)", "value": "a082e33b5be58ba5ac77fb9fc39cec2c56ff19757fecb7b155209948778200d7538023ecc87577ec9632433273f79b34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772266697, "uuid": "9d758b3d-6cc4-4558-b036-1035377fb818", "value": "T138F34CC7F801DEBDF80AE73A48170905B530B7E251825B372297797BED3B0991963E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772266697, "uuid": "b98d13e0-436a-489e-98c9-14c2e7450543", "value": "3072:l3ooPfxR/EV7ayJcj0/UN++WvMXp4T5VxjbiXLxrA1X5R:l3ooPAmyJK0/UN3Wu4TiLoX5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772266697, "uuid": "44e15704-71ec-44c4-89c8-0e1c5b6f07fd", "value": 163904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772266697, "uuid": "f30b2a09-cc1e-45a6-83f2-ce03799691e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772266697, "uuid": "80bba60f-b3cb-4a15-9911-cfb67f31d4d8", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84120369-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772289237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289237, "uuid": "31a30f40-08fb-421d-b305-0753299ff6cc", "comment": "Malware payload (Mirai)", "value": "e734952743532df2915ff7718075e5a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289237, "uuid": "b5042b09-3ae2-4bcf-97f9-894d0a5300e5", "comment": "Malware payload (Mirai)", "value": "6e47162196d5df15717ec7ded37e9482ffa91eca0a4be1a0b79df3b0e38ccded", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289237, "uuid": "047312df-501b-41cd-b3cb-c7609cbd97d4", "comment": "Malware payload (Mirai)", "value": "65e686b35aeb6e0c4a4bf2d72dd50bfcab3463c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289237, "uuid": "1d0ccc55-d83a-4a2b-818e-3ba9dd82cfcb", "comment": "Malware payload (Mirai)", "value": "018bb3fb3545b49f8ea2ae11393a88bbb61d5c08e0f98afb678e41569679676733a6145d929e5e8c313c20808b82a4f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289237, "uuid": "2b0adacd-7aa0-45b0-a106-3c7d1f460fb4", "value": "T17C13E2ADAB0285A6DC06A0B947E40F3D52F10B3319D3E89B26D1FAC37DDB55066937C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289237, "uuid": "f5f843b0-60a7-4ed0-9d07-d8524f3b4071", "value": "768:Y8nm56gKNcTJJ+jrJowxbNQ3pOJ5zcEKXRjlW9pv758na7ebZAGFYJgGlzDpbuRb:1m53KNcTJJ+JowhCYRcLRjl8v75XC+x2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289237, "uuid": "f1dc684d-c02a-4032-a363-635f30dc5f80", "value": 43172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289237, "uuid": "ffaf43c8-6d37-4122-b315-c084292b08dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289237, "uuid": "1c9c5f86-9196-450a-a1e0-5d33af7d1387", "value": "nwfaiehg4ewijfgriehgirehaughrarg.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7959a12-14ac-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772286827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772286827, "uuid": "15206e5b-9feb-430c-bbb4-677983f40afc", "comment": "Malware payload (Mirai)", "value": "c5d82654fdc0869d329f86dc52c70dda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772286827, "uuid": "e3b8fdf1-403f-452c-96d8-bdcdd4d332f7", "comment": "Malware payload (Mirai)", "value": "705e6e5da93bf7e0b85c816bc931df01a4cd1c5353ae4252ccda4934d6f0ecca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772286827, "uuid": "e86a49f9-4480-4caf-a29d-858434f9696c", "comment": "Malware payload (Mirai)", "value": "df37a6e767ddf382fbfc98fae0b205193d5f7d1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772286827, "uuid": "7f4ae234-476c-48b3-8000-f11b7f835b8c", "comment": "Malware payload (Mirai)", "value": "da0ffac1273da179de5488424b064cd3869125451d270b488a52eb481bb1c498336aa5bf93ab29db24cad109d5630d29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772286827, "uuid": "4fc6e854-e974-4cf5-9371-f65b1349ec51", "value": "T1B0E33A17B5C194FDC4DAC1744FAEF53BAD36B19D1238B16B2BC8AA221E4DE305E1DA04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772286827, "uuid": "937a58fe-80c1-43f6-9645-f529a9fd09c9", "value": "3072:8qyoG7VMD+5T27M/euhAC0EFGGXGxgUFCu2g5FY03lpF:8qyoG7VMD+5T27M/pD44iPpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772286827, "uuid": "2e0356bb-44e9-4c48-85cd-e22c24fe6a1b", "value": 152424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772286827, "uuid": "d465696d-8205-4f66-b9ca-177530804661", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772286827, "uuid": "fc9852c4-f204-4848-9bc0-cdf323b54469", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "490a9b98-148b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772272388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772272388, "uuid": "39522415-a890-4b5e-90cb-d755f23e6283", "comment": "Malware payload", "value": "e6b3e70f91c1412423da94ee67dcd2f9", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772272388, "uuid": "82443f44-398c-4579-960a-6079667344a4", "comment": "Malware payload", "value": "70f3f1092e5df170c6522ea35ed1c1caa0b44b5914c332e04f4136f5d9d0513b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772272388, "uuid": "980cef4b-dcbd-46dd-8612-5a6d2acddbc3", "comment": "Malware payload", "value": "e9e7f6726c4a4ff258fbe1d9b77671fe9a18db82", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772272388, "uuid": "ad5d7146-4338-499d-93a5-78cbc8a891db", "comment": "Malware payload", "value": "9a0affd92a45bbd14ab007f830b5b73b7d8241d01b2f5952c1fd1f9913639ab3c159068d5db8ec5f85434745de3b4b89", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772272388, "uuid": "b03b2c48-f93a-4521-9e29-2054e0dd25d1", "value": "T111D40107A0D28456C036E27C499094B2641DAD5DCAE48FEFA863BF1F75FB346CD1A12D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772272388, "uuid": "b208bce1-5827-4861-942e-13c6b87282fc", "value": "12288:TEReoRXEZU1NYeCge59lEReoRXEZU1NYeCge59Zz6yjaJrB2TVbWA8y:wRkZKYeC559KRkZKYeC559Z/jzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772272388, "uuid": "41902dea-7bd9-48ab-bb6b-01ce42862712", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772272388, "uuid": "01baaeec-2a17-4edb-aa52-93144d57cb3d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772272388, "uuid": "1bc84a8b-9474-47b5-9ac6-924128b36417", "value": "e6b3e70f91c1412423da94ee67dcd2f9.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ae4fcf-148f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772274369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274369, "uuid": "bd7e37a3-eb37-4f95-970e-a249e5a19637", "comment": "Malware payload (Formbook)", "value": "dad59cd4847cca8e9626bf3362b78b82", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274369, "uuid": "00d36926-5520-41d7-a17d-06e1d0438031", "comment": "Malware payload (Formbook)", "value": "71043a4c0e0ce7ea11b1f1de15594cd3ddb7048a34134022c1101e7653d5a2f6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274369, "uuid": "8d2ff245-f431-44a2-a2c1-537e80fba086", "comment": "Malware payload (Formbook)", "value": "4bdab14bdf784f478137e8536557d5ddb8f3f3ff", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274369, "uuid": "4dce0d68-d383-4b9e-8691-0d7cb7091a46", "comment": "Malware payload (Formbook)", "value": "933fcdaaa0c27ac739a8f9a1418724937b3a7fec51aa6fc074a84a2ddf585c329c24005a6fe3256c6150a02e463ea498", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274369, "uuid": "36e6c9a9-5b2d-4299-b4e5-474841dab96d", "value": "T186A22F3EC985DFF00B6A31A2A56F7A1665180367B9382A4C7CCBC19D3B35650CBB11ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274369, "uuid": "683185c8-0b5d-4d3d-901d-78f05f2c9e2d", "value": "384:KR6285sLOKJKgH+u94tkcnoyVFPyeFhq8TWhgV7oXdo0YKL2N6glQpoJfyEfyytZ:Ko2BKgfED9PMbvKUpQYJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772274369, "uuid": "ca349b6e-019a-4799-a77c-13b81c4a12ab", "value": 21639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772274369, "uuid": "fab42c80-f9a6-4248-a6e8-fab3a1b0f8c9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274369, "uuid": "28b903d1-0833-46c3-98f3-2ce2ee45a69d", "value": "dad59cd4847cca8e9626bf3362b78b82.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff76cf2-14bf-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772294706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772294706, "uuid": "ae14a8d3-e662-4746-9343-d6c50a5daaf1", "comment": "Malware payload (NetSupport)", "value": "6b80c8998e3ab193824a2dd4a4443447", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772294706, "uuid": "dfbdc469-a879-4631-9aa9-9e3c4925110c", "comment": "Malware payload (NetSupport)", "value": "712c7e845543e6ddd07f724b6f9a9a0e2c84fdf6d8956fdd2bef94775b2ef707", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772294706, "uuid": "e2376fce-f981-4f66-ae91-7561ab0e9c1d", "comment": "Malware payload (NetSupport)", "value": "afb35f8801f0e210a6293f914be10187029a4758", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772294706, "uuid": "8573c653-0202-441b-9a01-5f4d782e490a", "comment": "Malware payload (NetSupport)", "value": "8a92be323c27ff8aee4ca94bb679a35db5cc9e0e98695d701f849f2bf44ec6dab8638ea5b5c518e5a0a4375e44236ffc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772294706, "uuid": "396c264d-7dc2-44e5-b729-d8c58879c1ed", "value": "T13BD633A0A6E811FBF9EED33DC8619992C59635762B49C193D3F8C5A12C733C46A7E700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772294706, "uuid": "5aa278fc-c8af-46c6-87f4-e645ef3ca05f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772294706, "uuid": "baa800e4-6f2e-4143-9080-fe2abfc268c3", "value": "196608:P14oWUoB9qLZBFslHl7dZgnRMWF3y99TisLkuornJ/urH/P/XRLSq2KKeF:P14FSsFl7dCR1C99/LkuM/uDX8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772294706, "uuid": "6c34fc52-302a-4ef8-aa3e-ecccc9fa9451", "value": 13423887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772294706, "uuid": "f4007fdd-18b8-4442-b006-57661b816082", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772294706, "uuid": "bfabd934-541e-40a2-b633-d684d346bce9", "value": "us.gov.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5d6f16-14b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772290733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290733, "uuid": "5053747d-99c2-41c9-b48a-ad89adae483e", "comment": "Malware payload (Mirai)", "value": "6fe109d56bb566f223d0997a73d883ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290733, "uuid": "c44c92cf-9917-4802-822f-72e85dc001e7", "comment": "Malware payload (Mirai)", "value": "727997f581a1c79d259860069ef702c041715141f32e7d60f7837d742d2b9cfd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290733, "uuid": "9319d151-9067-483d-8427-3c1da4c2ceb9", "comment": "Malware payload (Mirai)", "value": "0a791fc6ac67d6ae7a65612ebcf85190476038c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290733, "uuid": "6b63c2ff-30d0-45a9-bbfb-c88bffeb8354", "comment": "Malware payload (Mirai)", "value": "ae92f0448b179dc3bcc9e5da1a5a9b923220e5d12787456a8a74ac62aae6b203dc4689e78d254ddd9259b27edd5389aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290733, "uuid": "bb26a506-e353-42a7-8b33-b90afc369abc", "value": "T141134B42322C0947D5A25EB0293F57E193FFE99120F4B5883A0F9B9A8675E331582FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290733, "uuid": "c0511d42-6b33-4b1d-9fd2-afdb3baabb1c", "value": "768:YpfjnI1S0uunR/RlDKE7fDNXZgx4x14JFOOssXR5SL:UnI1S9o5u9jJF7vXTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772290733, "uuid": "0153cf89-2bc1-40d5-8544-7e75519e3261", "value": 44812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772290733, "uuid": "3ec00a4a-f481-46cb-8856-7980396bbd34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290733, "uuid": "e504a59d-7b93-4065-8696-8a20ae51e971", "value": "hoho.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5940e7eb-148f-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772274133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274133, "uuid": "0e8d3235-baaf-4823-b97c-ea02e29309d4", "comment": "Malware payload (XWorm)", "value": "7a9b581e885c9c09f4905f0f9c19e1a8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274133, "uuid": "58457d31-932c-48ee-9cd1-9984a61e29f4", "comment": "Malware payload (XWorm)", "value": "749446d354bc53570b382a523903b197408e391db3dc1692b53c069fc3040ad3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274133, "uuid": "d2bd6280-acd4-4af8-927d-fc55bf304665", "comment": "Malware payload (XWorm)", "value": "45b518d923d1303dfafdc7594ad9ed8fe5d8cca1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274133, "uuid": "d2c69005-1655-47bd-8b26-b7c0ff7de36d", "comment": "Malware payload (XWorm)", "value": "850dcadcf17825a3115b2874d6a30a31163ac4210205b1213941885c5e048fff97ee5240e82ba47c4db527b0a2bd9970", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274133, "uuid": "08a68281-0a9a-4b9a-b4d3-c5944b0d1d80", "value": "T1243552D860D263E049B02B6E3BDFD568FBEBAD54309211AEB1C364CF5D64AD8D8104B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274133, "uuid": "aa02aa0e-eb8e-421a-a2d9-00f296424453", "value": "96:vlLQ5QzPWMAfF3ejeVr3nayllgBVrvdyvbDzVaI1XMUO5XXBPsEdjHS/k1HR7TCg:9LQMHtCYxcOi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772274133, "uuid": "6b96dbad-5d87-4cd9-b43c-1fdb983ccc99", "value": 1111618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772274133, "uuid": "72f9f6a8-37d6-46e4-96da-52d35b08741f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274133, "uuid": "716cc072-6bc8-4d80-9ddf-0441f5d5af64", "value": "7a9b581e885c9c09f4905f0f9c19e1a8.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86682e8e-14b0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772288382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772288382, "uuid": "b7913302-2275-43ae-b7d4-9af9f03af46d", "comment": "Malware payload (Mirai)", "value": "865b7883270dc5b996888c5ca5f2299f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772288382, "uuid": "952de6c4-2c8e-47dc-8561-8f400d91c05b", "comment": "Malware payload (Mirai)", "value": "75ca070cc4c618006c8252e7e4cbcedad56400a0688bab3ba7ae2a8c79b9c0aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772288382, "uuid": "104872c3-d01f-4af5-b7aa-381207c46055", "comment": "Malware payload (Mirai)", "value": "04958fe1e0bd815d9618d90da453239b0f809ab7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772288382, "uuid": "586c0233-d23e-4753-b4d7-146b8f9795b1", "comment": "Malware payload (Mirai)", "value": "7265080dfac7becf714ad084ee23d5f2e36d99c82f0c28eea055afd095057f33d4d68f76fb661d8cbfe95cbd3bf4ff25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772288382, "uuid": "0e700313-390f-41c5-9f1f-1a9d4f2959a1", "value": "T1A0F34CC7F801DEBDF80AE73A48170905B530B7E251825B372297797BED3B0991963E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772288382, "uuid": "92f851e2-1875-462d-a46f-a09c257a4126", "value": "3072:l3ooP1xR/EV7ayJcj0/UN++WvMXp4T5VxjbiXLxrA1X5R:l3ooP6myJK0/UN3Wu4TiLoX5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772288382, "uuid": "55bf152b-dfb0-4c54-9f37-f32cedec0506", "value": 163904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772288382, "uuid": "8e74e6fd-2982-46ea-99bd-3408ea21522f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772288382, "uuid": "5fa1ec95-d136-47ca-a79a-248736aed8de", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2debab-14d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772303263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303263, "uuid": "ef939485-97f4-428b-a754-c30538e7f6e7", "comment": "Malware payload (Mirai)", "value": "481a42832dfe5aeab7075f492f945ea5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303263, "uuid": "544094eb-ff8d-40ce-9106-9b508e31ad3d", "comment": "Malware payload (Mirai)", "value": "7613e59aedf718abda262f76e5aa877ccf983a4a1b1308df13d40188664a06e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303263, "uuid": "6ec9039e-519a-4066-baa4-63a931a5fc13", "comment": "Malware payload (Mirai)", "value": "3bf76300661a0cc8f700d308f9f4670e47708ab6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303263, "uuid": "5c6e2a44-d4fc-4485-b388-d057f759bad7", "comment": "Malware payload (Mirai)", "value": "2ae502fdf3b4180625e9f3277c9710485facab283713aa39012828b3853478752147c44d92de9e6bae4836f21787d089", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303263, "uuid": "41fadf96-2fcb-47af-9eec-ca69d46fab61", "value": "T10A333A35B6752A1BC8D8987D22F74328B2F4168E28F8CB1F7D720E4EBF6085025176B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303263, "uuid": "d6c6c289-1485-49ef-9baa-12bffa5a309f", "value": "768:vj72UF999I26p/d1DNwm+BK4HpX2KlNhdtBBY/hju/QJwO+351TSOj:v3pF1IDp/nNwDBK4HpmKlzB+/IQJa3e8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772303263, "uuid": "3ca8f5f9-8bdc-4c06-917f-252aa56a4532", "value": 50256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772303263, "uuid": "51682465-c6f2-4ccb-8fe1-f303d7708301", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303263, "uuid": "7b59b959-4f8e-4ed6-a694-590e0e69213e", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764f663d-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772289214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289214, "uuid": "7b33d27f-1dc0-47f1-85e6-93a8d92bae89", "comment": "Malware payload (SalatStealer)", "value": "eac2c86ba7c3827f5a9b88b6ca2bc9cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289214, "uuid": "177f642e-c7c2-4810-86f6-62a9b02935df", "comment": "Malware payload (SalatStealer)", "value": "76490865e8e6d845ddf00422452e28c5c661a784560bb3b78aad63285404f3e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289214, "uuid": "64e8bf2a-b7d2-4559-aab8-708e3b658cf4", "comment": "Malware payload (SalatStealer)", "value": "b2dc254f7cebc5166f949e5cb741942a3b0d4f01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289214, "uuid": "53ea9884-d514-44ce-959b-a0a3e6ad6338", "comment": "Malware payload (SalatStealer)", "value": "aa410ffb92ef7adaf5f6bd26de5d5123354465968b59bd8ce4998547ab38ca78be65379f1b92a76e0c337898fde242ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289214, "uuid": "c37a80d5-8560-41c8-a7c0-54e134139226", "value": "T128C65B41FA8B94F5E9031835816BB23F63315D049B28DBDBFB543F6AFC7B6811926209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289214, "uuid": "9e58e3ad-9fa5-4c30-bc77-275094529bb2", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289214, "uuid": "a9c00027-6fcf-4a96-bfeb-0e88979d36bf", "value": "49152:ZzT98G+ufJJo4ahz/M308awD+q3rfoPyFFY6/EuUsTxNQaTMHgxEnEFP3Rg+h5NR:Jp8G+t4nv7UsgaTp+O39tCjQJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289214, "uuid": "401abb02-2089-4697-803d-d967aadf71af", "value": 11674112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289214, "uuid": "4d8fa3b2-fa97-4d05-b986-9380386c7275", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289214, "uuid": "abe6e14c-3eca-4559-b8a4-f83c6bd258a6", "value": "retracfixwin111.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8833c143-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772289244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289244, "uuid": "4e2e9672-a55a-4aa6-b17f-ff2b91adf678", "comment": "Malware payload (Mirai)", "value": "c8f7b3c5f4dd4a965a1994996a18b6e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289244, "uuid": "ef451555-f924-4f44-85df-81ce084bdc1f", "comment": "Malware payload (Mirai)", "value": "769dbb9461f3b119bf700bb5b44edc475975bbe078a4b911ac36496bc8bd8af4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289244, "uuid": "9d7a4367-b768-4166-bfb1-754f5098a1b9", "comment": "Malware payload (Mirai)", "value": "8edf2d3525e292ba7fb495c6baccc3ec3b8f7882", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289244, "uuid": "8ab6a9e5-4bc3-4fcd-adbb-60ed3cd3a723", "comment": "Malware payload (Mirai)", "value": "fe071f2f5ee4a87c1c23933a3f725f123488a378e2fafe0c506df3ca8c72988e136e5e3a46e53cdff17d6632154f8187", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289244, "uuid": "74c260e5-87a3-4a27-8f65-049dd7ff3ebc", "value": "T13F936D22FA79193BC4D4A87762F34721F2F6438B20A8961E7D720D8DBF6465022977F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289244, "uuid": "b7c39cd8-90dc-4e86-98e4-754c225cc3ad", "value": "1536:1sCnTLVM3AVKeaALrc3XpEe17OySt1Z6q5ENqQ7Z5tH3wH:VqtAeMXZ66EcRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289244, "uuid": "917223be-cdeb-49fc-a58c-2cde945b33ca", "value": 95056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289244, "uuid": "5545005b-c848-48af-9b90-2b6b76adcaf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289244, "uuid": "9e70671a-ac84-439c-a117-7214ce97fa07", "value": "nwfaiehg4ewijfgriehgirehaughrarg.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509d52d6-14ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772292587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772292587, "uuid": "e1896e69-cd12-4ef7-b188-1cde9379b628", "comment": "Malware payload (Mirai)", "value": "daae2c5b4fd882e167ff62449ec87b6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772292587, "uuid": "f60796a1-6796-4a6f-845c-a58fac43cf6c", "comment": "Malware payload (Mirai)", "value": "76b05b1a1afd7de61c4b9be7c02c3f6515e4aba0f59269416a670e06fc9d709e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772292587, "uuid": "18f69958-eb76-4701-8e17-5d00fef24b50", "comment": "Malware payload (Mirai)", "value": "21bf77e7c83e40b8bb47306a5bab21d6f685768e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772292587, "uuid": "65758e1d-8c13-485a-b27e-9c45d94b0aa1", "comment": "Malware payload (Mirai)", "value": "8e2d1450b8059a8a100bc359cff50d7c5702300ab66149952da15d023bea59067060a7fe0676b38a4fd8b194cf3a6687", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772292587, "uuid": "348f036b-41e6-4c89-9375-5f8d0b68607f", "value": "T14CC37B33D82A6F68D159E030B0718F792F53A59282875FBF59A6C2758083D8DF905BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772292587, "uuid": "6e7a33dd-a182-4268-a29e-a819d3e90876", "value": "1536:ywxGXM/nvXvjuZ+Zj8wvoxloxtC+7Ks0AEbcpoYIMrTGjZzDkhJvDV4WjHQRr3/2:ywxtfvXDZjjhxtb+s2khJp4WLQR7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772292587, "uuid": "bf48e877-b25f-4a41-8182-6e630910ac25", "value": 129888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772292587, "uuid": "c366997d-64f0-4d57-8727-7f9a41ec8abd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772292587, "uuid": "575ece1f-890a-4586-acec-a4b7fedf4b91", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df7b06ea-147d-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772266627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772266627, "uuid": "d4dd6b89-1c3f-4d57-a800-451991836f4e", "comment": "Malware payload (XWorm)", "value": "d0115a3a2774600920ee3b12a485e48e", "object_relation": "md5", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772266627, "uuid": "efe48fcd-f620-4c76-8798-b325344fbde3", "comment": "Malware payload (XWorm)", "value": "7706af0288e1f625d7f60916d15a0786503ad8b00db1de03590401336cb2786d", "object_relation": "sha256", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772266627, "uuid": "05c4cd9a-a295-41e5-a8d6-2d6c9918e106", "comment": "Malware payload (XWorm)", "value": "8e4155cdc4086cb632b7c85a88a477a741f959b0", "object_relation": "sha1", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772266627, "uuid": "54255509-da4b-4ace-b9e7-007158c64955", "comment": "Malware payload (XWorm)", "value": "a2fe1983b5a2788e0bbce233a1ecb6133633aabaf58f58583673e16661d37baa7391f70747df47ea081016cd7f2e6f97", "object_relation": "sha3-384", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772266627, "uuid": "f1a26242-eacc-4ac4-acc3-1cba172a246e", "value": "T16C35527AB7C16D76C390C35AE4CCB14BDD516095B282A9D69E48EECF8800D4DABB0D73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772266627, "uuid": "63ef4b59-3ffb-444e-bb15-0349e12d7569", "value": "12288:og5R5XgK5xwbRQtvgUDu1yKgmA+YySiLFSYwgDAMYTkWFMe4FIs:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772266627, "uuid": "b8c3c632-f30f-41ca-8b7e-a73b0cb56981", "value": 1127261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772266627, "uuid": "dd9dc084-75cc-4461-9b63-077674aa76b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772266627, "uuid": "a254f925-7e5d-4f70-be55-f586f743f980", "value": "comprovativo de pagamento.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42085c69-149f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772280966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772280966, "uuid": "fb3ae60b-70de-4c10-8ea6-4f44a56c1937", "comment": "Malware payload", "value": "44263e63336066fe4cfeeeb332699836", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772280966, "uuid": "738da476-e96e-47ff-a55e-5619bed5c191", "comment": "Malware payload", "value": "7799e18df43b76250b3fe291689640db097983a6275918c35cc62f2206e4ba69", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772280966, "uuid": "dede1af4-990c-43b9-810e-828651d97a79", "comment": "Malware payload", "value": "0458b4f9778884b74756d05978d6b77c346d979c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772280966, "uuid": "7c083d29-0176-42b6-946c-048df72871ab", "comment": "Malware payload", "value": "af6660226e50c7a089529cc2c7781887bde259946f5b054e62bf484e12f378e817509ec853517b2a09a7c0cc94c6aedb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772280966, "uuid": "b44937d2-df8d-41d2-910d-d6921c86b387", "value": "T1F5B16D20736BF9E208507982823D165ECA8490BD111B7427FF49E645BBC8FE0F48D2EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772280966, "uuid": "882ca821-c267-4c22-9a5c-cf54a93e0a3a", "value": "96:EAaKmw2psP4iqnIkJ6BMXx1yy3TEqyvbFhgkL37eisrp3xHPaK30zf/3v:EAbiIMXx4y34THTL37eim3wK30zf/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772280966, "uuid": "c63a347d-7ac6-49e0-8f62-f6ee29084ae9", "value": 5174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772280966, "uuid": "96d45461-b118-47df-84fb-dcb0ae50145d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772280966, "uuid": "13c4ea1c-99b9-4ca1-a082-823de11ec392", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2d5210-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772289196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289196, "uuid": "50731043-5971-445f-8455-725520a4fb59", "comment": "Malware payload", "value": "ca4d08096b353fbcde8469bce9763dec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289196, "uuid": "53d3c522-196d-423b-a7b5-f403475c308b", "comment": "Malware payload", "value": "77df2f420ef026d030837fb120a268b1b2fdf8b5f5274423b20eaf923bcf30d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289196, "uuid": "f69d447b-c341-4333-aa31-ddfc19c1b68d", "comment": "Malware payload", "value": "1bb57b93b05594a2b53f17009307242a0fbd9532", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289196, "uuid": "c3bd3fd5-9d3f-450f-81b7-89ce153c04da", "comment": "Malware payload", "value": "ebb395bca5bb92677e2ecb63374a29211dc7c971daee664abe4ac0b966b329ca0c50d7516b338a5ef33c47a115d340a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289196, "uuid": "036bc0e2-3a44-44d1-ac44-e935cf8f45ec", "value": "T109D3DF0F716350B8C060E2703BA7C836AB71F4A61525FF7D62A1EB395D74A405FA8E2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289196, "uuid": "1cb35a7c-c78c-43b1-b166-c241bbf70263", "value": "d0211f71ed6994a21532e888c12d1098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289196, "uuid": "f40af968-a5fa-4869-9ce0-f7a05f05a774", "value": "3072:gnfCFSw4tYanhKJK6Z8gnvcRJ8gODCHkpXSR/bhNlCcr:gnaowtNJKWnvgFmCF1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289196, "uuid": "d80f830b-dc85-43be-b287-01ccc71a85ba", "value": 133168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289196, "uuid": "01462f2f-7d7a-4ff8-b72c-dd7b951a5cf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289196, "uuid": "d00f6f20-ef42-49f5-b6c9-839a38310bff", "value": "77df2f420ef026d030837fb120a268b1b2fdf8b5f5274423b20eaf923bcf30d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34358942-1440-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772240141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772240141, "uuid": "ed2048fc-7cc0-4025-9fa1-85bf2bd2c7bb", "comment": "Malware payload", "value": "5281e8ff22ff094b2360dbc9fea512c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772240141, "uuid": "b24a3551-4279-4747-9eaf-20b8acf4cd70", "comment": "Malware payload", "value": "784a7853fa1e98eec299924bce808fd865e72e4d191445ad70b5a4275acd361e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772240141, "uuid": "60760b26-3ebb-481e-8be6-6fd3dd360f96", "comment": "Malware payload", "value": "d35941cf5752e51a1cde0913668863d442b22e0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772240141, "uuid": "5ef7b985-c338-47ed-9f21-83b4e23b20c2", "comment": "Malware payload", "value": "b5fcc0ff59a5a00d292615dd4616d53be248eca4852bf8aba47fac0554758c44c21adef1f8aae82b4368da158db4b90b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772240141, "uuid": "fc764670-7464-49e3-adf3-1ae14a13d562", "value": "T113864981FEC751F2EA07493145A7B26F27306E054B25DBE7EB487B6AF8337911836209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772240141, "uuid": "9add8f5b-c2f9-455c-bd11-b087f58b35dc", "value": "8bb9cb7df4e43dd981f69dfe2a1c8a6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772240141, "uuid": "d0b8fdf5-46af-4206-bcc6-f0ac0e4a6a0a", "value": "98304:4KqYDaU4R0DM0S+Lj5BVcrL8ezWEAiDpMmwQ:4YaK7E8ezTAilMmwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772240141, "uuid": "73b4388f-03fb-4911-8aee-e5c94185eb39", "value": 8388776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772240141, "uuid": "33c4076b-b4e0-4dec-95e4-1f94247f0782", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772240141, "uuid": "e2c558fd-6ac8-4711-b426-bf304da68cbc", "value": "SecuriteInfo.com.Win32.Evo-gen.41174848", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21053f59-1450-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772246980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772246980, "uuid": "6c8e64bd-fb81-4b33-9fcf-ef91410ab94b", "comment": "Malware payload (Mirai)", "value": "49f0fb031a85b39a5051d75d93218058", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772246980, "uuid": "bbed858f-c9e6-4d93-af96-fa1714624dd7", "comment": "Malware payload (Mirai)", "value": "78811df1a6d1a67d62025d1449586189c32b5d83109d6040e9a0b38fe0e8c679", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772246980, "uuid": "70e4f234-6161-43f0-a8d5-0a0ae506a736", "comment": "Malware payload (Mirai)", "value": "e2db826f4d616aef84a809fef3f79706b7e8e176", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772246980, "uuid": "d9a80372-cb01-4152-9c68-5f6c2517d18c", "comment": "Malware payload (Mirai)", "value": "261ac4e8af337b383f2e7dfbf1485cf57a8811aaa75b198d65e22dd4d92b0c609e55b6cb9867b02e9ef3afaa49149ec8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772246980, "uuid": "bd9821cc-5186-426e-ae62-f34bbf711f18", "value": "T126343B45EA418A13C4D117BAF5AF418A3332A795D3DF730699286FB43B877AF0D63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772246980, "uuid": "c31a58aa-5536-4696-b8aa-f719a3f6cc13", "value": "6144:YIoX0lMTL8+yabqqcVRF9YnJVDMRf9ihM/95AU:Y74kg+yabqqcVv+JaSG/DJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772246980, "uuid": "78112274-00a0-4464-83ce-093adb16bc6f", "value": 230952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772246980, "uuid": "1c98ab1c-95cb-4ad9-a892-1f53adbcefdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772246980, "uuid": "03517ba8-a7d1-471a-87d6-cd63b5d3549a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d35590-1445-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772242262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242262, "uuid": "2204d512-6be8-4810-8270-149ebb499c4a", "comment": "Malware payload (SalatStealer)", "value": "7da11ef730c3ef9272fdef97705bbfd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242262, "uuid": "5974d895-51ea-4c99-9c65-c007e15467dc", "comment": "Malware payload (SalatStealer)", "value": "7ac8761735f178ef01091392e9d1d11648d45bb7a51b14b1c3d8601e65285967", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242262, "uuid": "3cde6468-3fe4-44b6-9f0b-36db11145686", "comment": "Malware payload (SalatStealer)", "value": "4d16db9cfc3e0b97a988aea647823aab2501ec91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242262, "uuid": "81c77c45-febb-46ab-9f71-ba722938943f", "comment": "Malware payload (SalatStealer)", "value": "8c5e67cb5fea7040ebfa04eb62709b1e0ed20fd0b328fd07bde8fe83aa1a174419fb3807708fbff8bec85fad059ebb70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242262, "uuid": "4fe19e61-4b44-4a55-a714-f254d188fb81", "value": "T190C64A51FA8B54F5E9031831506BB23F63315E048B28DBDBFB587F6AFC7B681192A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242262, "uuid": "f99685de-687c-4974-a92c-e282d33bcdae", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242262, "uuid": "b548247f-e74b-4c2b-ad2c-994b539312f7", "value": "49152:TAVQ22qpimoi1QUZmTT4UfnSYDfueI+yxZMJrex9m+oCNI+5f6Ue5MESGkXqk4vr:cS22qZ1QW8am+G+5B03kCQnp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772242262, "uuid": "d0d107be-4f7e-47d4-b0d6-181451b35e77", "value": 11671040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772242262, "uuid": "c876aadb-1bfe-4f2d-91e3-6d2c3da1788d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242262, "uuid": "c8f4a6fc-6736-4b69-ac54-fa8b3fcfc268", "value": "7ac8761735f178ef01091392e9d1d11648d45bb7a51b14b1c3d8601e65285967.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0abe7f16-14e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772312656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312656, "uuid": "7a1d521a-4f43-4553-80ea-eed4cba85b45", "comment": "Malware payload", "value": "bea8ace2a09eb08c1b1e5532e3520fd5", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312656, "uuid": "26205eda-1aa6-46d3-9bbf-90fd633ecbcb", "comment": "Malware payload", "value": "7cab00718926dfb7bba73fda26297f927aa29d9d1dbf9637d75450cffe65e685", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312656, "uuid": "c31dfd76-e1e6-4f0b-a308-2500cc68aa7c", "comment": "Malware payload", "value": "2817ceefd646d8d7dd43161c5320b2c9f073dbe5", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312656, "uuid": "002c450b-4b4c-4cf5-a02c-6acfe04dfd8a", "comment": "Malware payload", "value": "be3191bd25f91da9b4df432e5aa515777011de0dab02d51310515df17e86e4bea116d65d78f4976d8bf95c72b8a01e05", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312656, "uuid": "3334aa82-69ab-4573-b341-9364efc18c3a", "value": "T159F062F570380C93BBB60C78B2592CFE24E0D42C0E88CC80241D0579DFEE8A8FD09A22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312656, "uuid": "b0810a9b-6372-4931-be92-e03dad8a2e7f", "value": "12:WHXsvklF39DZEXOO3Ot6QWVtKS+X9EZp/MGFHv3o8YFoLkNaLdLn:WHcvEF3MJDKNNup/t1v3o5WAAJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772312656, "uuid": "5898ae63-b4b9-459c-a922-72d8c8205a3c", "value": 653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772312656, "uuid": "d94eb516-f32f-47d3-bd89-37170d1b0b6d", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312656, "uuid": "990a541f-a21b-4ff5-b4b4-b13185fbb18c", "value": "spread.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee4b6ac-1445-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772242279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242279, "uuid": "a2914bf5-b9a7-42e5-bb62-ba4fcb076dc5", "comment": "Malware payload (SalatStealer)", "value": "aeb547123130dbb601198d5d75735d1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242279, "uuid": "561e44bb-d13c-4961-b47f-061f342e258d", "comment": "Malware payload (SalatStealer)", "value": "7cdecc8af372cb8ea951262826272b1c9708dcecb72c775bd89626a190103e51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242279, "uuid": "787c9a8f-73ec-483d-8787-892bc94b50f5", "comment": "Malware payload (SalatStealer)", "value": "be793e6124b599a7d0053dadd85ba029a2b742a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242279, "uuid": "2a9dfadd-d34b-427a-90c1-b29df193ca4c", "comment": "Malware payload (SalatStealer)", "value": "12d8375ae452e1af799d481b0a6c617c0782ee99e03bf2545ebc88347dcf837bf11b648a74941f492c2d21529aa74370", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242279, "uuid": "00c8cce6-4908-4698-a511-46b6a221585e", "value": "T1F4C66C51F98B56F5EA03583141ABA63F23315D008B28DB97EB44BA3BFC3B6811D7B644", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242279, "uuid": "898fbc3b-14c6-491a-a846-e98ddc5f9f97", "value": "49152:GSG10ugtaAyLqdhsV8Dof0I3+CevTD4W5AyHyLCMkmZyNruvQK9nouVUEdaeZGcs:C1pGaNuE8k0oTeuamSPgnzUEQ6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772242279, "uuid": "42a771de-a34c-4df4-afec-4e269c9ac145", "value": 12113408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772242279, "uuid": "81f92c8e-3fa0-40c5-8bc3-c3db55075053", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242279, "uuid": "6fb74b68-ca21-4dec-bb9c-b0f35573c047", "value": "7cdecc8af372cb8ea951262826272b1c9708dcecb72c775bd89626a190103e51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "466bb866-148b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772272383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772272383, "uuid": "5f06ba09-d4ab-4ad9-9147-4abe140bea44", "comment": "Malware payload", "value": "c7a0c3be4baa24ff77ee4fc4db46f64e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772272383, "uuid": "1718651c-1688-408e-a157-9764016d27c0", "comment": "Malware payload", "value": "7df2376b9b9891ef4c5cd7b4d44db6ebd71cb7691123face9888341e897db393", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772272383, "uuid": "4dcb0e15-101d-40be-b2b3-33fa0912b83a", "comment": "Malware payload", "value": "ac05d6d251c8bd166ee961c3cd5ad29152bfe4cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772272383, "uuid": "40f69e18-e3b8-4b71-ac56-2e6c8c414dd4", "comment": "Malware payload", "value": "efc087a15faeba6e8dea7a2aae3c820f6bd72e731e23584ca7f5d1560e539c4a6b09da56c209a26b32503616cab3df3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772272383, "uuid": "a513e11a-8f72-4d3b-9298-188322692e5d", "value": "T16CE41257B7A9B0F8E173467884624912E776B4B24B908FEF4794064A2F633E18D3DF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772272383, "uuid": "1b6588bd-db49-4dc7-b74c-7d77e9df279b", "value": "469e59bd592f93ae01ff61cd0d813e4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772272383, "uuid": "ccb3e22a-ed43-472e-b669-f2816a41acc9", "value": "12288:Ir8VpxdYrK8mIqpLypA3Z2mtP2ytjiaJywTCV5ZBfwl6dyd/Job:28Vd8tqNyp4pP2afyNfwAdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772272383, "uuid": "9adbffe9-ef35-4fd9-a761-a8a16ba57c3e", "value": 688382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772272383, "uuid": "5549a2bb-40d2-4b45-aed4-3c933fcf0396", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772272383, "uuid": "21bb5e78-d0c0-4185-ac05-60cdf1e94c3d", "value": "c7a0c3be4baa24ff77ee4fc4db46f64e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "095add8a-14ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772322103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772322103, "uuid": "50216891-c7fc-452c-af15-1331ff0e0aa7", "comment": "Malware payload", "value": "6a3d3a018891d394b69ccb08bed2f114", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772322103, "uuid": "56aadd74-2f0f-4e72-860a-4c3f8c84fb9a", "comment": "Malware payload", "value": "7f1917b261182a2eefe53083a4cd39b696cdc319928e00afbe36b4320fb20189", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772322103, "uuid": "2cea6b89-faa2-404c-a390-1f1fb2b4eea9", "comment": "Malware payload", "value": "555ea573280699a8cf8738f4dd7e774cd9befc2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772322103, "uuid": "9838502a-e477-4a52-ab61-d4f3f07c9fcd", "comment": "Malware payload", "value": "43f38d179c2c717c46296f76e0dc0245f53c2377cd6822b07f2964c2b1f6eee70c52ba8ac2d6327320eb1cb6e4a2197d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772322103, "uuid": "7719fede-4edc-42c5-9422-1fcb374005be", "value": "T1D6F7594262EA05C4F9F7DA358AE65217D673BC166F3081CF325C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772322103, "uuid": "55c62a15-50df-4af9-b64c-13d989877569", "value": "772ec87d3452991a9933a3ba0d9963a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772322103, "uuid": "ebc12737-3585-4475-a75f-1f92b9987399", "value": "393216:4n1XQgPR2k3m5C507G9ITEc5eAlkLbQurxMWhAsIyNOPS0B4AycWsCYaxFzwW/tL:41XR7AsxYqt2oRGj5rs3wb8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772322103, "uuid": "6cfc7526-2398-4566-a265-e82214297508", "value": 71421440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772322103, "uuid": "d9ca5c15-9df2-4ab6-9d03-9dd6f7ba501d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772322103, "uuid": "050158ea-0852-4703-bb50-a443858a272c", "value": "Latest_Software_V4.0.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d446298-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772289145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289145, "uuid": "dbda4ed5-5951-4067-8826-bedf3313925b", "comment": "Malware payload (SalatStealer)", "value": "4faa8fcba980d2fb0211ae39e2653820", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289145, "uuid": "571aa392-4f88-49e2-b1f4-b4d57c02af56", "comment": "Malware payload (SalatStealer)", "value": "8062505536c79ac6f40fe04a3723ea6238598546e241a702492a2c354e16ec92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289145, "uuid": "ee1a3858-dae7-4d60-9fa1-31f585143ee0", "comment": "Malware payload (SalatStealer)", "value": "3771b8faaf225bd75d36bb7c48fc98639462ee5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289145, "uuid": "e97ad093-db18-421a-81c6-2ad9e8a1a3f7", "comment": "Malware payload (SalatStealer)", "value": "22195fe2e318d382be9b822b30e4006de88b27cadffb0edf88f96b68d4147e84ae99c121b987054e645d01e59b80abf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289145, "uuid": "67c9525d-0f74-47c3-841f-02dd2c689e57", "value": "T123E53308D13614A0D54B257BA2C9133699A3C3E6754D4E3E91D9AB0079E0E787B3CFEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289145, "uuid": "529fe2c6-a507-4e3f-af34-00395909762e", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289145, "uuid": "1fa42262-9189-46e4-b61f-1eb6c3a9eadd", "value": "49152:49ywRMhN9Z7NjFlLvR3ZVZsZKEs7y6oscPd9shMz4QaIXjWhlkRGDbhOMDlKW4Ju:4zRMr9p7l7R58hhPEY3WVhyW4J9UQRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289145, "uuid": "33d49eec-1429-4b6e-be93-6cfa680c5c5b", "value": 3297792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289145, "uuid": "540a7cb5-dffb-4911-a289-f03aaf43a60c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289145, "uuid": "c8339853-1101-4fd3-a64b-a8a164ab6c34", "value": "retracfixwin111.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b6a46fa-14e9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772312765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312765, "uuid": "5c813240-d184-49c0-93b9-80fb093425f4", "comment": "Malware payload (Mirai)", "value": "a8fb1b49303d6d882d2cc617a086a638", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312765, "uuid": "4c4ce993-1b5b-419b-b335-e8e6f37e8cdc", "comment": "Malware payload (Mirai)", "value": "817fb161a8199e1cc57206461aca31154b2a69890ea7cef73ed7410c95671a87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312765, "uuid": "1e3d9fbe-d6e7-4f80-90e8-cbedbd0301cf", "comment": "Malware payload (Mirai)", "value": "98d60e383f895038b20ab2d3a388e57e3d80c1ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312765, "uuid": "09c8ff02-d381-455e-af76-366aecba2d39", "comment": "Malware payload (Mirai)", "value": "51fa3cc8ddb57515cbce4027d918399fabf254993e120a5390106627a3eb366f6420785a032c06a90ae6c989bc51bb37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312765, "uuid": "c29834a7-dbc7-485b-a990-5e7c4704500e", "value": "T145467D16B5A314BEC19AC430835FC6136D35F89596327D3B3A849B342EF6E245B2EF21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312765, "uuid": "3284034e-14ff-483c-9fb5-9dfaa9d641f3", "value": "98304:TQ1uONRt7yuJyatIYkh+1Gbb42dbtIKjyM2AVDZolL66VAQP+hKQ:cTk1dbtkA4p66VAS+cQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772312765, "uuid": "adf0d93d-4b1b-4076-93b8-a7da049eca72", "value": 5513616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772312765, "uuid": "99f5d8bd-307e-44a3-8c4f-6b6fd54fec01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312765, "uuid": "49aeac0c-e4ce-468d-93a9-a79cb0736a15", "value": "download", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f20d923a-148f-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772274389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274389, "uuid": "98411e34-ba66-4a38-9cb8-dec28a4e3346", "comment": "Malware payload (PhantomStealer)", "value": "324196f184ff8460eff2c84d2ab1be35", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274389, "uuid": "41143831-9a38-4e14-b311-ebc4d9eedfad", "comment": "Malware payload (PhantomStealer)", "value": "821c139e7e316ac4e667ed9219575c87f5c78cca73aedc99810660953b50a4de", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274389, "uuid": "e5461185-4da6-47e8-966d-039b2012b9a0", "comment": "Malware payload (PhantomStealer)", "value": "be5155109e9d4f8959cf9f4d1b1514b3637d45d3", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274389, "uuid": "13e1502d-6cc1-4a95-bdfc-f08ef8e19e4b", "comment": "Malware payload (PhantomStealer)", "value": "4369967e35b97c87a54dbe03bf041be866a373f6ac40478b3bed7c9f7a33c065b86fdfc4285752218dbd29da08b12c53", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274389, "uuid": "654462de-006b-40d4-9f1b-a8945eb19342", "value": "T1A026AF244731BFC69D84253A65FF292F2B60F8CED705B706FAA9EF1C93225082147B65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274389, "uuid": "3deeda6d-0ab2-4ab2-8342-0d2ecdec4b68", "value": "49152:umsVumt2qPNX1xDy5piBQKR86rfarTW/9W7pPokCMSFtiZJJwbaP:v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772274389, "uuid": "982bff35-2e65-48be-ac44-2932b10f2c98", "value": 4648497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772274389, "uuid": "8a05ceed-a821-4e90-b9b6-1b389c6356b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274389, "uuid": "4b22edb3-833e-4efc-9a06-0738b7a6b67f", "value": "324196f184ff8460eff2c84d2ab1be35.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4aef026-148d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772273535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772273535, "uuid": "7e57b84a-2330-46ec-8b67-cf26d8873a9d", "comment": "Malware payload", "value": "e3c28c425dffe254b7cd8f37d8df9142", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772273535, "uuid": "420b68a3-89b5-4fea-a6a2-413797914bd0", "comment": "Malware payload", "value": "82ee9622989c0a02f9337ff4709b207392293fd3408d04af900b1e9e60904c3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772273535, "uuid": "71c3f1e3-feec-4d1d-b2e8-530abe03a28a", "comment": "Malware payload", "value": "235a08e875bee8664286168b481a5f2469ebfce4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772273535, "uuid": "93694e88-c863-4798-9e47-a99e6efe9890", "comment": "Malware payload", "value": "46b81fdfce72ed7125942e5e4c6e9d1e6c78be3ee88b78e460426ae93a27d36c120b02986327580052c3ed11c4bf153d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772273535, "uuid": "f530118d-69de-480a-93cd-3845d9ff2317", "value": "T199D53316FBCB52F8E8F419B59496710B4329E229431048DAD3AC29A34E338E7E5FD2D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772273535, "uuid": "7b4d3ce1-cbef-4205-9324-0ef7805375dd", "value": "771106f54fcc51d1aa3989e528332f80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772273535, "uuid": "4293b5bb-fb94-4c8b-b854-d2112029d10b", "value": "49152:pvkTt8rwvc8OgL3g8jiZzglKT0GIieR1XEfSiu+HmPGieSjZhHuu/5mVMAuC2NcO:Fv8OgDIZwWU9riu+GPGtAhl/54MAt2NV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772273535, "uuid": "209513b0-fda2-40cb-a6e3-aaf5d4a0046e", "value": 2759168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772273535, "uuid": "bca31620-4cd6-4ead-b376-63e0fcc435c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772273535, "uuid": "1aa26108-2e5d-48d0-b1cc-cb72185eb40c", "value": "run.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7809d739-14a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772282775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772282775, "uuid": "176abdc8-894c-446c-ac4b-5bb2abe9bcea", "comment": "Malware payload", "value": "53538c8630ab550a0323fe5fe433e0d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772282775, "uuid": "795b4d65-56a1-47ff-9763-535e4370c0a4", "comment": "Malware payload", "value": "82faf341fc8e9e5b1de64c33f19cc6b384457b72f2823bc017ed1c622848ed3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772282775, "uuid": "11f17736-25b5-40a3-9693-fcca5e7bd9b0", "comment": "Malware payload", "value": "6637cec1e1aa83b9e7258e13ac3e3aae0cf0695c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772282775, "uuid": "8f3552c3-1308-4dbf-b821-275f22c9dcca", "comment": "Malware payload", "value": "adbc6c4f2da673b7c4d729b77f556e33814bf9fb29cc9d2269f22f9c6dc3225e1675b66a9284d405765691fb972c92c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772282775, "uuid": "f09681b1-e199-4757-914f-e4bd22bbad57", "value": "T191F7594262EA05C4F9F7DA358AE65217D673BC166F3081CF325C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772282775, "uuid": "4dcacf20-bb50-47d9-b532-61d7b32eb2d6", "value": "772ec87d3452991a9933a3ba0d9963a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772282775, "uuid": "c30f0f66-4902-4ae5-b349-6f8c26c1bb28", "value": "393216:jn1XQgPR2k3m5C507G9ITEc5eAlkLbQurxMWhAsIyNOPS0B4AycWsCYaxFzwW/tL:j1XR7AsxYqt2oRGj5rs3wb8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772282775, "uuid": "793fee75-8c59-4447-8b8d-18e9acd3964c", "value": 71442432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772282775, "uuid": "4ce65dd4-e3da-446a-83d6-1bdbd765d7eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772282775, "uuid": "654e2e55-2740-482e-a096-a70ed739ff80", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd81f1d-1444-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772242194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242194, "uuid": "d65b72b9-d967-4614-8dbd-d0aa853ed9e5", "comment": "Malware payload (SalatStealer)", "value": "2c913362f56b1d40d748968dee3960f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242194, "uuid": "868c5fc5-7793-4a16-ac74-df6d6c722e3d", "comment": "Malware payload (SalatStealer)", "value": "833f7f2895fcb905e1781b32f35917e188989c86b51dc79b8a72f997eeeb6a6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242194, "uuid": "b143144f-4c87-413c-930e-e0a7f6993637", "comment": "Malware payload (SalatStealer)", "value": "3eab871889c806250c9f93bbfcbc8eca07fecfda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242194, "uuid": "30ada688-b947-46c9-b3ee-a6ecbf0d1b3c", "comment": "Malware payload (SalatStealer)", "value": "174a0df72aed26d302df8f0937979dbc6cce7979d9293ab4936c2529743c3fad1e1ecf419b1f78d933d0e7a8400c5900", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242194, "uuid": "841dfdcd-8a20-4909-9f3e-459eb18064af", "value": "T11BC65B41FA8B54F6F9035D31405FB23F23319D448B38DB97EB547A2AFC7B682196A209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242194, "uuid": "e30f88d0-e397-4171-9b37-515369ab9bb3", "value": "49152:4Gd36DGITXWx1tlyOcgtMP+CNR4gd6r5ceApa/nNsPKXwMSypJFWF+qFKE/jbD6m:zp6DGl1BPOpaiPKAEWFRQWbwhiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772242194, "uuid": "df093b18-5f60-4dd8-acaf-908e17b91cc1", "value": 12107264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772242194, "uuid": "37d618e0-740c-4bba-ad82-f1da169c5280", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242194, "uuid": "f6a21a29-5400-4913-9588-56df1235f710", "value": "2c913362f56b1d40d748968dee3960f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9ddd91-14b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772290728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290728, "uuid": "31cd2da2-4706-448c-9dbd-63c0090c9532", "comment": "Malware payload (Mirai)", "value": "0a4db9ff124427ef0ca06ede1b10b251", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290728, "uuid": "1d57aafa-81a0-4b1a-8b8c-3ce9d7a6f078", "comment": "Malware payload (Mirai)", "value": "83efa77298c4aec892dee8c14549e5684d20c7b0e3094d262db799c7dcc80ceb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290728, "uuid": "fe6d2bc4-2b0e-4499-a249-c66f9bd1f751", "comment": "Malware payload (Mirai)", "value": "bee44879809dfefe5988b1d88892f366cc1473fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290728, "uuid": "747ac6d0-3676-46ef-8b52-f3619273a093", "comment": "Malware payload (Mirai)", "value": "01a736bd5c89e6a5dd2e15a85aa9457c4739af6c5fddc453f68544af848704ef9568f878b337b414c5ae3c76624eb009", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290728, "uuid": "ffc1b9c1-537b-48d4-9e4b-5af0f7437c91", "value": "T1B5135DC1A203D9F5ED1542B42877FB335B3AF0B62029F997D794E632AD42A0196033AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290728, "uuid": "a18bd54f-a817-4517-9d6f-06ff1e5cbc30", "value": "768:k9aSFOBgm186NVHBYKdOWe2qDe78PJsLLWkSmCa99GkAkOdwVOVp+G:kzigm186NVHBY0OWe2IDS6kzDkkfOdwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772290728, "uuid": "4bae8379-b999-4b35-bb8e-5211e27b1e0a", "value": 42108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772290728, "uuid": "70f698c8-5172-4fbc-8417-24b20a21ba2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290728, "uuid": "119677e5-0810-48a6-9df5-906088512279", "value": "hoho.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba98a694-1445-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772242514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242514, "uuid": "8020d7f6-2462-48e8-974e-17931425a611", "comment": "Malware payload (Mirai)", "value": "d1d60977ba78180ad07f844768a1d947", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242514, "uuid": "ed392ceb-32c0-4ee0-81d1-8262fa23c9c1", "comment": "Malware payload (Mirai)", "value": "841204db03b755ba28c3c7e2b0c7e68f3e8e66a4139ffbb46520aa5c0cd213bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242514, "uuid": "affff05e-4a2b-47d5-9b32-dc31ed48de51", "comment": "Malware payload (Mirai)", "value": "7a70470b135a27c85ce4213e2647dcc718e0230a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242514, "uuid": "fdfe2725-2146-4f63-9b2c-419819db0a9c", "comment": "Malware payload (Mirai)", "value": "3c6bb4c9e57c62bcb26c7faa93a18c933351c5f9a1a7a3cc4b251b1e813a4a5cea94eaf4ce3c5bbfbfbb223dbd2b375e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242514, "uuid": "334e48e7-f495-4ced-af00-8ff3fcc2ca67", "value": "T1A3C39E32D8396DC4C1945434F8B1EE711FA1A6C441A25EBB1AE5C97900C7DA8FA0EFF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242514, "uuid": "4705628b-1a03-45be-a5ed-d0f22bbe40dd", "value": "1536:6aZwsA5XjVZJK0twtfXd/GW25UhMMJNu5xWKLYUIaXwDrucKygHIwS8w+NrFXwwA:6f5Z5Z98XdmVMJaGaX3DymS8TXAwEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772242514, "uuid": "df9e8b47-8e7d-437e-ae06-b5c9c88e3f9c", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772242514, "uuid": "8c719930-bbbf-4454-9dd8-b2f2881f385a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242514, "uuid": "797a1edc-cbab-41e6-a508-1cd55252ce67", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d9ec4e-1446-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1772242794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242794, "uuid": "e31b9f3f-c884-422a-997a-462d73f1b59a", "comment": "Malware payload (ScarfaceStealer)", "value": "36f0e989e51ecf3c1c1136854214be2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242794, "uuid": "beb86e7c-ce04-4d2c-981c-11da911ec7fd", "comment": "Malware payload (ScarfaceStealer)", "value": "84f77ade3d79ef5872557dd8d9c1c720b58d1d924785ab34f9fee896ea06a995", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242794, "uuid": "a88b6782-b5d0-4cb0-b111-e20a2ca05dad", "comment": "Malware payload (ScarfaceStealer)", "value": "1f96a25d45732eaea7cb7d4b89d480b0cd67ba51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242794, "uuid": "93e56b2b-3ca8-4246-bffd-72ce126fb172", "comment": "Malware payload (ScarfaceStealer)", "value": "384f9bf1891afb7d1b8ab1d78517b982b57a93cf748feccfeb429013158aed4c36e924dc0e751f32859da0f2f9074657", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242794, "uuid": "8f1da4ac-19fc-4ee6-b49d-41eb08907ce5", "value": "T13DC622ED46D953B890D20640718B83AE75C1761E42FE5C2A3DC72C41272ADBF518EEBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242794, "uuid": "d5679d7b-a340-4db0-b4ee-fd404b6b7165", "value": "8739de86cd836ae1476705562c069cc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242794, "uuid": "55fc97f4-86df-4dd6-bb89-ba66c5794e80", "value": "196608:oCEjeqMQYIDp1Rq1jkQLhtHWWVGxh5ZYt9tMIbLByKgm7h/fYtw10P:7EV4eQLh5NVAut78Kf/wtw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772242794, "uuid": "b299f9fb-9208-4118-a376-fe8afd4ec496", "value": 12567552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772242794, "uuid": "90630eed-287c-4ca7-ae4d-fd8e63ff930a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242794, "uuid": "eaf13546-cb9c-4539-81ee-8594f842d678", "value": "RLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f88cbc9-14d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772303269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303269, "uuid": "3e201acf-78f6-409c-9948-167edef1223e", "comment": "Malware payload (Mirai)", "value": "4f686c9ce5be3f9bfd5cf40bb892c4a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303269, "uuid": "86f66a84-d7f0-4f40-aa12-681a2e6b18dc", "comment": "Malware payload (Mirai)", "value": "866d8cddd8d042426e7f9779ccf880cb1da36201adecb85d8ff674fa300cee89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303269, "uuid": "ca938669-7761-4cbb-8345-39284f4ad0f4", "comment": "Malware payload (Mirai)", "value": "80159604b2757dafe9fcddf08dfea2a6eef68f02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303269, "uuid": "5e416a7f-6252-4363-b034-9a7fad319f59", "comment": "Malware payload (Mirai)", "value": "7ede455f567aff017097cdf68954d610655e056a6045d4c6281b01669d27e55ebc51f9b0c2ea1ddf0e328aca64fbac7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303269, "uuid": "4560b3f3-eaf9-4848-9ece-c2168acfe56c", "value": "T182131742B3180547D1631EB0353F47E1E7ABAE8122E4F288760F9B4DC171E77A946E9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303269, "uuid": "40ff0963-1ca3-46f6-8901-0247b0777f45", "value": "768:TuZQBal6xzFogyxBvDMLccDP1UqI9XFPTMGy6/janpyvsM73V+Otauo:T0UFogW5DML3DyqWPwGy3nYx73V+uaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772303269, "uuid": "1f580efc-523c-4c61-b97a-d73157f37beb", "value": 44168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772303269, "uuid": "e8620368-5529-4bdf-9674-cfeb6dc4bb6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303269, "uuid": "c082dded-8ac6-4807-b317-bf1e381f653c", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e21cc8-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772289247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289247, "uuid": "890638e0-d220-478b-b9ac-b7c3c21e96f9", "comment": "Malware payload (Mirai)", "value": "bdc5c0fbb08f065d415d2bb29727dcc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289247, "uuid": "327a62e4-63b8-4742-9e14-b7292fa44cd0", "comment": "Malware payload (Mirai)", "value": "8789c35824204284924a4f523938dc18e93a3b07967e6319e718c0ac95ade8fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289247, "uuid": "fbb4c0f4-ac09-49ed-a28d-8d6177c278f6", "comment": "Malware payload (Mirai)", "value": "da73b2ab105fbac1abe3ef4858baaf8b0203c928", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289247, "uuid": "5dd0a7cf-ec62-4547-87de-ace284c67b93", "comment": "Malware payload (Mirai)", "value": "29345390e1396791931c73927ae88d025039834bd0c3e3619054e2e3b9126f3e9066c97a5d0346c0b6226d0ef38571e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289247, "uuid": "497cf82e-26fe-47e8-9757-c5da5bf78d88", "value": "T191B2D03146554167CF30093EB978C1A9F7BA4668D1FA700B5B285F3027CAB8865FA7C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289247, "uuid": "e004d94a-7c05-4633-b822-ae4e781fb203", "value": "384:4t1x9PjhbaH/ooUXlsXi1TT//1ScBSrqUFLCmUo1HQECj5AcMoV6yuAbsUhymdGz:APyuVsy1tSBhmUYA3ol7s3Uozp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289247, "uuid": "5bbca4b1-daac-429a-bc75-7d9ed9b53b00", "value": 24020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289247, "uuid": "94bb1d8c-1016-4812-8883-637d874b6ecd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289247, "uuid": "5a96023c-795c-4f61-950e-521b1ec5374b", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6980bfd-147e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772267096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267096, "uuid": "ad3965df-fe03-4791-b573-939d70786b5c", "comment": "Malware payload", "value": "7d2cffbdf887c2f5391350b9fedf485f", "object_relation": "md5", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267096, "uuid": "800f9109-9f7e-4b69-bd47-942643b56377", "comment": "Malware payload", "value": "883847a0bee215ba5dc75427d07270f2576b1444358e47c3090d0b2294f50340", "object_relation": "sha256", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267096, "uuid": "94c7fb52-66ac-47b2-a471-b03c36c4ed7f", "comment": "Malware payload", "value": "d0e8155fc55e81697724b58542a697e133447dc0", "object_relation": "sha1", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267096, "uuid": "87babbe3-af56-4bfe-8635-1d76419bd8bc", "comment": "Malware payload", "value": "362bc5b26937eaadbb7daf754c0a243e387ab6789dcaabc2d3795ebb0d78ab66c3ad26cab504415be54bf3a2f87c989b", "object_relation": "sha3-384", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772267096, "uuid": "701e6943-abd5-4f36-83cd-454a41615b85", "value": "T1F0311123BBE0439E48D6968989E434FD6E372B0587800DFED965F8E881984EC6E86951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772267096, "uuid": "1b17c29e-0151-40e4-9917-52841544a3c1", "value": "48:2E2Fm/DYdVeiVDFw1sVK7IKFb/WJMWQdlHwyJ8:7t0n9h2iK8KFb/WzKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772267096, "uuid": "fd1a4d47-041c-4b30-aba6-7d123b0022e8", "value": 1600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772267096, "uuid": "33230831-72cf-4664-af96-88805714f622", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772267096, "uuid": "0e0a2a7e-05b5-42f4-99ad-395c5c447773", "value": "ps2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab68ad7-14e8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772312253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312253, "uuid": "ec3e8372-36a0-45be-bc3d-ce2c0b49c319", "comment": "Malware payload (Mirai)", "value": "95c8ae2f9cf8589a33d515d26714cfdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312253, "uuid": "e35eec14-2547-431a-9a3f-e8a63811da70", "comment": "Malware payload (Mirai)", "value": "889cb1962ddd9c46795ed0cd9b909d46ae9d4e0016ba2c5f389b42700da30e80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312253, "uuid": "29436e03-ecab-4c72-83cd-4bddc089b102", "comment": "Malware payload (Mirai)", "value": "242b71366677fde704680362f8a8c86de6a8eec7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312253, "uuid": "62096d3f-a8db-46e3-9320-ed7ddbb06553", "comment": "Malware payload (Mirai)", "value": "6cf212577059df3b7ef08844c047d25ac63f4e7844075a348d458691c21aad06aabe133199d284b3c6ed4f3d3a3bed3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312253, "uuid": "dd5f45de-37ca-42d7-abd2-a45e488f188f", "value": "T1A4736A01B3584A43D4671DFD3C3F17E583BFEE8122F4A188690EDB4A5270E73595AEA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312253, "uuid": "d7bbbb42-2eff-40a0-b0e1-ccdf1f31d55e", "value": "1536:3diHPjT72LcVrFXNXEWW8N8nIBZMYesgB:yP3yQV5R7QnInMHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772312253, "uuid": "3fd6ab6e-5dad-443c-9c6f-3a0cf0c106ec", "value": 79300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772312253, "uuid": "d1f3d419-bf5b-4782-a25b-ed3a24e8345f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312253, "uuid": "66e3fea9-0c23-4b30-889d-de1327a4ff0c", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed4e97b8-14c5-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772297574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772297574, "uuid": "42078595-8262-48fc-b079-7bd25a95a816", "comment": "Malware payload (Gafgyt)", "value": "e291ecb0855c5ed97a9bee016ae7d480", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772297574, "uuid": "edfe09bd-3cfa-4169-b27a-ba34f2a7ab0d", "comment": "Malware payload (Gafgyt)", "value": "89d5d443cacdb0ee2ca35fc46362eb7194481eed12a69567861e1053744135f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772297574, "uuid": "dac452e2-0b87-49b4-880f-d8c7e234ff68", "comment": "Malware payload (Gafgyt)", "value": "7855e63a69ddca08f4339c0bdefd61d7af10b3af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772297574, "uuid": "ca2096b4-1c26-4685-bcf3-043f008abbf5", "comment": "Malware payload (Gafgyt)", "value": "3a54e2bf99e82f192ad8f055e5b25b7ee6554b955fbb1dfcb7927609ec4c560a0d1d8f9585e7d9cf13b3700ebc9d308f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772297574, "uuid": "9e84261e-90fe-4335-8570-9b5cefe168cd", "value": "T1C5C3F146F88240B7F483917A444F938BBB31FF26510DDE63D744BB69AD332E618265AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772297574, "uuid": "8b677c43-febb-43ab-a75c-70bc2f31db7a", "value": "3072:qa3z5a9yc6DM41dVDTefX1d5LBLHucdraI1XY3zuxwcF2jTRh3SEoIse6:qqm10XdB6/LuoraI1XdmjrWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772297574, "uuid": "9168df32-ec05-4a3e-b5c2-a54c4793eda6", "value": 127076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772297574, "uuid": "d5787774-583c-4a43-a115-2399c0ebce97", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772297574, "uuid": "c4818820-83db-4cac-9fc4-c4a3f1d8ca89", "value": "8cb7qpuydx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ce64aa-14e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772312195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312195, "uuid": "acba3399-d8c0-464a-ba86-3d6dddae3cec", "comment": "Malware payload (Mirai)", "value": "52730ef14985795ea7938a01b531bd32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312195, "uuid": "9ef0bbd7-3d77-4244-b26d-ceb893c58566", "comment": "Malware payload (Mirai)", "value": "8a885ecd8db3814979bb5d496440a2f597b345c2ed83ac95d318b3d46d851bd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312195, "uuid": "a7d35f7f-cf64-4862-a620-0d1437e61621", "comment": "Malware payload (Mirai)", "value": "3018d6af2817b5ea4ed839da707b776385dc5d00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312195, "uuid": "8ca8b75a-d9d0-4bf8-a1b0-f2f9fc8e94b9", "comment": "Malware payload (Mirai)", "value": "9620f856463b1df9e492cab0b3ac4eb1b449f904350504eb5017a753e8e9f2331fd9bdee41766f9f2e6b13d4b328e331", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312195, "uuid": "dab7cc1a-474e-4a42-a29f-ad77bcdc4eb3", "value": "T1B2933A56BC819F01D9C5167AFA2E108E331317ACE3EEB2139D249F2467CB92B0E7B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312195, "uuid": "1ddc47f6-f118-449d-94d8-0dd5451ecbce", "value": "1536:t24nTDHQEcMOrPADE/HLQyxB+0dVOH+N6/40HaER3mcHI+iwQMjpiWRbp5dYQSS:tDcMYPKcr/TXVBs/bHacQMtiWRbpP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772312195, "uuid": "d5eafe19-c096-4ee8-9fbe-0fcb843f0a9b", "value": 91492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772312195, "uuid": "b99ce1f4-a96b-4097-aa58-c7ab3a9b5404", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312195, "uuid": "bdfd726b-fe0e-4697-935a-28636feb850d", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f0363b5-1445-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772242414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242414, "uuid": "b207fb49-d1bf-474f-a1fc-70fa133900c6", "comment": "Malware payload (SalatStealer)", "value": "5c92ad63d3684da5c2d5246d928c73ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242414, "uuid": "12c4ecfa-2923-45a2-a3b1-7c33aa4683bf", "comment": "Malware payload (SalatStealer)", "value": "8b54c2b9fe94f65c599e194a3af10c3a50dcb3bddce9842fec18ad9eaafd9de1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242414, "uuid": "6a2be6ac-b5ec-425f-801b-c1e9ccecfb40", "comment": "Malware payload (SalatStealer)", "value": "fb65338e8f2dc15f333dbea91f47b948af877e4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242414, "uuid": "4ea62172-f725-4c58-b36e-4b1a9b9e13e5", "comment": "Malware payload (SalatStealer)", "value": "ad975c23b4f7e4502476c3b7e3201262c84ffae56b471e1b06749062928561367a081d8e7a34aae3e52273ccb446da0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242414, "uuid": "f3d0c936-b81d-494c-b8ee-1ccd295304fc", "value": "T181C63B51F98BA4F6E9031831405BA23F27315E048B38DB9BFB547B2EF87B791196B205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242414, "uuid": "28acfe6e-f6e5-4207-99a5-554d26f78657", "value": "49152:MFlvc5ei0xSf+RHzzg4UI3xvG3dbkSDc1hoymXvooNi4XLeAFhLQjGnYtN5CC8AG:Ihc5e6+PHwXvq4X5XNnqoy1tE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772242414, "uuid": "7476b7ed-6318-4675-9337-4f3e91d624f3", "value": 12255744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772242414, "uuid": "a134c1c6-3253-40fa-9942-9e83d439c169", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242414, "uuid": "0db30f57-dea6-4766-9826-6908df3a1c5b", "value": "8b54c2b9fe94f65c599e194a3af10c3a50dcb3bddce9842fec18ad9eaafd9de1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "322aba3e-14d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772303273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303273, "uuid": "2c17a24e-bd26-4896-8cb9-6bb4843e3e0e", "comment": "Malware payload", "value": "2ffa916b30b0079ffa98b409ed096f08", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303273, "uuid": "bcfaf394-7233-4bc9-bd5b-96398f76bae5", "comment": "Malware payload", "value": "8b9ea0ab6d318a0bf0e90a2d12c9b2a23d3f242f1b081464e4721fbc12b1ec11", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303273, "uuid": "81ebd781-08e0-4793-8bd4-efd0f0e3ab2d", "comment": "Malware payload", "value": "40afd90841f24bdc1cf501b470cda7a97ef9865c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303273, "uuid": "446af92c-6ddc-452c-a230-de9d67c2d7b3", "comment": "Malware payload", "value": "a619e222a13cdec6ea963cf265a581bc21c18215d879d6df8c27ad47c380dd5dc2a1c535164a5cccef711e081775fa10", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303273, "uuid": "fed6a11f-d867-4095-8d07-e3c7e8015ba0", "value": "T1A55104CA13934371ACA1DE7BB2F50945B5B1A08B74C59D58A8EC38F492CCD4A7DC5AC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303273, "uuid": "fe5c2c05-f4ac-47d7-8de8-590bfecf45dd", "value": "24:IthSFLYnSER2UFAL4n4o1cTfkNfiuL4eTpaOXgGZ4dvo:ihSFL4SEA6A2cTfkfiA4AaGZ4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772303273, "uuid": "3e56a75b-52dc-4b01-8a08-801c220f5307", "value": 2479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772303273, "uuid": "ac96329f-36cb-4ea2-aaec-590f75c8799e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303273, "uuid": "0aabceb8-77d1-435e-9151-8f7e97356f66", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db64cd14-14e7-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1772312147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312147, "uuid": "edf3339b-a032-465b-9ccf-9d2455e999cb", "comment": "Malware payload (ConnectWise)", "value": "234a2643ced70d03ad18756f974ffff2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "www-stattementviewonline-help", "colour": "#C4572B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312147, "uuid": "138500d7-8818-457e-90ec-170c25f344da", "comment": "Malware payload (ConnectWise)", "value": "8c90653cfd88ee763a8fe78700b5dbf96053c90b2e54fff3ebf86ce7076f3daf", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "www-stattementviewonline-help", "colour": "#C4572B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312147, "uuid": "851d08fb-da9f-4c27-a23b-074328c7c8f9", "comment": "Malware payload (ConnectWise)", "value": "1dd4df92bc59ae5258a93896f2d4663684a822c1", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "www-stattementviewonline-help", "colour": "#C4572B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312147, "uuid": "c064d3c1-b38f-4c11-82ae-43e48e3e3ca2", "comment": "Malware payload (ConnectWise)", "value": "7cbd000b1c119e957bcdea13c322f21d1f66481d6ac6454913e25465b0a7e06517f4125f56cb7a8cf76ba91b2bd85802", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "www-stattementviewonline-help", "colour": "#C4572B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312147, "uuid": "0f5742cb-21e8-49d9-abb5-abe2401c9cfc", "value": "T140D623116BF89678F0F22A35E876A0B1A5377C525E22D12E2324791E2C75EC0C9B3777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312147, "uuid": "dc81853c-09ff-4194-983f-3d3fb8663758", "value": "196608:tHxcp9ym3nltDUJVzHxcp9ym32Hxcp9ym3MHxcp9ym3WHxcp9ym34Hxcp9ym36H0:fGplpoGpEGpqGpkGpGGpIGpL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772312147, "uuid": "f84b4bc8-892e-4e4f-a670-b870783cdb01", "value": 13537280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772312147, "uuid": "c29ede9b-9ac8-4b17-acd7-1bb5e0460baa", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312147, "uuid": "fb297efb-45e8-41f2-8d60-3b9965d9500b", "value": "ZoomWorkspace.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27947ecd-14b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772291659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772291659, "uuid": "84c13254-2b59-40eb-ae93-929da1c5168c", "comment": "Malware payload", "value": "d2eb577123b9004b1c631b0a22a1c340", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772291659, "uuid": "bc93f789-ac7d-47c2-abdc-0d93bc7cb1d1", "comment": "Malware payload", "value": "8ca4b9ad2173e71fa75c7d645cfd225b043fb39cd3c02a3b1bb022ade7e64891", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772291659, "uuid": "5050ddeb-a3cb-4a70-919d-a83e8d1bf7af", "comment": "Malware payload", "value": "d6bd34182ccd47fb8b60d9bca033b2e1108f0464", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772291659, "uuid": "7645ce50-caa5-4565-a61c-2932169dad69", "comment": "Malware payload", "value": "c7ff7ce5fc1d8436d281d3eccb2f2a8ff1b3be38554bd89804475491d863180383401c85c27e4a7dcafe9e42d7bd476e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772291659, "uuid": "f2a25a34-d797-4202-b198-a223abe76ee3", "value": "T16E925CB916496C79BBC0DE7D9F3C7F0CADE4C1C02119A39CBA4F39614A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772291659, "uuid": "44c0d36d-ddc6-46b1-9e8e-d3f26c6d60cb", "value": "384:4xUI0M3vgRjGlsaq7czsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:iUqmjfQzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772291659, "uuid": "edc5a5ab-392f-4e5b-8633-b7bd989b5163", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772291659, "uuid": "50ee4894-4528-4fdd-ae21-f978fa30a92a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772291659, "uuid": "59d53700-d8e0-4d3e-900d-ef9798e4f9da", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e4dfca4-1481-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772268155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772268155, "uuid": "bbc76209-3bd5-4bfd-ae25-ac85790ab681", "comment": "Malware payload", "value": "372b1ed440039434c93ffd834df6e8b8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772268155, "uuid": "4c551f40-a2b5-4cbc-97d1-0c3c02465d94", "comment": "Malware payload", "value": "8d0f127c30c996c691ced8663c2c8e6b693b5cfa1df80af84c3cd451e5aab9c6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772268155, "uuid": "7400dc96-5ece-49fd-9186-ccbf53808e13", "comment": "Malware payload", "value": "7d5928189ff33123c2d25b2a3db5a79138186d26", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772268155, "uuid": "3903f449-6803-42f5-a814-bc30b55b0898", "comment": "Malware payload", "value": "410a56e243d9790c67df2ef6a189856b99f93a0ef28383c5bc71c4c97c578b79b819553399a717b52f56c9ce53a98bc2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772268155, "uuid": "4601a86f-d956-4174-b55d-de0d2e038ef8", "value": "T170925DB512896C79FBD1CE399F3C7F4CADE8C2C42124A3ACBA4F39215A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772268155, "uuid": "95872fab-d1b9-47d1-ad8d-47525ce8a532", "value": "384:n9cuQpWx+BL0SWL0gAzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:n98i+BL0SI0zzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772268155, "uuid": "d72370ee-64ed-4379-9ece-707ed8449fac", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772268155, "uuid": "4e184b2f-b8f7-4fdb-90f2-a4c17ac23180", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772268155, "uuid": "2c0e6d9e-c2a5-4d6e-8358-21626d68034b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "342cf52b-14b6-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1772290821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290821, "uuid": "1135a63b-c7c2-464c-9fab-60027f810833", "comment": "Malware payload (DarkTortilla)", "value": "f721f6908552ee2e17d9d8c93d8ac062", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290821, "uuid": "a0d3d18e-98ad-4634-a7b2-6c6404e11b33", "comment": "Malware payload (DarkTortilla)", "value": "8dd8dbcf94b3397802b1ee69a9e91549cf31cbcb56b9471458706b275d6d176a", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290821, "uuid": "6b59633d-dcce-4ff4-9358-b23d987c64fb", "comment": "Malware payload (DarkTortilla)", "value": "988086b1ff25138e90a911eed07b77b9ea3cc592", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290821, "uuid": "abecc321-a309-4a0d-9754-3b483ecd5e94", "comment": "Malware payload (DarkTortilla)", "value": "5d1349e3e86eeb6b34e27240d7403436b93917dadb029e169af3fac5f235342f5b27eba2f216361a2a91e09fb0165855", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290821, "uuid": "95fd3409-4660-485e-85ee-6e7e6e780951", "value": "T12EF42387EADB059FBD3AA4795CBE30E5059C06ED1105DEB1B6C0E00BB7DAE93842C856", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290821, "uuid": "a115a132-0db8-432d-9f21-8de04d98ebce", "value": "12288:Gp8GaQMfaL83vWj779MO0cexkMpQVPebOTUAzv3vcuCgF37t2IOEC7OsmI3TEY0T:G+GQiKQuO0ce7EPeCTUAQuCk37Fl+3T6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772290821, "uuid": "8187d1eb-cfa8-45b1-bdd1-885af3be7a97", "value": 745921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772290821, "uuid": "9d2a5832-2c4d-4288-b782-7b1a14a6f337", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290821, "uuid": "49a37f78-f9a0-47e0-ac9f-ce70bcbb3fc0", "value": "nOrden_de_compr.bz2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745b784f-1482-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772268595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772268595, "uuid": "840e22b3-9d63-447f-9327-b6c07e6bc460", "comment": "Malware payload (AsyncRAT)", "value": "52e3feff2e8716959f19bbac8c18df32", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772268595, "uuid": "2c4cb595-ad50-4106-ae7a-12e8a9b5d051", "comment": "Malware payload (AsyncRAT)", "value": "8f1839bec2935e3159ecffc52e3a3d6738f0236d2cc7fac3afa6a4f8f449d58d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772268595, "uuid": "c02e6b08-3876-4488-bbfd-e7976ce15d85", "comment": "Malware payload (AsyncRAT)", "value": "0b80c2c73007df3dc0444bfd2b59a7d04c1f52ff", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772268595, "uuid": "4e29f9ea-4efe-4679-9c2c-cc0d9c6cc17d", "comment": "Malware payload (AsyncRAT)", "value": "eeb0010493dfc09b718ccdaf074f5ffe367592365b1033d0058cc39ea6e1e0ada08caeb5e4d1154b42d43c7feea0c553", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772268595, "uuid": "118bbe0a-1462-4239-aad8-d28eaae7744c", "value": "T17ED24A08B3D88561E1FD56B94D7293048775EE5B9973DB9E1FC440AE2623B88CF24BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772268595, "uuid": "634287d1-6a29-407c-8cf9-6b48c0ac71a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772268595, "uuid": "a4747d69-8dee-4174-80db-178bd5a584ba", "value": "768:QMARXV643iqBkgg/cIRGqoW/Rb7fB/dTW/+:PARXT3iqBk51ioRbN/o/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772268595, "uuid": "059d78e2-b430-4b88-a2b2-2c7dd80c577b", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772268595, "uuid": "6cf3180b-6bce-4c5a-860f-1861c4ef19c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772268595, "uuid": "85f304b4-9160-4a07-99dc-72cd6551c1e0", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5dbba6-14a8-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1772284872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772284872, "uuid": "af070793-bb01-4224-9a4d-5a71106714d0", "comment": "Malware payload (ConnectWise)", "value": "4f3cff31bc4f2cae0e5802e786500370", "object_relation": "md5", "Tag": [ { "name": "95-216-63-67", "colour": "#FBC290", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772284872, "uuid": "00f5cc8c-d6bc-4bc8-b60b-c20af966107f", "comment": "Malware payload (ConnectWise)", "value": "8f433bf8793a5a00cfdf01ac20c787722c584b5214c45015b3ceee2a542c1125", "object_relation": "sha256", "Tag": [ { "name": "95-216-63-67", "colour": "#FBC290", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772284872, "uuid": "5114296c-0569-4f23-a423-d3f5c8c55ee7", "comment": "Malware payload (ConnectWise)", "value": "444524afd68b1af83a9bb93d01cf9910d1a7b37d", "object_relation": "sha1", "Tag": [ { "name": "95-216-63-67", "colour": "#FBC290", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772284872, "uuid": "c93a7810-ab72-4bf0-bca0-1a4d47db5a38", "comment": "Malware payload (ConnectWise)", "value": "6a20fc8129f14c5a32af31e1acc666fe8d7960555306de2ddfae4fdab69f55ff3e0fef732c4783751304dd1cab7021b5", "object_relation": "sha3-384", "Tag": [ { "name": "95-216-63-67", "colour": "#FBC290", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772284872, "uuid": "d5ddd1c8-8026-4ab7-949c-77a0452e4321", "value": "T1273623317AA0D139E2B4293DC83AA6F1A56ABD21D673452B93747E1D3C70DC04A73736", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772284872, "uuid": "2d73ffb2-0525-4a31-ae91-7d80d547b6b3", "value": "98304:CIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlVIdoaxcp8wy5c3teIl:LHxcp9ym3nltDUJVUHxcp9ym3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772284872, "uuid": "97707cef-e5ba-4dae-92a2-f02871aacb37", "value": 5002785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772284872, "uuid": "3e988bd9-6295-4e04-a22b-310bd041037d", "value": "application/x-ole-storage", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772284872, "uuid": "c6fcc2fd-e5bf-4ed7-8a64-92a163405c87", "value": "8f433bf8793a5a00cfdf01ac20c787722c584b5214c45015b3ceee2a542c1125.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f20d41-14af-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772287791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772287791, "uuid": "418ce24a-faef-491c-9f58-30cf6f3b0b12", "comment": "Malware payload (Mirai)", "value": "d0ca2da7bc47daccc4f5f378788a6e7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772287791, "uuid": "b7c44072-84de-47bd-ab77-1af1560c463e", "comment": "Malware payload (Mirai)", "value": "9093723b95effa744341daa0da44328264bc0088268f20bd0ba85bfc1d792fb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772287791, "uuid": "2eaca2bb-f858-4f64-a914-2df24d08cb5b", "comment": "Malware payload (Mirai)", "value": "2e1afcdbfac128631c91fd869f910adf57c0b861", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772287791, "uuid": "e09ca273-7601-47d7-ba5d-1c04efc56d31", "comment": "Malware payload (Mirai)", "value": "372eaf1aa4615c61be2b3cddb205c5edd714f1b5cbbf0e39e59abe4dbff514eb8b614a1c31c36f485ad8a08285f7add9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772287791, "uuid": "6d9fac36-13d5-413a-8954-daf9cd8204f1", "value": "T19814E81AAB550FFBDCABDD3706E90B0139CC944722A43B3A7674D528F54B50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772287791, "uuid": "254abf44-70ae-4ea9-bfb1-1cdc2a34e5dc", "value": "1536:ZApm3TGAbl4qCHcwM7d0aTswUNt8h7cF8aRzEtZvdue2lU1LgXZAqxjE8XNCIwgR:apm3TRqqlF0Cn25lTXCKNCmhmCYOCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772287791, "uuid": "cfaa3053-ed2e-482f-b21f-49ecb8950c6f", "value": 194464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772287791, "uuid": "8e09da6e-a7d8-42b2-9653-fbf49ecc7bfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772287791, "uuid": "27992b28-18c4-4074-b99d-f153f3f5aa4a", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f57212-14b5-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772290391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290391, "uuid": "012761d9-8fac-4a44-a3cc-398a71a4b2ef", "comment": "Malware payload (AsyncRAT)", "value": "4da5c5736c519c4c787923f0557151a0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290391, "uuid": "1c7247d4-c894-4563-895b-8edf0a42ba48", "comment": "Malware payload (AsyncRAT)", "value": "90fd5c9b21c51814a25bb2eac80a6c5d34967ab2752665a6cbe5bce4c25c0e3b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290391, "uuid": "92137950-2ce2-4782-9e14-dc4ffb92225a", "comment": "Malware payload (AsyncRAT)", "value": "8c5412e192a77caa46aa605d9b4c8f9a23ceec85", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290391, "uuid": "72635928-1bca-4939-9af2-13e165f48742", "comment": "Malware payload (AsyncRAT)", "value": "e1b0d03ed9834625f3d3803aa9dbe98476ca86ba2033225fa1c63eb76a5cbd252c1e2f7e5db92eee4af9fa603874dcf6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290391, "uuid": "72be0e31-9a58-47a6-8d2f-e01adf27e1e1", "value": "T1F3E501DB5E0A46B2D30DF43145B773BD472FA93C2BDB2E5D824B3E9113B606DA940A48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290391, "uuid": "d8dd9df1-7566-4231-ba2e-eca0b8a21aea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290391, "uuid": "c9e4bf82-e07e-4c67-a41d-b12a979640f2", "value": "49152:yhZlxJm9X9VqecNpKraEzT8hE5Tk/oklPT1D0Ck7n46L/4u+k2rPuoM6TrdV:oZnIrV9clkjTkjlZAPJLErRM6TrdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772290391, "uuid": "5d514b95-da99-47d5-bab4-cae87954bbfc", "value": 3054080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772290391, "uuid": "28a4a10c-8600-47f7-b9ce-ba4fdba95e58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290391, "uuid": "c97ed8b1-d937-4f8d-9d44-aff54f323cd2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d08178-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772289138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289138, "uuid": "bc86f966-9a1a-4ca9-9d7a-9955039d94ad", "comment": "Malware payload (SalatStealer)", "value": "072198e1867a49371229151b05be25f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289138, "uuid": "86d717d8-4ff9-4510-adcc-566f675612e5", "comment": "Malware payload (SalatStealer)", "value": "91156536cc0a60de6a94ad4164dbd784522675c97cc4a06909f2e9340c025cde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289138, "uuid": "848b7c5a-c42f-41cc-bc6f-3fc5bea5cddf", "comment": "Malware payload (SalatStealer)", "value": "fbd9512a62c394771867a6345cc42a943b47c82e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289138, "uuid": "49fbdf1f-e711-4a68-8ebf-3151c51cb162", "comment": "Malware payload (SalatStealer)", "value": "8704ed468ec220d9f2e5d1152118ccac78cc18563f68a14969e4d14ef5e5b11dc63726922cd50cbe425bdf3104f670e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289138, "uuid": "f8ce1e37-5d22-4867-920d-0bef1c2d367e", "value": "T1BFC65B41FA8B98F5E9031831406BB23F63315D059B28DBDBFB547F6AFC7B6811966208", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289138, "uuid": "dfad415c-0e9c-4ec1-8034-c8744d54167f", "value": "49152:5zT98G+ufJJo4ahz/M308awD+q3rfoPyFFY6/EuUsTxNQaTMHgxEnEFP3Rg+h5Nz:pp8G+t4nv7UsgaTp+O39tCjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289138, "uuid": "66594135-6298-491a-9c44-9b4e74f607b1", "value": 12115968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289138, "uuid": "a0565596-2f95-4124-aafd-bbc662e5ddae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289138, "uuid": "1afbaf5e-74c4-4b3a-ad07-5bd15a041da2", "value": "91156536cc0a60de6a94ad4164dbd784522675c97cc4a06909f2e9340c025cde.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c2f152-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772289319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289319, "uuid": "604b4a22-bb33-464f-a66f-3ce84608eb41", "comment": "Malware payload (Mirai)", "value": "28cc46ea4ee88c2c516188c25d62598a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289319, "uuid": "e284e408-02e6-4cec-87a1-f5e7fa6fa01c", "comment": "Malware payload (Mirai)", "value": "9137fa92a06a68d03caf3a0a121ea4f141f5e188c8605cd40b77cec1bd5a716c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289319, "uuid": "f5117709-52e8-4ce0-baa5-46da10324db6", "comment": "Malware payload (Mirai)", "value": "667ba10e10932b5c7f129746e7964627f4e56743", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289319, "uuid": "0f5837cd-e7c3-455f-b7f8-3d96e9883469", "comment": "Malware payload (Mirai)", "value": "aa2c120cc03a394d22dbfa25ba4992b1284df52558afa05c0da5b4d934fb19398f665868d32a5bd2bfa9514ba6bc1727", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289319, "uuid": "9dedfd64-defd-41fc-b10a-a4158df5143e", "value": "T18F933B56FD818B21D6C112BAFA1E118E3313177CE2EE72129D146F6077CB96B0E7B942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289319, "uuid": "4f0c7595-96a5-4c09-9baa-3c6a11d4bebf", "value": "1536:QXnQOMYe4eq/wCjG9rM8UWZotOa2HZ8nC8DRix3VGlvb7AB5yY1gR9:fO5lIoG9OSotOa233VGlvbkBgx9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289319, "uuid": "49efb6b2-4fbe-487b-b71d-e3da3517e9e6", "value": 97568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289319, "uuid": "9c8526f5-99e4-4e17-a715-8eed3e6f0d06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289319, "uuid": "811953a5-20c7-4886-bb15-f403d43f77ed", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "440dda92-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772289130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289130, "uuid": "2644ce18-a361-4bcf-9528-0780976ee329", "comment": "Malware payload", "value": "0667dd22c3f66c42ef9a696c7431fc3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289130, "uuid": "c91bfc3b-48d4-416d-a459-21f9b924f8b9", "comment": "Malware payload", "value": "9161b0a0ee0a52cf00142c1c2674f90441452b1039a1fbd45046964415152777", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289130, "uuid": "a8196334-44ec-4de5-8efa-ffbcd60f9523", "comment": "Malware payload", "value": "0ce4f97c7895b5896f09ea66ace155bce3d99e3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289130, "uuid": "6c8199b9-64ee-46bd-9fd1-397050ff49c1", "comment": "Malware payload", "value": "6f1afd4efb152199cb7a4ac4343a26634d534fbd1e5ff488e715eb03e18ee8d3c52b9269dea5cf26dbdf50ed4a0f5c8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289130, "uuid": "780dc6f7-779a-41ff-85ea-090e963523b4", "value": "T1C5E3D04B766320B8C015C3B07AB3C8762B31B4660522FF3D6269EF355D60EA25F69E1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289130, "uuid": "78d5e1f0-4d68-4e1d-a6b3-0c1de6821d0f", "value": "d0211f71ed6994a21532e888c12d1098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289130, "uuid": "3c745715-fcf6-4ddc-9767-0c41b6c35932", "value": "3072:VnfCFSw4tYanhKJ1FtANzGw64v3OmcWFhajxgS5EL3Zc6Sw6Kau2MioH:VnaowtNJ1FtANLvemcWog9zZnx6Kb2tQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289130, "uuid": "afbec2f6-e928-4091-b4fa-efe1b3dc316f", "value": 157232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289130, "uuid": "08a32f68-540d-42eb-a86c-aabb570739e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289130, "uuid": "d35f60ff-89de-4f4e-9afd-93f108f258a9", "value": "libcurl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d90a0735-1445-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772242565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242565, "uuid": "4d988169-bae3-41fe-b61d-db731445b5ea", "comment": "Malware payload (SalatStealer)", "value": "54ada4cdae613011945b6ca2e6a2c586", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242565, "uuid": "c8c1d7b8-7001-4095-a6f7-7f1847309c09", "comment": "Malware payload (SalatStealer)", "value": "9168f1a97b3dfa8f37b62c12cc8d75d6daaef6ffe13e20ca3286b52f41d99794", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242565, "uuid": "0e8e0914-aaec-4fd0-a031-9ca9172d13db", "comment": "Malware payload (SalatStealer)", "value": "583e4491e8a906ddfe89bb42809a7aa660da2eb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242565, "uuid": "e04e553a-7b0c-4fd7-b873-816f82392767", "comment": "Malware payload (SalatStealer)", "value": "cee1ee3fdb79fe117da63d5a075259e29e4b19f780173c4011edd07057f705c40f1fc7418da2e482abf9a93154cb222b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242565, "uuid": "4cb12a4a-7a21-4c11-949d-f578d512e85b", "value": "T103C66C41F98B99F5E9031935409BA23F63355D04CB28CBDBEB147A2BFC7B6921977208", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242565, "uuid": "ce930e86-0dc7-426a-b80f-4cfd1da2971a", "value": "49152:zMaQqiJsRZVOVFAr0VHwQCS8qKQv1UZNI809PLw2pN9Z5R+GAJ4UPxeQckqxd1AP:odqiJ7Vn3hLwaZTeSeckKjTXap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772242565, "uuid": "30747c43-582f-4d56-a32b-dc2661043d69", "value": 12112896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772242565, "uuid": "9ed7a072-61f1-4e3c-a8f3-5d0a316359b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242565, "uuid": "a8adf8ef-112d-4f78-9ec9-dfc7c8b802b0", "value": "9168f1a97b3dfa8f37b62c12cc8d75d6daaef6ffe13e20ca3286b52f41d99794.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0255e885-14b3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772289449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289449, "uuid": "5653ca68-4805-4384-b197-de2bf486b29d", "comment": "Malware payload (Mirai)", "value": "3cc982b1d81740c84555bd2fb38b3957", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289449, "uuid": "552a82d2-1569-41be-93a4-465f34c142f3", "comment": "Malware payload (Mirai)", "value": "94d2a9a9cb7df0f016f5780116b234e6bc794ddb1306e4d2b5aca5367a79e6c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289449, "uuid": "b5560dfa-62f0-4dec-a03e-2842e6cf955b", "comment": "Malware payload (Mirai)", "value": "da95454246aca0a6712eab6a0d43902189079c9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289449, "uuid": "4586f375-9bc4-4382-9042-16d1c0f98464", "comment": "Malware payload (Mirai)", "value": "65526b09c46b45d993acdd7e2177503a243b745c66848cf765f5e297b18539087848a3948f1616ca8f0f677a42dce89f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289449, "uuid": "87bfca49-611b-4bfd-8b8f-a97edcdac2e7", "value": "T142935C02B70C0A47D1675DF02A3F27D1D3EFAEA110E4F684691FBB8591B5E321686EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289449, "uuid": "e4dee970-6b06-42b4-8fd6-438572e7c1e7", "value": "1536:G8ff607T7urvFe2eK63PGSbBOaEt+d3pHgTCZKK86q4mgml/v0fJ:Ta8TV+Ztm5jZs6Vfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289449, "uuid": "e313b113-cb6d-4af0-9558-380abc2236ae", "value": 89544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289449, "uuid": "c489bc24-db79-4b56-b053-4deb773c872d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289449, "uuid": "bf0e4e9b-fe1a-4fa8-859e-259f29a44e78", "value": "nwfaiehg4ewijfgriehgirehaughrarg.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa412e55-1476-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772263666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772263666, "uuid": "7d5a8c49-6002-41d9-bb47-06abf44ee7d0", "comment": "Malware payload (Mirai)", "value": "169b61927ed09df52a924bf7261bf4fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772263666, "uuid": "ba4371ba-a8e8-424b-bcf5-915f4c36abc5", "comment": "Malware payload (Mirai)", "value": "969ac04fd6f1c44ceb8061883f82fe26faeff196a4e882c8d2f1f097c5d13ade", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772263666, "uuid": "12dad8fd-0dc9-4095-8554-5fad70f2cd1b", "comment": "Malware payload (Mirai)", "value": "0c7282fd6644eee4bfdfd4b95871be74ab6fce0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772263666, "uuid": "84922ec9-9c3c-4bd1-8240-c871dcff68a0", "comment": "Malware payload (Mirai)", "value": "29ab2ebb44b525e10f931d6949e78332ec938e5d2d2b659d5cc0046298072820e47b613ce41da89ffff838a2cb81c96b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772263666, "uuid": "c9c083bc-ca80-4bdc-91d6-392a2d0431e1", "value": "T10614E81AAB550FFBDCABDD3706E90B0139CC944722A43B3A7674D528F54B50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772263666, "uuid": "2d7ec29b-b0a0-4843-845e-9b46c6d187fb", "value": "1536:ZApm3TGAbl4qCHcwO7d0aTswUNt8h7cF8aRzEtZvdue2lU1LgXZAqxjE8XNCIwgR:apm3TRqqlr0Cn25lTXCKNCmhmCYOCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772263666, "uuid": "812011a6-d02b-41f3-b319-5848c6da6bca", "value": 194464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772263666, "uuid": "dc541a2a-323a-4f84-bda8-f8390099b4ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772263666, "uuid": "c8b41d07-a7af-4dc7-9307-b3bf1ec9791e", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e1fa3e-1443-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772241482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772241482, "uuid": "f48160c4-5f45-4e42-a9e8-d089d2fd5ece", "comment": "Malware payload", "value": "d6b758e21a32bf7ffae84496708774f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772241482, "uuid": "7f6acb69-1132-4a82-b345-816a4e54ccda", "comment": "Malware payload", "value": "9708c7409d841052b7b6027e62b5ef8ac2b4cf86bb89f62552ee35120af42511", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772241482, "uuid": "685f0186-9ec7-4f28-8159-79f32b1b78df", "comment": "Malware payload", "value": "07d24b5ef2e4e97a8326d15ac99329aa9fa707df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772241482, "uuid": "7aff25ee-1cd4-4b0b-82cb-0ee334e8c61c", "comment": "Malware payload", "value": "53b80a71976cabc8640fedd6d30f43d0de036d75cc7e4e84e316b123c4dd9a8ce70298ba1ea559b83484fb312f918811", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772241482, "uuid": "249323f7-2f55-4c6d-b597-2f9dd5812e73", "value": "T10B863380A2D84EE4E8B3843E8AD50506E772BC611B7CC7CB87A1A2573F373C5897A715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772241482, "uuid": "1b29c4e6-bf74-44c6-90c7-b45fb4110a94", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772241482, "uuid": "5a9c42e1-51e0-488d-b8f9-0cffed519640", "value": "196608:kkY1W903eV4Q+tpDjIIAcwD2iRPMavk9SIL:XOW+eGQ69jo2ioT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772241482, "uuid": "208622b7-2f11-4e75-a246-23599c706bdc", "value": 8127372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772241482, "uuid": "0f2dabab-d122-4e4c-a072-1562584d9157", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772241482, "uuid": "3565e436-d44a-4762-9cd9-a6e06e203420", "value": "SecurityUpdate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e68b7ae-14b3-11f1-a769-42010a9c0008", "comment": "Malware payload (DiscordRAT)", "timestamp": 1772289550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289550, "uuid": "9f49eefa-edab-4fd3-9d24-6177351d5a80", "comment": "Malware payload (DiscordRAT)", "value": "3f78c5fbeecf9f4691d8319ff9aab31d", "object_relation": "md5", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289550, "uuid": "40b18968-cb5e-4b3f-9964-dea4189bcca9", "comment": "Malware payload (DiscordRAT)", "value": "975f4fb4200776d3943ff299d66677e35b1fa90e9ba47e10865699986ddc0a6e", "object_relation": "sha256", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289550, "uuid": "aa997a1f-b2b0-4846-8668-b4d177ec5b09", "comment": "Malware payload (DiscordRAT)", "value": "313b1345a3eddc09122cfab583c91a673febf159", "object_relation": "sha1", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289550, "uuid": "22aa1eaf-7258-43e7-b4af-7bff672f3da0", "comment": "Malware payload (DiscordRAT)", "value": "9d0d6d9e957478f87f975ded0c1f6edc20d3c5db151e3781f45cfa863379532a9423a5cd7563beddbb79499c980f0192", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289550, "uuid": "c88a6a9e-0ba6-4cdc-9afd-85f802c88cb4", "value": "T18273C8C877AD8903FBBF5EBD147141524B72BB17E935F68D088C54E611A2B828C42B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289550, "uuid": "531f3190-732d-4ada-9261-029194416bdf", "value": "1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+pPIC:5Zv5PDwbjNrmAE+ZIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289550, "uuid": "d52b383d-3b75-449d-b998-894956080655", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289550, "uuid": "df010c1c-0add-42bd-977e-6ec4794c9c57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289550, "uuid": "810228b4-6448-4828-bace-fff2f2365015", "value": "alltoolbyvekrixx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22288344-144a-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1772244405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244405, "uuid": "20856120-b15b-446d-8fc5-8f287136ffef", "comment": "Malware payload (DCRat)", "value": "c7e3294065eecac82ccc790a7beffe9a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244405, "uuid": "f6978f58-3245-4c3a-b35e-595848a80b3e", "comment": "Malware payload (DCRat)", "value": "97a3c46027f2f1467a058e92406d75535e2f91832705df5a33ccaac64579624e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244405, "uuid": "929a1141-eee3-4eba-b92e-0647ecf3bd39", "comment": "Malware payload (DCRat)", "value": "e78ffe9c0cb2c326667e47eb68c8a61c6ef02682", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244405, "uuid": "b2157489-6c0d-4cc3-b049-7ed574d9d0a9", "comment": "Malware payload (DCRat)", "value": "68711c3a71bfccd2b56c7fbecdd2e27d873fa590cb2a219591cc3b5c904227d14406110685924ce69ccd81ac45325562", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244405, "uuid": "192bc0b3-2c3d-4a17-96f0-74fbd38ee1d3", "value": "T160134C007FE5C57BF3BE4BB858B2630546B5E9632503EE4D2CC010EA5A17BC99B416EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244405, "uuid": "6249c92c-ff97-405e-af08-d0c8a2ea5fa5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244405, "uuid": "9b879dd4-5afc-4056-818e-e3198e2bba93", "value": "768:YZgSQuSNzxI0Malv6/XNjMfDrg3GVfhHydmC+:YINzVVlCfNwfDrgIptC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772244405, "uuid": "5d7a6efa-36ab-4b6e-9042-1933ad974ff9", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772244405, "uuid": "f2051d84-4599-497e-b1c5-b7dde151c122", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244405, "uuid": "0d9c4919-3fca-4b6e-a087-88cfb3eafd0c", "value": "brnf0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf11c76-14e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772312203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312203, "uuid": "6889b42a-80d4-416f-905a-468191f159f9", "comment": "Malware payload (Mirai)", "value": "8e64994ed0d6f966dbac65e29a5a9691", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312203, "uuid": "ed162b1c-76f7-48a4-90a8-ff9ffa36792e", "comment": "Malware payload (Mirai)", "value": "97c2d458e9b3337dfecc3ebfdf179b26f2840537a4b17bf352e0c5989fe77d1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312203, "uuid": "957c5c9a-62b4-4e06-966f-69c7f0dcddae", "comment": "Malware payload (Mirai)", "value": "a26ebf0c22f60d1bb76ca786ee6ce99e1c5fd5af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312203, "uuid": "457ba542-e281-4847-ada1-ea0671cbc760", "comment": "Malware payload (Mirai)", "value": "1e17efd6e71c013727a54f0ef2b007196a4cef1fb5b05425e64b8fa63969ecda860002a1ade5f24d8840ff13e24fba35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312203, "uuid": "711f2f55-e741-496d-8e03-3a7aee429937", "value": "T13FA3E80ABF610FF7E8AFDD3745E92B41248D551621A83B79B930E828F25A24F15D3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312203, "uuid": "fb3d8c5d-a307-4c01-915f-3da395c4be9b", "value": "1536:JA2PcjrbBX5n6zusHk8I9BhgnvgFVaZ+q5rukuoiUX:JA20rbBJnxsTpgDayZUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772312203, "uuid": "f4b49618-4615-4d55-869a-f289665028a5", "value": 105216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772312203, "uuid": "0094ca6b-a0ed-4142-8582-6d39b4dfc5fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312203, "uuid": "192f13e4-0570-4b31-841c-7a6dad56ba67", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e8ccff-1490-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772274421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274421, "uuid": "801bf4cf-1cd5-4557-b8a0-59accb9fd3b2", "comment": "Malware payload (RemcosRAT)", "value": "4c5c385b2acfc542a110b157bd9fb17f", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274421, "uuid": "89eb7a9f-e295-410b-8c47-d0c241d955bc", "comment": "Malware payload (RemcosRAT)", "value": "97d7f3b893f0797f06e7f14cfb220463b91cdb3b85f28c651ff0983693db9b55", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274421, "uuid": "7bc5adfa-c592-4e9e-92d4-f53137bd1147", "comment": "Malware payload (RemcosRAT)", "value": "555147e393e4aaaff20c1e59f1aab0d4ade51383", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274421, "uuid": "3d172a09-59fd-459a-90c3-8c8728039999", "comment": "Malware payload (RemcosRAT)", "value": "7cff65ce538f17400f735f8d16326bc21750e14164e0c82fdfefed083b325fa29231cbf58fb5a0ac881c44c03a2055f4", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274421, "uuid": "c536a8a3-459d-42cc-9f92-50008af24b86", "value": "T17972B41A9915DFF00A3D3194B69B6D16A51043A7A4383E4D7C8FC4AD3F3AA10CFE11EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274421, "uuid": "bd13c14a-c75d-4d92-b3f1-d68c4e1e9ec2", "value": "384:KC9qsN27CJBr7Xm0xXs+74XqGhWNlD2aPQ/6lRshy2ESAOlTQvDmlqjr:K2v2czXpbUTS8gDmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772274421, "uuid": "ab5bf6dc-a916-4884-8b7c-a3ff67656e8b", "value": 16127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772274421, "uuid": "ffd9502b-829e-4c4e-986b-293b7d50cddc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274421, "uuid": "73f6dc8d-010a-4fb3-b16e-a80af0133c2f", "value": "4c5c385b2acfc542a110b157bd9fb17f.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55438bd4-14e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772310634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772310634, "uuid": "6fe9ddf7-ae0a-4d76-b09e-3fda06858dbc", "comment": "Malware payload", "value": "16e7da49a1c0232a7bb6b66030887f06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772310634, "uuid": "a5aac890-be13-4228-ba3b-19b6733f93eb", "comment": "Malware payload", "value": "9a00b23646147597b2600958a95b8728c6a935b359f2983193f0fd4dcf00024a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772310634, "uuid": "8eb293ef-4843-4220-adee-a7504d6bb0e6", "comment": "Malware payload", "value": "3d9c58c78e13251ea856662562753812ea4ffeed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772310634, "uuid": "95fcb3ac-4084-421b-b921-a81f94e79e6d", "comment": "Malware payload", "value": "33e59e0c6f264a8db724b6ccea8aaafb7dacfc2c342b52f23ece92371205c0ac48616b7d475917ec3ee7080d52358317", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772310634, "uuid": "45a7553c-d31e-4ccd-a10b-954048fc8e90", "value": "T1B684235384470AFEFB81367ED94860C6F6E07DB40D3DD24995FE8BA809528B5E9E8D30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772310634, "uuid": "f2ba5a23-b242-4242-b1a1-20e412b9bc00", "value": "6144:ju//HKcG2wchSnsUNMzdaCCDUox55Qw8wRe8VoxI20cU01zUN1/OkhGuOXengcjb:jEKT2wcEt0JCgox5Kzme8GxVvUfvhGXC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772310634, "uuid": "89e50aec-3092-47bf-8995-b8af7b7c30e4", "value": 392956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772310634, "uuid": "0e5c32aa-5dd5-45c5-807d-33a445647cd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772310634, "uuid": "2f35e905-4926-4bd9-9257-f7b72020e3a5", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cef2065-14e7-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyNote)", "timestamp": 1772311908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772311908, "uuid": "8f2843c0-2810-4667-8862-881e2daa27c7", "comment": "Malware payload (SpyNote)", "value": "0e0d4e1c29c87cad9f6537fbe43b8036", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeTelegram", "colour": "#FF4C93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772311908, "uuid": "0813033a-1210-4f97-829d-40f82a6d07ef", "comment": "Malware payload (SpyNote)", "value": "9aafbc143c66661609f34c483a85015f30f7da2a38f375d9e10c8eeadc6cb5da", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeTelegram", "colour": "#FF4C93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772311908, "uuid": "31ffbdd6-de13-47ff-81bf-7e136b126356", "comment": "Malware payload (SpyNote)", "value": "ab07d2de36df7332d5979858e7cbb9d6351e3da4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeTelegram", "colour": "#FF4C93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772311908, "uuid": "d7a0acef-4045-4186-af3d-b16199066ae8", "comment": "Malware payload (SpyNote)", "value": "b585a742d3b2eaa14c071c9cca4b2a65b0be7a559b1e8903bc206edc21cd473e0d69c151cd9b0e770387ec1e848dc0d8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeTelegram", "colour": "#FF4C93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772311908, "uuid": "4d9ddcfa-4b8f-4e8b-88a3-124ef77cba55", "value": "T10C26F113FB44DA87D8BA83F66B370DA919134F28C342AAD345117A7F2E771D10D96A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772311908, "uuid": "7763e784-a4f3-4e87-9b56-316e36c2e360", "value": "98304:bqTQpQ/RcaGY3y343BB53hf6i52mz5zBoTX0tEpNwZ/Yok5:bqTQ0caGY3yE5pBz4oMaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772311908, "uuid": "7290b08b-3204-470c-a41f-70fe6d7c7df0", "value": 4734418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772311908, "uuid": "30189096-a9a9-4646-aa58-aaa48e3f7d0b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772311908, "uuid": "90b66cda-d89a-4dd0-a84d-6dd4e9a03b7d", "value": "Telegram (2).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09f4bc5-14e7-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1772312048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312048, "uuid": "29d84dfa-5868-4bcd-b7b8-740a26dd1d74", "comment": "Malware payload (ConnectWise)", "value": "8c79e7a3a0f881a08d3691972aae8d4a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zoosmnm-com", "colour": "#80253F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312048, "uuid": "1c3ac6cf-3320-4b6c-8aef-aa85de509799", "comment": "Malware payload (ConnectWise)", "value": "9c71fca90904adceac3477b5c5a85cbdd3d5b4c4c64bee96730ed68d17441048", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zoosmnm-com", "colour": "#80253F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312048, "uuid": "13983217-e95d-4606-b36c-c71f632a1f05", "comment": "Malware payload (ConnectWise)", "value": "bdd426b3b9182a1dcf414254ccfd7dc4ccbefa71", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zoosmnm-com", "colour": "#80253F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312048, "uuid": "c4a55a54-1ea4-4277-b7c1-216e21b059bc", "comment": "Malware payload (ConnectWise)", "value": "8a5011164f2f428cdef10a73d95f01bfb03a2133f9788b59226dd7530b14fd6fdec96d9800474c1d206dc6c788957a3b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zoosmnm-com", "colour": "#80253F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312048, "uuid": "90ccc71f-f4e3-4cc9-924f-5fcf0fd61985", "value": "T1A746F011B3D695B9D5BF0638D87A42A95774BC048316C7FF5390BD296E32BC08E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312048, "uuid": "9fe2dce3-9f97-42b2-bfb4-c383a4848511", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312048, "uuid": "3301ba8f-d0d3-4660-9da4-87355006aba0", "value": "98304:Wv8s6efPOrJJNr2uTvY8vYEoQTJ9GGPrQZU/nLLLLLi:TfefPOrJH2ulvYPQTJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772312048, "uuid": "908d02e8-fb1f-4f55-9021-ffc7ca8fef2d", "value": 5741560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772312048, "uuid": "a0a6369f-76c8-4a0c-adbc-20f932c3fad7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312048, "uuid": "f940fce5-09ca-4cf1-946e-edf7e0a32397", "value": "9c71fca90904adceac3477b5c5a85cbdd3d5b4c4c64bee96730ed68d17441048", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13761549-147f-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772267144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267144, "uuid": "0aeba41d-578a-4f42-b32a-c5f17f950e04", "comment": "Malware payload (SalatStealer)", "value": "b8911b08c5085a3070ad68fa25ae6d08", "object_relation": "md5", "Tag": [ { "name": "aywbbg", "colour": "#A84F5B", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267144, "uuid": "335d4487-fd4a-46ad-8935-7d69556a5dea", "comment": "Malware payload (SalatStealer)", "value": "9e7b2ade35ee67a8b0678db1922671a21289b27d85a0394e2a6ea57bc1be723f", "object_relation": "sha256", "Tag": [ { "name": "aywbbg", "colour": "#A84F5B", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267144, "uuid": "21bba1b8-aabb-48e7-836a-a9d32e956470", "comment": "Malware payload (SalatStealer)", "value": "fba1b0fe28e610724ce3e9a6674f119a8f62d0fc", "object_relation": "sha1", "Tag": [ { "name": "aywbbg", "colour": "#A84F5B", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267144, "uuid": "7e7d2de2-06a4-477d-89bc-790114e3d9f5", "comment": "Malware payload (SalatStealer)", "value": "1503ef94d6bb237a840b8af92b86e5cc0ff29d684c5cb17dcd9be02a15d5ccb7a652980baa6a85b0733d5185cd415f47", "object_relation": "sha3-384", "Tag": [ { "name": "aywbbg", "colour": "#A84F5B", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772267144, "uuid": "40bd19df-8143-4748-81d5-20a866acc555", "value": "T161F19ED6D64D3DAFD5C33ABB765C92640D091A7C026640FB73DB75BA02857061BE0381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772267144, "uuid": "31a1790d-2448-4ed8-b77b-b95d67c80e5d", "value": "96:IZuoxjb0MiE6clMFKAhdIYO2Vv3BP/EeZsEOPYYeY6JpuDNqHP8m4t2jWllvXoQg:oxjAy61HrVt/Ee7gyYWpuB/TgMd4S4zV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772267144, "uuid": "da6e6f0a-f49e-406b-b008-8d021c53bc1d", "value": 7688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772267144, "uuid": "ed5e8727-1c60-46c6-906a-82e99d0c7783", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772267144, "uuid": "aee1ec71-4316-470a-b2ca-be3f537ac906", "value": "aywbbg.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84e4fbf3-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772289239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289239, "uuid": "a9f6380a-27bb-4448-8f78-355b751b17bf", "comment": "Malware payload (Mirai)", "value": "fc44083b358e5a09ba0048b55e421355", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289239, "uuid": "3ab572fc-09f2-4659-aaff-5ceb88f7cc0d", "comment": "Malware payload (Mirai)", "value": "a043c68516caff545cf2d60b96ea47d63f7996640a735b138188acaf253d9456", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289239, "uuid": "bd8d2a3c-a6ef-4e30-875e-63f085b4811f", "comment": "Malware payload (Mirai)", "value": "26b5cd063406ca96aba1bdcc7b824312ddd89777", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289239, "uuid": "30b61f6c-8e3d-4264-9d57-f6ffe6b61860", "comment": "Malware payload (Mirai)", "value": "66e92fd9e9110db232e0524e3a03cce27301a3ae97a02ba06ffbc7225b3da03c1462fb6d9679fe9488dd9d045e0a945d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289239, "uuid": "e9529b44-f118-41a3-a945-4e9251de12ef", "value": "T1CC13E1FB103F7A36D56711F5DA9A8B40ECB7E90AF2539BE3445A34BD484B74426A13C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289239, "uuid": "73784699-078b-44f5-b7c0-bd58140a34c2", "value": "768:17T6K3h+PnNoJbaow2CWfh1ioR5hqshGSXkrbw3KzZ5Sxx07qs:16Kg+Qolxp11R5hqshGdz+Oqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289239, "uuid": "f3408bdf-5ee7-4a85-a83b-14abfb1d629a", "value": 41892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289239, "uuid": "8bdfbccf-f7ae-4ad0-bae0-4cb730bad17d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289239, "uuid": "32b51007-34f2-4892-8e94-e2aae24d2dfa", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db216093-14a8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772285088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772285088, "uuid": "4c6b7c7f-9dba-4c4a-b34e-73c89cc86596", "comment": "Malware payload", "value": "800ea687b296df3b20065a05cf820f97", "object_relation": "md5", "Tag": [ { "name": "95-216-63-67", "colour": "#FBC290", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772285088, "uuid": "ebfb643b-6120-4ce7-9eca-f12836c546c6", "comment": "Malware payload", "value": "a05674744713744a5ea43d0e0985609138fe9cc1c30f23f6cc26e592f3d2b6f8", "object_relation": "sha256", "Tag": [ { "name": "95-216-63-67", "colour": "#FBC290", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772285088, "uuid": "4e18255f-4438-470f-958b-55b6d9f5bb8b", "comment": "Malware payload", "value": "bc73312f696a9eaf51460177ab34d0b525781ea9", "object_relation": "sha1", "Tag": [ { "name": "95-216-63-67", "colour": "#FBC290", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772285088, "uuid": "bb9e4f4f-1156-4768-a995-bcbd094621ba", "comment": "Malware payload", "value": "57c93c24eb7f7c477e765883eaf3a8b7b1d7518c5995ab289ea934bf70639ddb50abbccde3591a4d8d6711e29b943959", "object_relation": "sha3-384", "Tag": [ { "name": "95-216-63-67", "colour": "#FBC290", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772285088, "uuid": "5fb0a75c-978e-4197-a40b-4b5339501259", "value": "T1D382D1C45F1E2518EB676C3943C64CDA2E1189DC4EB352AB6AFD3689D032E89CB157C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772285088, "uuid": "b17fe5fe-c9ab-401c-add4-1a0eb973a0fc", "value": "384:5oT2bjeziQ7d9fcTUc9TkAInOoEq2aUfgMjBqu4AGOIsLCg5IZ:GqbUv3QqEoMcu4n/sugqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772285088, "uuid": "449caf07-2daa-44d0-8ef8-d192fbcda79b", "value": 18004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772285088, "uuid": "dcf73541-3081-4d98-911e-7d89493d97eb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772285088, "uuid": "76a1800f-27f4-43a5-95e3-559dd488e936", "value": "SSA_GOV (2).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "421d46a5-148b-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772272376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772272376, "uuid": "886a7f67-34eb-417c-aa4e-e1e1d8074224", "comment": "Malware payload (GCleaner)", "value": "82e92daf54d40c6ff7212801a213bcb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772272376, "uuid": "0850e86b-d860-4466-9041-3d00fad95b06", "comment": "Malware payload (GCleaner)", "value": "a329973df988ad0323edc035bc642ed613a72024154e935745140511d948a192", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772272376, "uuid": "922ea785-e809-4e97-b471-5ced6a8183c6", "comment": "Malware payload (GCleaner)", "value": "b436565254dfde1a43c9bc2b9bc65f331af0f730", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772272376, "uuid": "4246af63-29ce-4fa1-9cc8-2ecd104733c9", "comment": "Malware payload (GCleaner)", "value": "a55ee0eed82817a1400377fe3bfffd1d20d37e762c83cad9cf75ebfd3ace03a7c08f86bf892037e19f6167550662973b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772272376, "uuid": "de130493-7070-451d-a4e2-66a7cebffa22", "value": "T140159E2EB2F08036DD762738FD7B669899267ED03F3498C92AF41DCC4B3964174252A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772272376, "uuid": "a36c3d75-ba6e-42e6-b61b-d712c1322445", "value": "1b5561a94cb01af2569d6f2ff45e087c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772272376, "uuid": "ed010950-fdc3-4ed2-8c3d-22755ab8d28b", "value": "24576:TFTPaZNNIN6ndL7cuL7jFd+LUXrUH9IdROE:TNUXjv5/jFdx8IdROE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772272376, "uuid": "32795728-9a93-4baf-9aeb-b075260b019b", "value": 919040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772272376, "uuid": "9e2afdb7-71e6-458b-9462-ccb694a5df53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772272376, "uuid": "b09e47bf-3a46-49d3-8828-d772247fb41e", "value": "82e92daf54d40c6ff7212801a213bcb6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d30cfc7f-149a-11f1-a769-42010a9c0008", "comment": "Malware payload (XRed)", "timestamp": 1772279062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772279062, "uuid": "c37c390f-04e2-4843-852d-80641e5cdeba", "comment": "Malware payload (XRed)", "value": "880a15ca0dcba93d0f93390af98e20d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772279062, "uuid": "22a36bc8-9448-48a6-bf91-585817a1aa6f", "comment": "Malware payload (XRed)", "value": "a380d3d69ccfa937fb1dacccfbf7cb91b74957bd14999ea9094f6f51c3209227", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772279062, "uuid": "993cb2f3-69d6-4cb2-b72a-c4758795d71c", "comment": "Malware payload (XRed)", "value": "aaa0efb51a36732c592b3217340af20caeeb131f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772279062, "uuid": "665d24cd-8947-4ad7-bd1c-8111937f8e59", "comment": "Malware payload (XRed)", "value": "cd4ba4d47e19530e634d2b852ad8cdaa92cfe5640c3aaa73e7ff79a11e8c6f2e23be9f79f742c0c70b1499e96b502f73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772279062, "uuid": "96640255-bf7a-4300-b53c-f6e5d2277f01", "value": "T19137332272D170B3C26766789DDBD365583DBE925D78F05F26E44E889F2E3822C142CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772279062, "uuid": "8ab24b0d-8a67-4293-83ce-7d9584a557a1", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772279062, "uuid": "1e890746-916b-4bb4-a275-19aedaaf6b66", "value": "393216:rlPBC1lb8R765hM28vF9LnrsTlYYqxh5vSaArgxRXy91qR6tcevTBplr3JPXboB2:jkhMHzLnIlESrgrXcYclr5/boQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772279062, "uuid": "28d19769-432e-4739-805b-d02ef69c2e84", "value": 23733248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772279062, "uuid": "7a5859d1-f1e3-4a3f-8367-be7f55778bba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772279062, "uuid": "5a4ca861-f65b-42b2-9a72-6e4e83f1523d", "value": "Bomber.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbf4c3ab-147d-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772266621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772266621, "uuid": "d098da41-7f74-4136-a766-5ef8be02eafa", "comment": "Malware payload (XWorm)", "value": "8bb57e630f6fa5a6b8e20f2bb554b156", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772266621, "uuid": "61a7764c-25c8-4b35-8d5f-dbbbbcb21821", "comment": "Malware payload (XWorm)", "value": "a3a03c8880ad5863064069cfa5ee78a14a410fca379bb1e5d0f16fcbb9874517", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772266621, "uuid": "9beb35ba-2047-48f1-94a4-187bdce25d6a", "comment": "Malware payload (XWorm)", "value": "018d96a57d84980076db463291811a14698da992", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772266621, "uuid": "6ba37945-cfd4-40c2-b926-3e57d65d7679", "comment": "Malware payload (XWorm)", "value": "78b805eccda9a9936bb924cfd8f4054ed6bd342e02d5516c6a5fad14d6367b434d0b066787259bc2969088351fd3cda3", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772266621, "uuid": "36e5a3b1-40f2-424e-aac8-1004f5ebb3e1", "value": "T1C5515B6ED6AAEB084D3789391326F60841C78BC2EC2E660385A178B33E3E47E5091817", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772266621, "uuid": "86786b17-71ab-4909-8b0e-8c0a83440238", "value": "48:j41JYiu1N5pLbbsyatwQO2qYwZ/nP4cxHGCOL1GwDBIlN:Uu1NnbTuyvpxoG+BE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772266621, "uuid": "c0201bfd-e10a-47e2-88ea-0fb59bb500f6", "value": 2750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772266621, "uuid": "744302e0-58e0-41e3-9892-78149c628ee3", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772266621, "uuid": "f9e23d10-ec63-4b10-b5fc-24cc908fe5ff", "value": "comprovativo de pagamento.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "067afbb5-1451-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772247365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772247365, "uuid": "ab0c0c71-71fe-49ab-8bb5-844e2c7a96e7", "comment": "Malware payload (Mirai)", "value": "ea16f02089d82fb2a9fc4d246bbf1964", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772247365, "uuid": "b23bd9ac-09a2-4d9c-b29f-2f2d16f4a2d3", "comment": "Malware payload (Mirai)", "value": "a3d71a4c6958bdd70e4a8a85088e40aa652e91f10e0c1ac2aa1187b3a6c5fadc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772247365, "uuid": "b7615c5d-0df9-4329-9102-9f7a4cd4f96c", "comment": "Malware payload (Mirai)", "value": "7684cb35fb4e7fe60d67991806e75b37a355f370", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772247365, "uuid": "b2efe41b-1678-409d-8a53-18bc347ab459", "comment": "Malware payload (Mirai)", "value": "1c8e919542744f70a05989f061c68b88ce3b1fffaa78f80ac86c1786806a9af0a9e94e7700aa63ee064be154fbab085b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772247365, "uuid": "1a76ad84-04fc-44ed-bd75-f8758a3e3ac7", "value": "T194F3C50E6E198F7CF79987344BB79E32965833872AE1C582E16CD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772247365, "uuid": "6cb24e88-b5a0-4f4a-9fd6-7057a1aacff3", "value": "3072:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/Q4vkTTzTT4BFZDiwP:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772247365, "uuid": "9430cd46-3a80-459a-aa81-8cc2b35eab95", "value": 171724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772247365, "uuid": "952d7e2d-e5bf-4866-b6ec-63e45d68d027", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772247365, "uuid": "96cc6770-bde0-4153-8e00-de9a3d9d869f", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31848229-14d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772303272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303272, "uuid": "645b1491-a833-49df-a776-67bb816eaa7f", "comment": "Malware payload (Mirai)", "value": "16e9891257e939a0d113edb2a5134664", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303272, "uuid": "7b7339c8-f44b-409f-ac0b-4c701e04250d", "comment": "Malware payload (Mirai)", "value": "a5d3b14ed9482a0c4947dcbcc206c40cee0ceddd0e80985a4be045eaf2fab7c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303272, "uuid": "d1f9161b-8603-4881-a67d-d9fd240b96b7", "comment": "Malware payload (Mirai)", "value": "1c2217857129099e5e0cc6a9b6ad899353437f05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303272, "uuid": "b9b5e9c4-781c-4a83-b83f-d40aec4baa5c", "comment": "Malware payload (Mirai)", "value": "2d79a51985f3d741296a97c307221b5669deba1828489b6b8c88994f2435ef16d7c053665d19ade154ac93187f91e2a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303272, "uuid": "4102c398-5e66-4928-8274-bf7e770ddcbb", "value": "T1951349C59A43C0F1EC1112F11077AB519F72A436AA79FB47E7A93A32FC02B1196173AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303272, "uuid": "6b1924a1-5bb3-4adf-978e-c1f43f13f526", "value": "768:x73jOIDzzrq7WiEu+RiUjre0Ex63a7x2oq1z7yvEdTpKMxn:FjOAzwvEuP4a0EgwzkWItKKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772303272, "uuid": "944c634d-d653-4589-9169-6b1c0e29b904", "value": 41840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772303272, "uuid": "d7ad5605-88ea-493a-9222-f6425455fe5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303272, "uuid": "58cf728e-62f4-46b7-9065-732b494313db", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d4f02a-14e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772312166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312166, "uuid": "5fc0feed-16e5-4ca0-8059-6ff050d259ee", "comment": "Malware payload (Mirai)", "value": "0b49bb501fc3e7e8fb7fb4ff14528f62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312166, "uuid": "b70ea0de-0851-4abe-92f7-c4ce50df70c0", "comment": "Malware payload (Mirai)", "value": "a6f5c3ec37d0b63b6d17d93f2b9b5c1c17326191fc83779e436ff3b1ad27d748", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312166, "uuid": "93f7054f-3f0e-4563-905f-e0bfcdaa7780", "comment": "Malware payload (Mirai)", "value": "ef8551f95641146c73a4ce26165ff888db6628e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312166, "uuid": "4eadfef9-9c74-4374-a39a-13998c46b218", "comment": "Malware payload (Mirai)", "value": "fce8b76ca40cb7a1b1e41359dff5136f563fff18ebdc96c1080a01b12f965c4bd2d555b8b5bd77e1a88e3976b37c8727", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312166, "uuid": "df63600e-54af-4989-bee9-7252df2202dd", "value": "T12503E134F8DE1CDF84786C35CD1EC6836EE4563CD41B362723588750A7E651AA6B290B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312166, "uuid": "cb11ec80-fc60-42e0-a8a6-e8889aa04a41", "value": "768:yyLQUqgcPjX41WIZQpoBxJFry2DpEAHIg23F9q3UELiH:hq5PM1pTBTMyhLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772312166, "uuid": "1f136d49-099b-40cb-9d78-0e3563adaa58", "value": 39416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772312166, "uuid": "08482f2c-96ac-4f73-8bff-c1bd8b6bda69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312166, "uuid": "96b726b1-4d7e-46f3-b739-6ffd24dddc5a", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2184b56b-14aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772285636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772285636, "uuid": "3b318bff-625e-46c0-8f68-d96ffe79216d", "comment": "Malware payload (Mirai)", "value": "990483b683b841405669deccca9df010", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772285636, "uuid": "fbd108ec-cc65-4682-bb4e-517e24532cc2", "comment": "Malware payload (Mirai)", "value": "a97255887e37b592e949a21269743dd1c48136532de5a422fd74ac7cb0009375", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772285636, "uuid": "ad9bc287-66c5-416d-8088-b1292e6433b5", "comment": "Malware payload (Mirai)", "value": "b4cafd0ac0bf64858485e78a09a5a84f5d496c96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772285636, "uuid": "441328db-850c-413a-8b45-237101854eb7", "comment": "Malware payload (Mirai)", "value": "d2ab69db5933777ec35664b72ebfbc475177e5e2812ff390c9a7ca143c1a4e1b927466d6611f3e8bd9b5092ae46d2aed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772285636, "uuid": "0f7bf95f-f013-42dc-b141-a9da4c7467a5", "value": "T16814961E6E228F7DF668873447B78E25975C23D627E1D641E2ACC2105F6028E641FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772285636, "uuid": "09d5e836-d13e-4e13-b26c-698959dc19c6", "value": "3072:3c2nXadriWo282fLLTwMif6md0gM3eDBilA+OEuoz:s2Xgo2VfsMo6eMSBp+OEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772285636, "uuid": "bdc6e313-47c2-4f08-8937-5b7ad819fbfa", "value": 194176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772285636, "uuid": "feb76df6-746c-4d00-ae17-5b2dbda64bb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772285636, "uuid": "2e15d9f1-18cf-431e-abfe-ea885abc9d6a", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec59430-14c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772297577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772297577, "uuid": "a2ffec41-b7e0-436a-92bd-00d4c05e42e6", "comment": "Malware payload", "value": "f74ed8442b9e9062e08c2517b8ffd3bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772297577, "uuid": "80a2774a-25c8-46fe-aa16-846c33d035ee", "comment": "Malware payload", "value": "ab358e2167c874c048d23c7d6ca3646f403b84c5321f56230d8362f36d98a146", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772297577, "uuid": "137e8298-c5c7-4ac5-89d7-e3773c6d2614", "comment": "Malware payload", "value": "0020a989f5c36305c1d8bc06de6602d113aa72e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772297577, "uuid": "43ddc543-9465-4e87-8b91-0c84ae7eb139", "comment": "Malware payload", "value": "7c8969c3f899c60e24e6362797051ddf56ced7c1a2c494ed6be11030d996937d8eead9dad6ac16a08bcaf1094decd23b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772297577, "uuid": "e2b95058-b1dd-4eb3-9e65-e2ff70c50b31", "value": "T17204F18AFE914F9FC42FDF70055F136755ED85DA8AE2632B827C8858B18C245CAE3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772297577, "uuid": "4490ed0c-3dd9-4170-adad-6bb4aa5edd51", "value": "3072:oDTIzc663gm4FNsHXLBuf7T1VbKghIQtZfht7a2e/LqIP6qrh8zrI36ce:rzR63rcAwLNyQt17hwLbPZuzrae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772297577, "uuid": "025e45a0-3053-465c-8648-5ee3511f3768", "value": 180213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772297577, "uuid": "b7039c3b-5b71-4525-9a74-2a30fab6a84f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772297577, "uuid": "99d30821-f5c9-45aa-be9b-f5c52fb632a8", "value": "8mrg3tlpxq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1dcc605-14e6-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyNote)", "timestamp": 1772311728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772311728, "uuid": "7adadfc6-7c1e-4ce6-af7c-6631606dce83", "comment": "Malware payload (SpyNote)", "value": "780c88f948825264b61a7c08f8ff937e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772311728, "uuid": "638f5448-72fe-42b7-94ea-7d35e10f40df", "comment": "Malware payload (SpyNote)", "value": "ad02db22949f80c2981ae59813672c44d339eb94dfdd4e01ff329470cdd9230e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772311728, "uuid": "4860c4b6-2dca-4a87-9d85-a1c972f89eaf", "comment": "Malware payload (SpyNote)", "value": "b045cbc21b94c742c98beb2bd8f76b36e9a964fa", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772311728, "uuid": "b82e3c05-2bd1-489f-b52f-ba7f37e554bf", "comment": "Malware payload (SpyNote)", "value": "bbdad356c90aeb70e9d9722e0595554341814ff3ff2c0c6c5d46369bb8586dfb18eb146870c9c1e7af5098d66e6955ba", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772311728, "uuid": "2e903c44-32ed-4a15-9592-322789fa3bf3", "value": "T1E5762212FF46D46FC5FB82374A7A02362A165C5D86538B9759A8B13C1CBF9C04BD2EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772311728, "uuid": "5b203477-0cb0-4745-a393-b207bc11975b", "value": "98304:wKl2EBjygOhoV1LWqwK/33AFfyDzV+Qc56u/Io7di283LYilbg1+V29ANFQZaZNA:6EBMhQZvAfdRTQ22YiCPiNCZKn2j2KHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772311728, "uuid": "5d0ef193-b2b9-4b32-a96a-3c6a72e4f528", "value": 7628974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772311728, "uuid": "8426981a-aaeb-4af1-a4a8-2fa277df59b8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772311728, "uuid": "40e0a07f-a847-4d96-8f75-48e527856376", "value": "Indecopi (1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "092a1aca-14e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772312653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312653, "uuid": "dea19bf1-3bf0-4267-b197-5854c9a443b4", "comment": "Malware payload", "value": "d7e2b193229aea8e1632cea82b8e5ef6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312653, "uuid": "2a7e69a1-3e53-45b5-8fcc-3daedeaaa0af", "comment": "Malware payload", "value": "b0e328a131e4d679e9b268552db99ca2d46051b9205a67f9b7f7c1628983daae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312653, "uuid": "6726038a-8fdf-48ff-a376-d7d32d5226e0", "comment": "Malware payload", "value": "e3c46f53707e537d8c48cc3af2fb8c0a956bd5e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312653, "uuid": "1895170b-9ef0-4733-8682-fe5db04a3e96", "comment": "Malware payload", "value": "1f8a4650c43e0eabe941817319c9ef7173e1a91cbf3eb2c8747ed07bdfbafd3e88ae6fc35b10a54890746b317ab1ffa3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312653, "uuid": "b351aadb-68c0-4475-8f03-401fada0335d", "value": "T18D873913E8A544A8C5A9D534C6769123BFB27C49873033D37B68FB206F76BD096BA350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312653, "uuid": "fdb91d1d-e7a7-4280-8e04-54c05238960e", "value": "196608:gXIKebtBVbf07AKTzwF72xu0bLpHB8FGZ4WmO0sSe4nZBkTEqEVWUh+:gEbt/fa1wFExdhKGZ4WmO0s7+ZRDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772312653, "uuid": "9a98772e-beb6-4879-b727-712578260cf7", "value": 37970104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772312653, "uuid": "6fb04349-0d55-40ad-b9df-ca2de35a8205", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312653, "uuid": "14c8f34d-a7b2-45a7-817b-d70e76c67420", "value": "sliver-client_linux-amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0310bcc-14c5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772297579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772297579, "uuid": "4da96e60-3030-4a8d-a343-5b1be9b5e5a6", "comment": "Malware payload (Mirai)", "value": "85856518a225bcc13441328c656437f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772297579, "uuid": "9aeb36c4-aace-4775-bd81-2e099da2ea93", "comment": "Malware payload (Mirai)", "value": "b1bb2b68a28ca28c0d31ced9558df53275a7afe97985dbf4d636c342f81ae12e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772297579, "uuid": "23ef226c-d9f3-4b65-8567-024badc4f93a", "comment": "Malware payload (Mirai)", "value": "fa36e1ca5929b06d2adb7cc6b039f7aafefbebec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772297579, "uuid": "4407c07a-95e0-48e4-9e9c-326a063bba9c", "comment": "Malware payload (Mirai)", "value": "a3a3915474b4adced3f1bbd91abbe8d37e6d9cde726d9552a782eb8ec9deaff168b782e4dcf9903c0fa8ec28bdf9efb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772297579, "uuid": "f004fd5a-8b3d-4e4a-9c35-2beae114d0c9", "value": "T106B3F262A791117DC58FC6BA0BB7E962F773B88477187B1E2245EA221F03F112B4D790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772297579, "uuid": "67aa7629-1c75-49d6-9a61-6664a1cfa9e3", "value": "1536:NovYbQVtiDor3zXQKfDBnGO5DdAUYjA6964ca8MaCtNNdQwx/e0nIAvjSGNdMo9p:Nov4QV8U9D9uR/akpxW0nj7SGfHxs/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772297579, "uuid": "88954872-b9cf-435f-a5ec-b88a3bda0b2c", "value": 115529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772297579, "uuid": "ec90ec1b-e3e7-499f-b336-18040724ab1a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772297579, "uuid": "5eba4c08-7daa-4418-8d80-ac15f4fabfcd", "value": "as1kxl6nr8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec138616-147f-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentCryptoMiner)", "timestamp": 1772267507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267507, "uuid": "33d51966-b76c-4af1-a7e3-91bc82c76c42", "comment": "Malware payload (SilentCryptoMiner)", "value": "af143dfc4178f8c62a5cc00c49207c2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "SilentCryptoMiner", "colour": "#F3BFFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267507, "uuid": "aa14a7a4-58ef-4da4-be9d-377ddc4e6fd6", "comment": "Malware payload (SilentCryptoMiner)", "value": "b4ae0aa38f19cf8c917061bcd03ee501ec97faac1582d0b8ca488f8c97c00a53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "SilentCryptoMiner", "colour": "#F3BFFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267507, "uuid": "c837018a-0786-47fc-93b1-d8926f387068", "comment": "Malware payload (SilentCryptoMiner)", "value": "3e64f12e8aed685a30a5226ba76381551475fc3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "SilentCryptoMiner", "colour": "#F3BFFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267507, "uuid": "e93a4058-af19-4e47-9a96-2a0cc9f51379", "comment": "Malware payload (SilentCryptoMiner)", "value": "f259dca55210969b39c7369a01f03ad298b007ee99c33e87efcdcd6d6ff44cd0e0adf23aaf4504f8088fe2b2d05016a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "SilentCryptoMiner", "colour": "#F3BFFC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772267507, "uuid": "f51f6d51-e1ce-496b-a200-0195774ad3bc", "value": "T16AF24C083BA4822EC9FF2BF96A73E6120370E5078A13EB4E59C4456A6F37BC149457D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772267507, "uuid": "c8056a4a-fca9-4c07-a921-9da09c66aebc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772267507, "uuid": "368f72e3-98dd-4b05-bade-0d701f3919a8", "value": "768:BzKeuw7mMDFDQAk9ShvCyzC+5WDWVFq9JGOMhHulK:B9bDgQdeHDGFq9JGOMRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772267507, "uuid": "fc42c085-720d-4641-8bf9-5d665aa5ce7f", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772267507, "uuid": "c3b01aa6-554d-4f0f-aa28-0264a0b2b558", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772267507, "uuid": "09598498-dba3-439e-b3a2-0e9fef31c92a", "value": "b4ae0aa38f19cf8c917061bcd03ee501ec97faac1582d0b8ca488f8c97c00a53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1113ae-14c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772297576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772297576, "uuid": "2ba60d4b-3c2f-485b-8243-fa2d33944285", "comment": "Malware payload", "value": "c176045987d7370a72df8650b95d2463", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772297576, "uuid": "26f70d98-cc4d-43b9-90a1-1caf92d92ce3", "comment": "Malware payload", "value": "b5a52d2a9765c9985dd3df02b021c114a90c2142428a82666ea06cc0889e3b0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772297576, "uuid": "c463c5e2-bf9b-48c3-beb3-7cb41aaf92f0", "comment": "Malware payload", "value": "51ff867c3688f33a3022a833b57df5eb884b26fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772297576, "uuid": "a990f04c-b9d4-4590-9ee7-6f2ff99306df", "comment": "Malware payload", "value": "ecfbc79438a45bdbb2609bb6b2e14caa1af709bdf928f85fb167ad353bf24f12a4a92b7b159dd195002cae05ebe4744b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772297576, "uuid": "a0f509f1-bfda-4dea-80d9-b2416f3f35d7", "value": "T1F704F14777014F61C339D47105F38A92F7F613E51792A28AAB2CD805AFAA38C650FEE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772297576, "uuid": "96296e8c-7bc5-4f37-be64-e29c1e297fa4", "value": "3072:kgfKVeEOH4lcgjZxOp2FpYCAPqodFKDbPJwNxdn5c6xW5P4s9cRuoBVsf1V:kbNR1POpApntDTJwZn5Hsfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772297576, "uuid": "74e49e8c-9706-4c95-9eee-69ced0399b6b", "value": 180676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772297576, "uuid": "6539942d-40d2-4804-ac10-6bf8f981e5ec", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772297576, "uuid": "a127b5c6-cece-44fb-affc-b75973415089", "value": "dszu1nu093", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e2e3e9a-144c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772245392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245392, "uuid": "7943c17a-f126-40ad-b2be-167fa27c2d30", "comment": "Malware payload (Mirai)", "value": "00d372a531b0988e21425c26a055ee0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245392, "uuid": "528e250e-c127-49a9-8bbd-f9ae96aa9b0e", "comment": "Malware payload (Mirai)", "value": "b775b53d510aa1b5b8ef7db69e7e19c5809024470419cd0b7dd4206518f28344", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245392, "uuid": "6f77b8e5-f411-4c1f-80ce-9d57fb6511d6", "comment": "Malware payload (Mirai)", "value": "7e17689502c3fa0da0ebc684d4513e9472f65a30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245392, "uuid": "f5def6e1-4045-475f-af75-fc0348d4bdca", "comment": "Malware payload (Mirai)", "value": "2cbc4a63cd077f89c3e2ca1f478fe6585b8716e0191a0539adf32efe69c6c9946159abe54887bd8157d721b7930e6708", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772245392, "uuid": "ca43386f-f988-435a-a51b-1acae13a97bb", "value": "T152A34AC4F743D4F1EC5701B16137FB36AB32E1B5212DE943D3699A33ACA2541DA0AB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772245392, "uuid": "2092af01-31e1-42a1-819f-f92a80b2e61d", "value": "3072:hkAFVLsS9EYiWZgsVb5HLHyKXBcu6JL+B:hkAHLs6EL2gsVtOxL+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772245392, "uuid": "b8290b5c-9b75-4238-8a9d-64a3a49984cd", "value": 103404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772245392, "uuid": "6aad3ffd-c8ab-4b49-9a6e-f13dc8c70b62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772245392, "uuid": "b46fb11f-8bce-4bc7-9b70-ce2ad74e4bfd", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29459ef2-144a-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772244417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244417, "uuid": "de074d34-b8cf-4198-944c-45ce61b1fe31", "comment": "Malware payload (AsyncRAT)", "value": "7167b57d36d6bb0323abad56f9aeaa87", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244417, "uuid": "ad760bb2-11cb-4432-83bc-0877181505cd", "comment": "Malware payload (AsyncRAT)", "value": "b7dbc3a02857e43842147aef80763e655d313dc7465ef202f82c29cd3251eb0d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244417, "uuid": "0ee4e9b6-484c-4bc6-bdd2-04d4251118f4", "comment": "Malware payload (AsyncRAT)", "value": "53acd00273d5d8e1d97eebb6b64f84ed13ef95ce", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244417, "uuid": "c8fa5bff-d600-47b5-b89e-ea0f1eb8d7ab", "comment": "Malware payload (AsyncRAT)", "value": "ca03be660824a83e04057e6ab366149f4e657deb61813fc95bb6d9cab47bf49589cd161a0e34d827fcee18d1b6bb5196", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244417, "uuid": "093bdcee-1e6b-4023-8d9d-54a39bd5e4ac", "value": "T184F42321D4A7B836C31B90307AA6C37BDB37E7F2365E9829531DE5313E994426B3E805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244417, "uuid": "4ef98dc6-a493-497f-a627-0f82d29688c2", "value": "05aef0bd2a5a346cf7b29eefc9bc31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244417, "uuid": "6f6f5e69-3a07-43dc-9058-05f926bbf021", "value": "12288:i+/3+qAPN9rU82uRpSHKJaLzaMuOKRiUTHHof8DLNIf2lbLAW23rewE0iJ5Ob:iMqPN6YRY5yMuoNf82eNkW2benrgb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772244417, "uuid": "078a6a36-b4bd-490a-b3e3-a971a4bf15a5", "value": 769024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772244417, "uuid": "bb120ea0-f825-4e1d-8d4c-b80dedbd019e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244417, "uuid": "c91caf89-229e-4c6a-a14d-353995a637bb", "value": "chrack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48861289-148f-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1772274105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274105, "uuid": "4c0e1913-dfbe-46f4-b84e-6e4ff70bc0e2", "comment": "Malware payload (DarkCloud)", "value": "f432b5ffa3e1a2246b07194fd57c1d7d", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274105, "uuid": "6cc092a0-a287-4dbb-8040-1fa37bd0c8e9", "comment": "Malware payload (DarkCloud)", "value": "b7e020ced3283cb18691d47a2d95e243664638dbb2d501f296108fb282854a7c", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274105, "uuid": "58897582-0cc6-48fb-a5b8-b8621814e27e", "comment": "Malware payload (DarkCloud)", "value": "ff02bac3a5a1cf54cb457189f7c686384e9733a6", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274105, "uuid": "8938e206-2efb-4ab0-90d4-00dc5d07c620", "comment": "Malware payload (DarkCloud)", "value": "37ceba0605eaf5b3f7cb1d62335b6fc238585f3fcd132a1817541cf7c857ef01c3e91a9fbdf078d82373014dde62f2c0", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274105, "uuid": "aa3d4f0c-f1e0-4b75-80a9-9a723d7769ee", "value": "T143F229ED13B7252B1CAC2055A437C2C189754E84632469AF5A9FACDAC14C4FF97FBE80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274105, "uuid": "cce2ce97-8108-4b35-97a0-5e33b42a8baf", "value": "768:mtng7oMWs5czidTzLBxHXNNOJAA9/MksBlbbQyFVrRGqgQFEs+lF67Ci:GHCYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772274105, "uuid": "8b2fb069-6b7c-4a88-b815-9a113c5b4c5c", "value": 34992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772274105, "uuid": "0635cf64-ed7e-4df7-9fea-f6a31417f6c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274105, "uuid": "38c5368e-331c-44da-83fd-fb5a4f277db2", "value": "f432b5ffa3e1a2246b07194fd57c1d7d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5e4486c-148d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772273483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772273483, "uuid": "9ef26120-c299-4060-8480-9e1539aac7da", "comment": "Malware payload", "value": "8839de129c0a227f080d57febf0e04d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772273483, "uuid": "827eb88a-fbe1-45d0-a37e-46412b5c96a7", "comment": "Malware payload", "value": "b80ac13edccd2ca442221d7b22a6e8c7eb98688426582d38bf4ebbd5e0ab265b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772273483, "uuid": "037ab446-de73-415e-b6db-17f867151160", "comment": "Malware payload", "value": "56aaed9c030c76c434f150977227117bde489637", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772273483, "uuid": "d8ed945d-9b48-423c-8fc0-08a9fd147513", "comment": "Malware payload", "value": "e808bb5ff0ee38f86f2fb0054a72731c60628edc6b80e03b8fdef7100eeb07fbea07d4962574dc92368b1e399874551f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772273483, "uuid": "a1a90309-5c41-4127-a8e9-fe87805716ec", "value": "T1AB269E07ECA108F9C0AEA37189B296567B75BC481B3263DB2E60B6782F737D05D79314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772273483, "uuid": "e547cf3a-fd93-4e4f-aa8b-fbadb39424db", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772273483, "uuid": "ad522dcd-e591-46de-8455-d8bd91d3e955", "value": "49152:cUITOK5wYv9w+Vm508U5oTumujEVXWAf4mGJRvXS4w5yxkNtTPv+0srqTKKURIg0:cUQRq0/o0J1w5GkNtT/UD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772273483, "uuid": "353afe5a-0f23-4ac3-873c-0c5deb4d59f5", "value": 4681216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772273483, "uuid": "a378af9e-9bbb-44df-a912-a46d2eff6b4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772273483, "uuid": "7fcdae07-36b8-4b82-88e8-31f1a8c59b55", "value": "YOaxz85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8694895b-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772289241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289241, "uuid": "0513b977-e9b1-4f6d-9916-b3d0e0822f11", "comment": "Malware payload (Mirai)", "value": "1e9b55c431b77d6be749b41e150550b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289241, "uuid": "e373f8d2-0e80-41f1-b719-62e7681a7d2d", "comment": "Malware payload (Mirai)", "value": "b8cfddc51a547b11dd5f36f7711b901a701b8346fe3a83a61fc2411e2b4179eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289241, "uuid": "0f638aaa-c8ae-4a64-8579-d0eff8f9c2f5", "comment": "Malware payload (Mirai)", "value": "5ad33a2971b2e67f8c94f2450ced503c2c1efaf5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289241, "uuid": "3fd6de75-fb9c-4152-a9bc-8692b20489cb", "comment": "Malware payload (Mirai)", "value": "0e43f1b2c93f5abba001c12007cb3db37b55fd316fa5abf501de37c08f7d8c3df75e07332c510895522d5ea634e48da7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289241, "uuid": "e828f49c-f0fa-4a06-bd12-ab0c374e6e7e", "value": "T1BF630292D0EFD744EAF38C3998111A0A7B0F1FBEA3162472086099DAAE178B70DD4597", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289241, "uuid": "76f64eb4-3e3c-4993-9f4a-c14937742780", "value": "1536:ijDbRJKSJFpm5FDPpbvRUfszL70tq6ZkwLiBKxEZkygfjz1VDMnm:ij5pxcDRjRUfszLYtBkwLisckNjzTAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289241, "uuid": "b1c943ce-4411-4fed-ad38-6debbe9858ca", "value": 66896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289241, "uuid": "a62f8685-8976-4a4f-a93e-722a25fa8b28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289241, "uuid": "34e2f9ac-de91-4c78-8387-63c52ceea65b", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af19ec49-1473-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772262251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772262251, "uuid": "6520120d-e659-402c-910f-1012e01079b4", "comment": "Malware payload (Smoke Loader)", "value": "e23f419933be4682518f34ade3170fd9", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772262251, "uuid": "22a2300a-ec1e-417e-b3c1-7ff6e5920b25", "comment": "Malware payload (Smoke Loader)", "value": "bc10bd71d75d2364e4768251e59a5e2e1fc0077e264f1aa3c7d41892143c2ad2", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772262251, "uuid": "2ae4bb34-283d-498d-aa49-53b15d21369c", "comment": "Malware payload (Smoke Loader)", "value": "bc14010c36e179dae6411e6bd08e0023398179b1", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772262251, "uuid": "b4c05918-723c-49c0-83a4-cf576b1f51ba", "comment": "Malware payload (Smoke Loader)", "value": "e6bd2f99eefe1be540c8b15f3fe913abb85a2a8a351a72ba4eeb6ddd20af67d0527c8570229eb2fd5e7be5fb8aa91fe1", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772262251, "uuid": "69840884-e2f8-493d-9749-fc98764a3180", "value": "T17495590BAC9418E6C0AEA77699B722913B70FC690B3223D31F8076782F767D45D76718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772262251, "uuid": "79bc918d-48f1-4f25-88cb-63e8f411d97b", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772262251, "uuid": "28d98914-30cd-449b-8697-b67cef332be9", "value": "24576:vg12XIkZoY5LRpHdspStssOx5lKevDay7gWtPLlxZ:vgs4kZoY5LpspStsbaevD3g+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772262251, "uuid": "e3b7a7c6-85ac-44ff-abf8-e8d7d94c7470", "value": 1935360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772262251, "uuid": "2d447c7c-81a8-4255-b13a-a1405a01e6a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772262251, "uuid": "bae505a3-af9f-4530-b5c9-6e806f2dd885", "value": "source code of carbanak backdoor discovered.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b982313-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772289250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289250, "uuid": "8bf6073c-7c6b-4a51-a59a-dadca035c371", "comment": "Malware payload (Mirai)", "value": "41af17a50a372f9276aa1c98f8d84fd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289250, "uuid": "7c16795b-7a53-4a43-b11b-72b40bec84f8", "comment": "Malware payload (Mirai)", "value": "bda95274f046e313e9d21e415aa1dffd7892ef83021ed3720fafa78cc331440f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289250, "uuid": "8595f405-34ba-44b9-8eab-024524a71de1", "comment": "Malware payload (Mirai)", "value": "23040078abc06ccd7a6861303d5f9be7610c9c07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289250, "uuid": "7eaf7485-c053-49ce-a1f2-da8634eec556", "comment": "Malware payload (Mirai)", "value": "5c8795f6eb989cbe093bca1a8836f7f5a623a84de9d66afb2ec89e3f5dc6095208837e8df4d3c10454b1c91bb602ed0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289250, "uuid": "9050c922-ff2e-4af3-bf7a-74322cf43cd5", "value": "T1C013F1ACE0587895C6DF2A37C2FC13749EC192E231DE9B19A3218CE4F75571B6D081AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289250, "uuid": "1ae90f51-70d5-4fd6-b4f0-1298d7e0b4b6", "value": "768:SMVKBZ1MsZrNFQG3it9p5cdl3r/sB38FMoru/SexJYIWmQKWc:kPVVi7pkrC8FM8MxS5mQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289250, "uuid": "9f1c92a7-cd52-418a-9b7b-c569cb76d56f", "value": 44052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289250, "uuid": "5ac24b6b-1f58-43c4-a109-7c6dc2940608", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289250, "uuid": "2400f1d0-2b6c-4ecf-bf15-ff76ddd3f400", "value": "nwfaiehg4ewijfgriehgirehaughrarg.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb58d25-146a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772258407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772258407, "uuid": "67ae4fea-4dd4-457d-baf6-09f481013b09", "comment": "Malware payload", "value": "7d18257b55588bccb52159d261f9cd7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772258407, "uuid": "8f1daad9-cadf-4c23-885b-485c805b1030", "comment": "Malware payload", "value": "be590100ecdcae5ce4b7b42f87082e201fcb2f38c114c8fbc6640ad9b9a0708a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772258407, "uuid": "4a1ba51a-407d-4545-8816-de1a102c91d8", "comment": "Malware payload", "value": "a0224db54280e4156ffd3afd97510e351591a8de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772258407, "uuid": "6f079820-40c3-4cfc-9b18-0f6fc091f4af", "comment": "Malware payload", "value": "1974e5ec89edf14d3103afb846fbaf60f53efdc983a3828ea56126e99f95dc415921b46e975f7f5bf3add9286fe6ce7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772258407, "uuid": "13bc8671-e4dd-4a5b-b510-23cbbe25bf7c", "value": "T1F9A7DFF0B654F094E3994621856A76A846332A313741D86EBE9B32C10D393D7FEA1F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772258407, "uuid": "7dbd1d56-338c-45ff-a472-17a9b9ad51fe", "value": "e01037fddb2897d231a72227eede07b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772258407, "uuid": "153463a0-e3e9-4e19-93f9-c90d5467bf58", "value": "393216:dt8ozLIfhMXZZy+MwMzoZG9toN2tgylAYLAbzzeP:X8oz2uk+ooZG9tzt3l8r+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772258407, "uuid": "d8a7685d-d882-472d-a0fa-2ae901ec1787", "value": 45598560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772258407, "uuid": "33265305-38fb-4bf2-a0e3-c0715a43efc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772258407, "uuid": "f83b2433-3b49-4f33-a131-5b006c18c15d", "value": "AppInstallation_623590.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e59b9bd0-14e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772312164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312164, "uuid": "5e60a760-2788-4c35-871d-f685e802b031", "comment": "Malware payload (Mirai)", "value": "15b69f1474492934fcc7bc37bdf4b758", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312164, "uuid": "047fc22d-f215-478d-906c-b164dba27004", "comment": "Malware payload (Mirai)", "value": "be75c36a98af6797dfee6a7cde7b0547b460bae66bc8f37a8a949a91b433cb0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312164, "uuid": "4401f633-6dbd-4101-ab27-461d566fabce", "comment": "Malware payload (Mirai)", "value": "6ca82e373de7f91251be3955d2cb43bf628c11d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312164, "uuid": "220e17bd-963c-43b5-9c46-0dd7b8ed50e7", "comment": "Malware payload (Mirai)", "value": "6da118045ef5881d727cfe3189d50304ef6b0b4cb78a46e3850aeaa93ea5811c7c85e8eec4cc18f13dcbc1ed0c079ae5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312164, "uuid": "08227c76-54fe-4c95-a8c3-f4a5321a368b", "value": "T167E2E178F5ED5815DEA0963CBE2DC956A7AE5D3C60FA2810A1004A3C7D005CE67F4B4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312164, "uuid": "c45d68dd-cd6a-4473-b555-a4658d709fa1", "value": "768:tCHnX1UD7bFKuK+QZ7rS12uByGB5A6J34UqSwxLG+s3Uozp:4W7bm+QP6y/694BSwIzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772312164, "uuid": "e828ab07-1b81-4d60-b564-25ab5878cd0d", "value": 33324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772312164, "uuid": "3285251e-402f-41c1-b820-52902a19498f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312164, "uuid": "b90f9ef7-a5c3-4518-83bf-261e12660f4a", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef13b87b-14e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772313039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772313039, "uuid": "9f12e9a8-4be7-4742-bd85-c760293f8eb6", "comment": "Malware payload", "value": "252f0c1039a90846718bba3aea1876e5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772313039, "uuid": "06128d79-ffe4-4020-9cc1-0477fa783506", "comment": "Malware payload", "value": "bf1330939818d083466cc5f720dd2dd7d0d3ca0513636429806371e378af088f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772313039, "uuid": "9f409871-a353-4012-a0be-b279bdf8447d", "comment": "Malware payload", "value": "6171436af227336a4b59723fd7e1494209032aef", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772313039, "uuid": "01d958f2-2223-46db-a8d2-5b2b8f533fa6", "comment": "Malware payload", "value": "af36fb205cfef373af6785f6e4d5b7491f7e617b57064553845ceb9ca4e729b7199813c19e633a62f9e8330fa8df9dc2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772313039, "uuid": "06c7f383-ea38-41ee-900e-82b434082824", "value": "T18A754B1BE2A385ECC12FD17486679772BA30B85D01347E2F1BA4DB311F21E909B5EB64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772313039, "uuid": "b876e140-0476-46dd-b21b-eb1e42806225", "value": "ac6665f6841c174b2de37e2cd0bc9023", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772313039, "uuid": "b772f7d5-f657-491a-8fd1-baa8c05a38ee", "value": "24576:A5oacJz2HUgkXXRwGX5XVLcmbm2qE524GLD78h4CWK71uTQO/:A5bcJz8UgkXXNX5XVLFbm2vktd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772313039, "uuid": "123507d6-e0bd-4ae7-9abc-4d16f953d3ac", "value": 1618944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772313039, "uuid": "fd7f0ee9-c71b-4abe-8860-2d4af5a53f80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772313039, "uuid": "df5a8e0a-0109-4eed-aff6-8ba24a3569a3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ad0581-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772289232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289232, "uuid": "4d7d79b6-8539-4283-a5b1-e2fc20134989", "comment": "Malware payload (Mirai)", "value": "8448c94aedac14e244368b68bdf76ef0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289232, "uuid": "01402115-b52d-424a-ab8d-42fd47b4b91e", "comment": "Malware payload (Mirai)", "value": "bfd1f0be53cfb0e9a04d243d6e84298b2ee999ac23a217b3a900a209bb3b88e5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289232, "uuid": "864bab50-3fc3-4584-95f5-411c3c85c0c0", "comment": "Malware payload (Mirai)", "value": "7e2a3569c4d79b8275f266d0b6050cd65da1ca09", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289232, "uuid": "82466386-00b8-4b46-b0d4-b3dcd8472598", "comment": "Malware payload (Mirai)", "value": "8caa2c1bd16d098c6e63e4d3a377262312e3956cd74c3efca858bffc861132992e5de59f864cad1b14b45a718c3502f5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289232, "uuid": "405eae89-06be-4bdb-82c0-478c13aaae37", "value": "T187D12DF2B496627DDD9FCC3A9121696D1085AA8B27870E68C7ED307A7C89FCD1C449C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289232, "uuid": "c5d249ae-e8ef-4b78-a2f9-b54d73bbbdd4", "value": "192:ni3mBYnOBqT0p8367C12/Vk7sZxgnAdqPOZwqPOZwJofIFoNwDGvGpiLFUr8JMxA:ni3mBYnOBqT0p8367C12/Vk7sZxgnAdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289232, "uuid": "a30b57d7-647b-447a-b90c-772534d362d0", "value": 6359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289232, "uuid": "1b7b0b79-5eed-4e29-9174-7be4ed9f040b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289232, "uuid": "38cc2a45-305b-4d0f-8a06-12d4742307fe", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c69c125-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772289251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289251, "uuid": "654bd3e7-4706-4ac2-9314-30f30dca496b", "comment": "Malware payload (Mirai)", "value": "9e61fab6c341792417456e05c56fe7ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289251, "uuid": "445c7152-3ce9-47c7-b942-1c9349d115d8", "comment": "Malware payload (Mirai)", "value": "c12601f8c9258a80722b147878d99e10ffe9252bb3373a1b62813b4145ee6229", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289251, "uuid": "479d2c4e-87b9-4d27-8fcb-e167a5b08327", "comment": "Malware payload (Mirai)", "value": "52d4aab91b6c7b5fc81d4a6f8d960cc52458de19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289251, "uuid": "99f9984e-2ea7-4824-8190-cbd4315e00b3", "comment": "Malware payload (Mirai)", "value": "013351e8ace47d2957767ab3c6f874e7bd5fb81d59052f3203588b05c637a537fd525e902e6bf70c0b82a8041cfdb333", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289251, "uuid": "8f4f8d49-a643-43bc-b2df-e5af476f5724", "value": "T14913F21670C7A8E18AB21876FC34955B7E0747F1E0E9B25B3B50EAA8B51100B9BDD40F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289251, "uuid": "ab1b966d-dc0e-41bd-bba1-510425d633e4", "value": "768:e9lVfv3kAytZo/4nbEwkl3rpIFqaRJcvD86BdkkkQpe1NSjR0o3qPHM9q3UELCg:CvUcOEwklirRavNe1o90o3qP1Lj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289251, "uuid": "913da0d1-85f7-488b-8656-f0654fd939bb", "value": 43708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289251, "uuid": "16a854b4-7e94-47a4-8713-bcb5cbd384cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289251, "uuid": "7a197013-9006-4eee-a85d-d33a95949f35", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e8c50b0-1446-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772242708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242708, "uuid": "efab3051-eb46-44c6-9aa9-b3c800221e3d", "comment": "Malware payload (SalatStealer)", "value": "509549242fea583986bcfc794a14b746", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242708, "uuid": "a415766e-1327-4dd6-b6b3-0139446492f7", "comment": "Malware payload (SalatStealer)", "value": "c22e337e199ca24f2e9f5055b60889e7846ad332bc273d6a5e08757c020ff24f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242708, "uuid": "85de19cd-9f98-42c0-b2fe-8d155d99f71c", "comment": "Malware payload (SalatStealer)", "value": "d1f79dbb12d755f2d542e691df244633f9a9fea8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242708, "uuid": "00320a73-8acd-45bb-934b-1eafb1755317", "comment": "Malware payload (SalatStealer)", "value": "82af03466d7cef4050fa56c343a33c4b47f66690c15626c42f22ff2ae8a0cca897a1e202438413cace56800ecfe86b78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242708, "uuid": "b98aa5c0-5ee4-4a64-a56f-8d7b3df44ce2", "value": "T170C66B01FA8B58F5E9031931506BA23F27315D448B38DBDBEB187B2AFC7B6811D76219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242708, "uuid": "d1ab651c-1539-4772-be68-cf1b55a88083", "value": "98304:KzX78oVy1YXPBvPhmkVqcT68KJDf8yTDH:4TVeHDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772242708, "uuid": "9e14fb92-4a13-4f4d-ad0e-0b144a5b6a8f", "value": 12105216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772242708, "uuid": "76f0e91f-c8ce-4b40-9cac-2949416ded5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242708, "uuid": "7c48ef3c-8424-4bc6-879d-6fd6425653f1", "value": "c22e337e199ca24f2e9f5055b60889e7846ad332bc273d6a5e08757c020ff24f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97488baa-147f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772267365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267365, "uuid": "08b34011-39b1-492b-851d-5d43f80b0332", "comment": "Malware payload", "value": "12f2122ed9d725e36c0fd6c6f554277a", "object_relation": "md5", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267365, "uuid": "1bad8b4a-7d22-44bc-b1f3-7db1f3ed6a75", "comment": "Malware payload", "value": "c2612e66a73a4afd5ca62e4f326cb4f6f29aa625920da9fa6bbdde935604b15e", "object_relation": "sha256", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267365, "uuid": "64188b71-7a54-43a3-9dc2-15074c4b36c7", "comment": "Malware payload", "value": "170700f7c2dd28c9e0573ebf83dbf54a5c90f15c", "object_relation": "sha1", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267365, "uuid": "b769a648-6fe2-44d3-a4f2-4f30471e9d7f", "comment": "Malware payload", "value": "c8af1bf41c23cb3638a88953440c4a691538339dfabc3381d4e50cb95438a99b20232879dce28333af61439fff84c549", "object_relation": "sha3-384", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772267365, "uuid": "7fe6463d-64dc-4b19-842c-67f49212a926", "value": "T152235BF21623FD8F8B260E52F40C1012DCACAD633596A4BEBF4445E98AF45189DB4DF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772267365, "uuid": "676304a9-bfe4-4fbb-8408-162d42f4f8c0", "value": "768:BxD6tY7oZjevGj0pIElL/1aQj99++BbgM2jDv3L0rx4y7iJScMGq2+FcXPsEmJxk:v6tSol+vDxd5G0brUb0r+iXPFWEEmOys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772267365, "uuid": "43ab0d51-661c-46db-93a0-48b53e55885d", "value": 48475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772267365, "uuid": "466706b9-1bf1-42df-84bc-231430319a85", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772267365, "uuid": "9b997b36-1f88-462d-b40d-7b7a3f824404", "value": "xxwConvertedFile.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd6c2f2-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772289311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289311, "uuid": "10fcbbe9-a2b9-49bc-80af-1cbeb904a401", "comment": "Malware payload (Mirai)", "value": "18b9d153769c77025fecf53805cdcd5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289311, "uuid": "f9033c69-0389-4b84-9d8e-51ea851866d7", "comment": "Malware payload (Mirai)", "value": "c26b480b9f0fb774dae7670bca56353c4cab139726af13b3064b01e6e8e0688e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289311, "uuid": "a76740c4-9c1a-430e-b50c-c3bea3a1f855", "comment": "Malware payload (Mirai)", "value": "99a2997c02c7f673bdedb03b02633c65054ce904", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289311, "uuid": "b830ef4d-51aa-4087-966a-c8c54e1d2ec0", "comment": "Malware payload (Mirai)", "value": "13c0696d3c382295e84b4b57415b3cf1b700b179943d74a5bb184e85fb07650a666343dab09302c6a1e4a99f2162f51a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289311, "uuid": "bf0afed0-ba06-45f5-b519-785ec1069233", "value": "T16DC3F709EB610EFBE86FDC370AFD070525CC651722A87B7A7574D928F64A24B09F3960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289311, "uuid": "63e7ab66-46b1-4220-a99d-e8a0ac8badfb", "value": "1536:QWeUSZ25Dy5uMePxR0hFXxhrygHW2qDOUu3upoiw1w5ZO2LNEMvluHIH38Njlhq+:QWeUSZoDTR0FaiiwO5dJmf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289311, "uuid": "57192bbf-ff28-4850-a03f-b47c4c22a2fb", "value": 118376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289311, "uuid": "3cb8056c-f60f-4fda-8b79-2660bdac3d0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289311, "uuid": "a94fc465-a367-4778-8573-aa530ef0e8e0", "value": "nwfaiehg4ewijfgriehgirehaughrarg.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30324bc3-14d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772303270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303270, "uuid": "45d3db4e-29b3-41d5-927e-d9cc754f8b3e", "comment": "Malware payload (Mirai)", "value": "4364910e528330572edc0b3381c1165c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303270, "uuid": "477b01bd-80e6-4dc9-83c8-a9d5c820308a", "comment": "Malware payload (Mirai)", "value": "c406e9185645c7a40319fabc9b021021a9acffb2ec23253ec38f161be4fc1d20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303270, "uuid": "cee43a6e-d91b-4e1c-91f3-3794b8704d36", "comment": "Malware payload (Mirai)", "value": "4a25529eb607d090985e15b1962483c268e95e59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303270, "uuid": "4d9cb5fc-2386-4a12-a8a7-44117a1839b9", "comment": "Malware payload (Mirai)", "value": "1e6a10befc36cff04199aa9b71fb2be086457de32aeb31a903a174bea4784fabc4085a07107e6fec0b429ceb8f426f8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303270, "uuid": "53974b64-d00c-405d-90a6-783ad362bff1", "value": "T1123319B51516F2BCE9E22078F40720F529530A1C3ADCE2D3B0930579FFB5B48B96AD5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303270, "uuid": "465e5ccc-786c-4a0e-97c2-01f487736bc1", "value": "768:zMClhMqB0yBuKw3GoACzQyZRtlkABYxQ5TUnRNww31:zF0vZ2oR9DtlksYicks1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772303270, "uuid": "9026cafa-4c3c-4f4b-b753-d285350c0d6f", "value": 50632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772303270, "uuid": "6fd90d47-c025-44e4-8a40-da2d4ead9239", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303270, "uuid": "1d1baa83-c1aa-42c6-aa88-88716e1df46a", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d8a2e39-14a8-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1772284851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772284851, "uuid": "3b356b9b-0aa4-4bcc-8478-843e6a9a0af5", "comment": "Malware payload (ConnectWise)", "value": "3587f8817b7bd393f5bbc15e7f33fc32", "object_relation": "md5", "Tag": [ { "name": "95-216-63-67", "colour": "#FBC290", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772284851, "uuid": "e52621d8-bad7-4e7f-b324-4d061bd61735", "comment": "Malware payload (ConnectWise)", "value": "c5b129b8e492c13d319000df84c55a3d1d15b9d00721102850943b83b1be2a9b", "object_relation": "sha256", "Tag": [ { "name": "95-216-63-67", "colour": "#FBC290", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772284851, "uuid": "db1137c1-b6d6-4a44-8f3f-025d588ae44a", "comment": "Malware payload (ConnectWise)", "value": "90aa5255b2c61bd0ea54263cb6fee1e22ebdc92e", "object_relation": "sha1", "Tag": [ { "name": "95-216-63-67", "colour": "#FBC290", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772284851, "uuid": "2dca7872-c5df-4e70-9c71-30c7e796d9e3", "comment": "Malware payload (ConnectWise)", "value": "f5dd3bf02fb2dd993c6d0eb3c491f31d7b4417a7334fee215542ea9c9c19446f8dc108f657ce515fe442f8ca5158eba2", "object_relation": "sha3-384", "Tag": [ { "name": "95-216-63-67", "colour": "#FBC290", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772284851, "uuid": "c0e460d8-ecf5-484a-b2ea-76da70c32d06", "value": "T1B03623317AA0D139E2B4293DC83AA6F0A56ABD21D673452BA3747E1D3D70DC04A73736", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772284851, "uuid": "25838a6a-6c3f-4eb6-a3cc-cec67eb370f5", "value": "98304:CIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlVIdoaxcp8wy5c3teIk:LHxcp9ym3nltDUJVUHxcp9ym3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772284851, "uuid": "c87bf029-5f27-4379-b9da-c5f41f4870b4", "value": 5000936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772284851, "uuid": "eb74ed28-4db9-4002-a0a6-2076f34386e7", "value": "application/x-ole-storage", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772284851, "uuid": "ff98f81a-7a4e-44f0-999f-79e3f7a97e67", "value": "c5b129b8e492c13d319000df84c55a3d1d15b9d00721102850943b83b1be2a9b.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36eb1d6c-1498-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772277941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772277941, "uuid": "a3f04747-9c3f-4579-95e8-7c850cc15e52", "comment": "Malware payload (QuasarRAT)", "value": "e133cfa2403247675216c8f317951b10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772277941, "uuid": "dc3c8a50-d5f1-4c1b-88d8-450fb06b0f1e", "comment": "Malware payload (QuasarRAT)", "value": "c656b80ba545c37b4a4e5db63784bc119354d728d7bedbfa10a8ae6631f5d165", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772277941, "uuid": "19564503-3592-4b31-a202-15709cc80774", "comment": "Malware payload (QuasarRAT)", "value": "5860062006f850e8e86af07ce2b8640d77c7301b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772277941, "uuid": "ea205455-e5d1-4859-804d-12859a54fba2", "comment": "Malware payload (QuasarRAT)", "value": "10b63e0eff7568562fe39d635805bd8e133d5dd4ba002127086c559112cd0d7ebeac892c35afd6b6546e49d5391e4701", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772277941, "uuid": "9274b3e9-8cf4-48c1-9052-4f9ec3bc9a0d", "value": "T19725E097BC729EFCE1448DB79454E2DE0DBAA3AEC7D21DD2D1B61890826AD30D171B0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772277941, "uuid": "50bc7335-39c6-46ef-858b-e2500953e093", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772277941, "uuid": "1dd2f3e2-4c44-489e-bf67-ccb7ad8defcb", "value": "24576:fCtzZo1iwJpFTnoLqxYXgEu1e4jkw6Hfm8+a:6bolsmxYw71fkP+81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772277941, "uuid": "49f0a68b-2b03-4fab-b7b4-dc5c7e09e123", "value": 1042944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772277941, "uuid": "d650d74a-c218-4884-8da3-1f41d8237ac2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772277941, "uuid": "53bd47ec-0e0c-4f8c-8bc7-974e1deae0b6", "value": "cs2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f476f9ed-14e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772312189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312189, "uuid": "0c8f805c-46cc-40fb-a034-4f4c3ea3d4ab", "comment": "Malware payload (Mirai)", "value": "32651dc9a12f3b6972db2410107fb7a8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312189, "uuid": "cc9ae2e0-c85b-42cb-90c9-a40a2e61e621", "comment": "Malware payload (Mirai)", "value": "c68a8b04afec72d5ef5043e3479160bb8a15641e602c1128e5fac9a5a4fd7bd3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312189, "uuid": "8092187e-cc36-427b-9f3f-fccbc1d80e46", "comment": "Malware payload (Mirai)", "value": "ca3c06dbdab912cd0f533c6725ded17726129837", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312189, "uuid": "b5d45aad-c2b3-4cbd-9b7e-4780c07ca3ea", "comment": "Malware payload (Mirai)", "value": "65ab0dc89d992f155a683d5c53afbfa44d520c873617401148e177a1911e4d937d13c21f8d09062652e808b00151faa8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312189, "uuid": "792d274a-36d7-4daa-b889-494612aa9a03", "value": "T13241C0D4139906B0BC5789AA65FA5C44B4F892D758C44F6A8EFB3CB8414EE0836C07CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312189, "uuid": "d44df2e5-ebf9-442a-9b7a-4fcd0045feca", "value": "48:vPspPlIePgjPnzPmEcPjrPtUthPz7vPvDPyZP4a:vPspPlIePgjPnzPmzPjrPCPPzLPvDPyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772312189, "uuid": "4df59d14-084c-4989-85f2-02a1688fa568", "value": 2076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772312189, "uuid": "5615cfc6-10bb-495d-8fb8-9e3e1492ee63", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312189, "uuid": "162c45ca-36a4-42a9-9996-d29f6d4fa7c9", "value": "update.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4014d66c-149f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772280963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772280963, "uuid": "1fc4fc22-3781-4563-8f05-8cb2d82a8ba4", "comment": "Malware payload", "value": "d1c2e7cf5da2be89b1e9e585a7926403", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772280963, "uuid": "8f1f0c80-5660-4ab9-81ba-66686447eab9", "comment": "Malware payload", "value": "c6b1ba747179ae30c03d474b9aab51ac13e0879a4f1fd648240db773e8d9d667", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772280963, "uuid": "ff116582-ceef-4122-b9ae-ec15e35cde4b", "comment": "Malware payload", "value": "37b6bfb89576b2ff91a20e31fe3c8fa2669b8704", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772280963, "uuid": "af09066e-a173-4a9a-82c0-2b1f591533bc", "comment": "Malware payload", "value": "52911b744fcdd4874cbfc3c8c31c99adc4b912e81d1c57532cebba4cfcc9eed184db6c343bdd3b6052b12c7ce4e0f199", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772280963, "uuid": "cdd192c9-010a-49e9-bb5c-ef25a69f5a6f", "value": "T117F7494262EA04C4F9F7DA359AE65217D673BC166F3081CF325C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772280963, "uuid": "66b5c82b-5c56-4327-81dd-decb6eb73090", "value": "772ec87d3452991a9933a3ba0d9963a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772280963, "uuid": "8565d10f-b17d-4006-8a85-1bc9b9fe2c6d", "value": "393216:Pn1XQgPR2k3m5C507G9ITEc5eAlkLbQurxMWhAsIyNOPS0B4AycWsCYaxFzwW/tR:P1XR7AsxYqt2oRGj5rs3wb8/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772280963, "uuid": "a92c259a-2763-46c9-b4d3-edbfb7fa963c", "value": 71422464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772280963, "uuid": "472d2ac4-1a45-4998-b387-f249a1edec0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772280963, "uuid": "6e060b09-44ec-4127-ac33-1a340db92b0b", "value": "Arcane.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3dbaa50-1478-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772264380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772264380, "uuid": "1d2d426b-04fd-4358-b7c9-a8d869ba18ea", "comment": "Malware payload (AsyncRAT)", "value": "1d228b7c03b52d7c2f3a0a7ed9591d8f", "object_relation": "md5", "Tag": [ { "name": "AsycRAT", "colour": "#4C159C", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772264380, "uuid": "eb1d7d3e-3594-4050-a618-add886c9c589", "comment": "Malware payload (AsyncRAT)", "value": "c7ad4212f6fef10d761b8cfba4019cd89a945f401bed589e39a1db9cbfcd2492", "object_relation": "sha256", "Tag": [ { "name": "AsycRAT", "colour": "#4C159C", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772264380, "uuid": "875e7531-45d8-4091-aee5-7fa5741f943e", "comment": "Malware payload (AsyncRAT)", "value": "18b7d387220ce7e08383ba095fbbfdb461304530", "object_relation": "sha1", "Tag": [ { "name": "AsycRAT", "colour": "#4C159C", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772264380, "uuid": "a3f10f67-f2ad-4bf7-a85b-0de549a92001", "comment": "Malware payload (AsyncRAT)", "value": "46c7687eedaca48a52289875d6161cb5bd7663a8baae6434106116be8e86ea8dd617ab138f1798704e79df25ce6eb8cf", "object_relation": "sha3-384", "Tag": [ { "name": "AsycRAT", "colour": "#4C159C", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772264380, "uuid": "bea22208-de65-456b-9be2-267982d0f076", "value": "T1EBD23A08B3D88551E1FD57B94D7293048771EA5BA973DB9E1FC440AE2A23B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772264380, "uuid": "cadc73c1-af4f-455b-9166-fd0cf7592924", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772264380, "uuid": "b647cf4b-a5db-438a-acc5-d85fa954d044", "value": "768:WuGRXHMMVEo8Yg/cIRGqou/Rb7fB/dTk/+:TGRXxVEo8B1igRbN/W/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772264380, "uuid": "680b69dd-aaa5-4dc0-baa8-a5cc1c056ada", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772264380, "uuid": "dcf0bedb-ec73-4e9d-81ac-2205b711f838", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772264380, "uuid": "1ea8e752-e477-449c-9dde-5dfc6c611db6", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c75a53-147e-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772267101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267101, "uuid": "defe6426-fe24-42c5-ada1-e90e147152ef", "comment": "Malware payload (XWorm)", "value": "4371b75c771b3a802c1c101d962f692b", "object_relation": "md5", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267101, "uuid": "cee62f7e-91c1-4d1c-8188-7a52ea0f8317", "comment": "Malware payload (XWorm)", "value": "c8d653b6011431a10ead8bbac8e4c4f5c29537eeff73609589cbac6c85d7a88d", "object_relation": "sha256", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267101, "uuid": "d88be175-58f8-438e-81c9-74f8b7b948b4", "comment": "Malware payload (XWorm)", "value": "5bb47c4a150add345b3c932bcd6d4fc06bb0e0d3", "object_relation": "sha1", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267101, "uuid": "1a9337c3-233a-4aa0-a621-517d5037c515", "comment": "Malware payload (XWorm)", "value": "fc695b017c50178f94d01c698e3b7328e21deed9d5512ae937a8a429fb83827839de1177e5903fae3a386f89e1b350b9", "object_relation": "sha3-384", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772267101, "uuid": "8a47c912-d5c4-4ff7-9222-57c86bf165fd", "value": "T13C41F7616BD126E0DFD8231F467EADF1E2AC84D636D866CD57853C2CFE6142886F0D04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772267101, "uuid": "82a662d9-b9dd-42d5-ace0-97b670a31ba8", "value": "48:FL1P352xF0KogVdBtUsck3ZIfwYKunarhwMGCc:jPsF0fEOXk2fwVunarmMVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772267101, "uuid": "7d60b6bd-91ea-4239-8fed-84cbd777653a", "value": 1919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772267101, "uuid": "51452977-9ba4-47ac-aed0-d5dd708b890c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772267101, "uuid": "b3a47c6f-da3a-4f42-a9ae-aa314acc5586", "value": "ps1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d59a8aa-14b6-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772290810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290810, "uuid": "89e821cf-0c65-4396-9ee0-4ba3448723de", "comment": "Malware payload (NetSupport)", "value": "2f0204526fc405f8a936e1707ccb8e19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290810, "uuid": "4cf029da-f97a-4d70-bc30-344e9fd3be6f", "comment": "Malware payload (NetSupport)", "value": "c9e5bb7a368280d771edcfdb33717a3130560d2bb71773ab1aaffe0eb585fd2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290810, "uuid": "2a492d34-8852-4dc8-91de-b79076389abd", "comment": "Malware payload (NetSupport)", "value": "df0f2805b1f6a5322e2764dd41815f56ff9d9e79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290810, "uuid": "e79860bd-3fec-4698-9193-467e397266e5", "comment": "Malware payload (NetSupport)", "value": "587952afe0e034ff21ba6a566301be220e12364588d7b875fd35ae69170a35dd15bc60d7a93ff3461af6538ff87997f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290810, "uuid": "aa80d3b2-99a8-42fe-8022-a958d1eab73e", "value": "T176D633A4A6E815EFF9EA933DCC51D992C89675A63B49C193C3F8D1A12C733C4663E301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290810, "uuid": "cca8f90b-d4e0-4e71-8710-e44ebf0d7213", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290810, "uuid": "640cbabc-7347-4cd7-8772-f937d70656c8", "value": "196608:da14oWUoB9qLZBFslHl7dZgnRMWF3y99TisLkuor4+kYurH/P/XRLSq2KKeF:da14FSsFl7dCR1C99/Lku3+kYuDX8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772290810, "uuid": "5a69cc39-6476-4ff8-8a3f-4f0be3527010", "value": 13423105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772290810, "uuid": "7423e784-eb6b-44d9-813c-73ec38d651b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290810, "uuid": "29eb85d4-1bc7-48c1-969f-7df8b78bbf5d", "value": "usa.confirm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30dcb5dd-14d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772303271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303271, "uuid": "f2cfcb09-c512-43a1-a1f8-6adc3b5c9172", "comment": "Malware payload (Mirai)", "value": "4dda99d136605936c269ef9edbbf47d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303271, "uuid": "d43b24b1-4e1e-42c4-a6dc-09b9c230fd5f", "comment": "Malware payload (Mirai)", "value": "c9f1e6d5cb31e4efd65a5a3680df0badfda61bb4646c1af0ded9b9e13836c47b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303271, "uuid": "2049f05a-4501-42e1-aeb5-cfcc69cbe0ed", "comment": "Malware payload (Mirai)", "value": "33bd45355667ffa275a3dde985441056b36b554d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303271, "uuid": "6388edb9-5027-4f7a-9f67-ce56c3218c09", "comment": "Malware payload (Mirai)", "value": "4eb570918617c8bc4c6313980e9234c6decf796be196f0e5bc70e3d7eae949bbeaf3943fc0aa7b1c146cabccaa619216", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303271, "uuid": "c6c58b61-534d-4def-bea6-e6251897aaf6", "value": "T126233A49C703C1F0D8861570507BAB7AAE7AAC325570ED5BEB983A26BC32B11950B36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303271, "uuid": "6c02af50-e3f1-457f-881a-9fdce3bc83c1", "value": "768:sXK15wniDa6PO5+m0h5phjhrJzm3W/NqNl1UJwlAscucuN7iKlkH1GsPK9K:sXK1KIfPk+m0rhom/a9cu5CGsiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772303271, "uuid": "c6545af6-b687-4b62-8ae8-7a89fb211f86", "value": 45728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772303271, "uuid": "42f211ad-081c-4696-88c3-9f7d09552e4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303271, "uuid": "e96b50f3-ed40-4748-b239-be1d32e7c5cd", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d07110e-14e7-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1772312016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312016, "uuid": "ccabe247-7f5c-4a38-bcf5-a9282782c262", "comment": "Malware payload (ConnectWise)", "value": "0e8e20566f9796f8a1e4a1bcf543091c", "object_relation": "md5", "Tag": [ { "name": "ATO", "colour": "#9E8D71", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "www-stattementviewonline-help", "colour": "#C4572B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312016, "uuid": "59edcab1-afba-4179-879e-5b763327164f", "comment": "Malware payload (ConnectWise)", "value": "cc2b74f4fba0b734a5455e521b1cd8d4dd1c13c87114cd407dd3f2a8dff343dd", "object_relation": "sha256", "Tag": [ { "name": "ATO", "colour": "#9E8D71", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "www-stattementviewonline-help", "colour": "#C4572B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312016, "uuid": "37f8683d-25cb-48da-8517-27e1f2d0b372", "comment": "Malware payload (ConnectWise)", "value": "5d193ffc208185cbf86aae98299ea49f33844e29", "object_relation": "sha1", "Tag": [ { "name": "ATO", "colour": "#9E8D71", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "www-stattementviewonline-help", "colour": "#C4572B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312016, "uuid": "68921825-3d91-4c54-9d94-44509d8442b4", "comment": "Malware payload (ConnectWise)", "value": "34d83f2179dcf5119842f9a5590b7ce912f4ad21b43d196119edc0daec5fc055b9a02b6d9e8d2d3a8c571c34df8b1897", "object_relation": "sha3-384", "Tag": [ { "name": "ATO", "colour": "#9E8D71", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "www-stattementviewonline-help", "colour": "#C4572B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312016, "uuid": "52e763ab-83c8-4780-ab82-76c24359f916", "value": "T1F6F633CDCE70B7B89064F8F540A67079F18B6297299B3B387125B75D1C9D08C8D83A7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312016, "uuid": "b46571fe-513e-4d0b-bc01-bfc64c426f94", "value": "393216:yo8bV1WJHAGE7C0uJ0ewcrFas6731zrzF6SE:yVLWJHmU/XuZzrJ6SE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772312016, "uuid": "45c97824-d706-4d63-96ce-dd2a6e410bc8", "value": 15476956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772312016, "uuid": "79988f0b-2de1-4033-af73-ebe496e2037c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312016, "uuid": "945f5478-257f-4f72-adc1-e380948ca199", "value": "ATO.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e4fac97-14a0-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1772281550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772281550, "uuid": "aba9a137-f227-485c-b8fc-abf55f841a85", "comment": "Malware payload (RustyStealer)", "value": "094ae616b16f6bee4ceffbef7bfc5fd6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772281550, "uuid": "a124ba58-fd78-44a1-ac7d-b2e23769d8b8", "comment": "Malware payload (RustyStealer)", "value": "cd5f3b39033e47bbfb251589c8517f717d98a05015277e00817ed391cd13e8de", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772281550, "uuid": "d8940ad4-2261-489b-9642-78000bc0bd20", "comment": "Malware payload (RustyStealer)", "value": "a0099e44b1f4798100c85c82a70e0c47d11ab28a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772281550, "uuid": "e041e852-81e1-402f-a233-2ffd33bda6cc", "comment": "Malware payload (RustyStealer)", "value": "64078f7ada10fb59e7bed4c1883c43afb6957df7457ffe8821ca1ac2248171a6c1d3f53d98b8bc13e2e624064528c874", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772281550, "uuid": "abf4e0eb-0f4a-499e-a789-e4b0e4362aff", "value": "T19AF6281010DA6607FD7EEFBD85DCB6444F7AB2953722FA389B4109E90FD1B08C9429A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772281550, "uuid": "f8b75708-a906-453a-bdf8-c9e3c832483c", "value": "196608:S0c1TXsxrZciO7TQMnCO2NnGv+Lo/qGASgW2dYRIdRBW3Yz5lTcR:SxXUrZ5CTfYpcmnYeRBMo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772281550, "uuid": "336937fc-e899-4afb-a0ed-849a1ddf7d97", "value": 15973888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772281550, "uuid": "908fcb22-9270-4248-9a1f-24a825a61af6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772281550, "uuid": "b3069e4d-f308-4a09-8626-03e93025ee73", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f585e6-14a8-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1772284845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772284845, "uuid": "fe905400-5863-48a8-82f2-01d6aad5ad4e", "comment": "Malware payload (ConnectWise)", "value": "bb8769cef69abb17953c7f5ef10acb61", "object_relation": "md5", "Tag": [ { "name": "95-216-63-67", "colour": "#FBC290", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772284845, "uuid": "486b0361-523c-4676-84c3-99fc5fb1a81a", "comment": "Malware payload (ConnectWise)", "value": "cd5ff6280c82375e9ed17e98b5965d7cc6ec9b4e3614e059b1f775ede7adcbe6", "object_relation": "sha256", "Tag": [ { "name": "95-216-63-67", "colour": "#FBC290", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772284845, "uuid": "fc4aa339-c2e5-4827-9694-4043b317b2b6", "comment": "Malware payload (ConnectWise)", "value": "64043782085a2f0909e1d13978a07a6652f8847b", "object_relation": "sha1", "Tag": [ { "name": "95-216-63-67", "colour": "#FBC290", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772284845, "uuid": "8536dbd3-21cf-4008-b3a6-c44247719efa", "comment": "Malware payload (ConnectWise)", "value": "44ca687b387652b9338bf05f05c3d4e7a723dc1c2778e85ec44a8c187689b74b2105c9389963cc0cab36b35b05dc17b3", "object_relation": "sha3-384", "Tag": [ { "name": "95-216-63-67", "colour": "#FBC290", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772284845, "uuid": "aca1fa83-6f71-4cd4-88a9-e604be1bf838", "value": "T141D622136BF89E67E0B1DB74FF365464A7277E055922B1EE1214790E2F70A8089A3337", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772284845, "uuid": "8dd4d0dc-8528-47a0-9a34-3312cad9af6e", "value": "196608:LHxcp9ym3nltDUJVUHxcp9ym3dHxcp9ym3xHxcp9ym3wHxcp9ym3gHxcp9ym32HM:VGplp7GpPGpjGpeGpOGpEGpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772284845, "uuid": "e29b9d17-89c0-46a6-8d45-c6a2632ad684", "value": 13541376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772284845, "uuid": "35660fd0-9aa3-4dde-b595-cfdfd24f18c4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772284845, "uuid": "d3cf7e0b-529b-476b-b783-13e49519b699", "value": "cd5ff6280c82375e9ed17e98b5965d7cc6ec9b4e3614e059b1f775ede7adcbe6.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ab953f-148b-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1772272277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772272277, "uuid": "7149db96-83f7-46aa-8e77-9df8627b29f6", "comment": "Malware payload (PureLogsStealer)", "value": "00e56c2a8643f9e9468ff8089754be80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772272277, "uuid": "9769451e-8262-4bf8-ad3c-cd90b91b44d0", "comment": "Malware payload (PureLogsStealer)", "value": "cefea254c114e09fa385fe5518fbf1e6310a56fea102fd5ebdbeae7d89724196", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772272277, "uuid": "1a075c7b-9b0b-4404-9625-7525f0c01de9", "comment": "Malware payload (PureLogsStealer)", "value": "6a66f2be1637547121c7971cb0ceefc85a181b11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772272277, "uuid": "92a557cb-0646-4346-9c10-1a5c2d7ad224", "comment": "Malware payload (PureLogsStealer)", "value": "010a36a4c27ec9d282a48971224b1cf7db9d1efb9820dce7a541a2eb47c6a5b7b101f50e9f7a27f0904c2a92096dd0de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772272277, "uuid": "ea0fdf58-1f82-4c9c-ac87-f7015c30b335", "value": "T189D49EE7B2234E24D2891337C4CB994193A59B5665E3F70E318913E624063EFCF4B6A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772272277, "uuid": "b1179139-49e3-4d81-81be-5fe43887a87a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772272277, "uuid": "7610611c-a531-4aeb-9c39-8ba83a9d03e7", "value": "12288:NCCDpr60vun5249eGhsxIKhDSmhD30hXJYMu8EufbyKj9Cw0:VVr6pZhsqKhDBEjYCEKb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772272277, "uuid": "d077a1bd-7a35-452b-8abc-2c010d8d293e", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772272277, "uuid": "ecfee990-9f09-4045-b5cd-643f686736dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772272277, "uuid": "3f8fa3d0-1ee1-4425-a1cd-c2f9773b7d35", "value": "00e56c2a8643f9e9468ff8089754be80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07658841-14b4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772289887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289887, "uuid": "4ac5cfcb-bb29-4678-83c6-9907da490691", "comment": "Malware payload", "value": "d35d7ac73526af87818bc34b8217760c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289887, "uuid": "b17c8594-906a-425a-b596-9387a22e0b67", "comment": "Malware payload", "value": "d19ce80f89099393ca69ad2cddb3b799d5c69f5933f2541b8b262e9d82615d35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289887, "uuid": "9a45d13a-5224-4b3c-9617-e2b4a73ade21", "comment": "Malware payload", "value": "1b1a8687445e05d19278820f2c77f423aa06e877", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289887, "uuid": "92d753e9-77db-41f4-91b7-58f198cf86f1", "comment": "Malware payload", "value": "91bc8a5570c6309f45aec45968af8a275a42a0914b5091103ce7eaa8a2c6cf9deee4e6e58203a3012ef5e32940b14494", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289887, "uuid": "875b7b6b-d8d0-44c4-9ad2-07e0bba7a2aa", "value": "T1C7E58E47E1A370ECC46AC1B0934BB632FA75B4454434BDBB95A4CB313F72E506A6DB28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289887, "uuid": "0e276246-08cc-4032-b2eb-4e2d2b6c489c", "value": "9672c68241368d46e3ea60b53aac03ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289887, "uuid": "e9776525-f26e-46ae-a705-feb3d3eb4b0b", "value": "49152:gHafbLaq5QlgQrDhmKgO5ugdRzxoRbrTC1G3iINij0dnFb9lQFNgDQpC56O2Y9hY:geQl/h9ugrY8SQIh4L1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289887, "uuid": "aaf1dffd-42b9-4746-87de-1596f82a6d36", "value": 3228672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289887, "uuid": "37919e11-196b-40d5-9b7f-27eeb80d7fec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289887, "uuid": "6e6608bf-63f5-4163-93da-18b0f258c8a3", "value": "SecuriteInfo.com.Win64.MalwareX-gen.43342516", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e4d1bf-14c5-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772297580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772297580, "uuid": "980e8d75-100e-4c84-a001-39758cdcb9cf", "comment": "Malware payload (Gafgyt)", "value": "7828132a1cfe9c8bf9066ba388f6c889", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772297580, "uuid": "475c0a6e-1c4c-4798-b777-778b9318cc11", "comment": "Malware payload (Gafgyt)", "value": "d1bb4c74113654b35bc47415ab2b738a29171e12021461e7f2e3e331bc3b6e5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772297580, "uuid": "4bf419b3-a128-404f-b8aa-d633d822de9f", "comment": "Malware payload (Gafgyt)", "value": "bdce9033670d5c896481214f79113a1144494e1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772297580, "uuid": "721ae943-d6a3-4ea7-ad2f-bd68e0c2d9ff", "comment": "Malware payload (Gafgyt)", "value": "d0d1166624e3c0fc75d1d812ee14661d5e6732b33ba04e148fdbfa8bba0566da49ee93e697c72d79ce9cca02bba808c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772297580, "uuid": "80477c82-811d-4405-a7ca-a459b97ae8b7", "value": "T157C30183FAE3D9B1E4474572049AFBDA9734EF2D4040CF53F7197A54A84A6A2282F74C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772297580, "uuid": "bc7dc0ae-ca05-4f04-a46e-9fc112dc2ed8", "value": "3072:rOlNTZa+Ef6jJ5GTQqGZe+2mqKA4p1FXu4WZqHaEmiS4ci:aPGfcbt/ZeBNKNFehq6EmfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772297580, "uuid": "74e51830-3f67-48c7-9100-ed983ef14361", "value": 126966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772297580, "uuid": "ed6330ea-d4d1-437e-8386-0de1a5c593a3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772297580, "uuid": "e2456052-dd1f-435a-8daa-6b7acbb52804", "value": "88296p2ett", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e27e60b-144d-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772245687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245687, "uuid": "2533b05d-3c4f-45e6-93f0-c66ff739ff89", "comment": "Malware payload (SantaStealer)", "value": "fac1de1eb89e8a8c7f4eeeba150c8c88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245687, "uuid": "db22e3bb-ee98-4d84-9877-937d313e75dc", "comment": "Malware payload (SantaStealer)", "value": "d414183672c33968d7377c612e57b15d9cfb89a4f0fc4d288d4639745ca8c81c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245687, "uuid": "a3692b5e-6d27-4744-ac84-8fd923fdb56c", "comment": "Malware payload (SantaStealer)", "value": "57964cff4008d6effc1fcdb92adf0961c2c37c7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245687, "uuid": "8d0a0f28-b047-4cd7-a474-9e7e35231d3c", "comment": "Malware payload (SantaStealer)", "value": "418ae2b088a52b07e2673ff83d55ead413c2a809483f405bbb4af1eec8873a23d1d2da7c02dd3bf8752832575ca15102", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772245687, "uuid": "3c3922ed-ca3d-438a-940a-fd4e1ac3b479", "value": "T1ABF6171020D96607FD7EEFBD85DCB6444F7AB2953722EA389B4109E90FD1B08C9439A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772245687, "uuid": "618823d4-40ec-49e1-b40e-1977d44633ac", "value": "196608:B0c1TVQjp9IuqdsoLCG6u3kE6OxU4chTJDhm8d:Bxqjp9IuqiG6u3kuxZcLhm8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772245687, "uuid": "b9d45419-087c-4f9d-89eb-0d3c766384d5", "value": 15386112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772245687, "uuid": "2cf7d69b-df47-4c24-9274-e18dce22c3f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772245687, "uuid": "497cdedb-bb6d-4a36-9dec-e7c090aca2ca", "value": "Azuro Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "824e57c5-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772289234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289234, "uuid": "8f3eee2f-bdcc-4aa0-b10f-3a7028aba5b4", "comment": "Malware payload (Mirai)", "value": "05d1e7408b4937272759fb58a473773e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289234, "uuid": "f865294c-b0eb-469e-aeb1-c0f68ea6d1ce", "comment": "Malware payload (Mirai)", "value": "d486c6efdba18482230997e2fc3069bbd8c9f0033df69e52f3ee42627600c921", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289234, "uuid": "eee737a1-30da-4fa0-83c2-530d69a65571", "comment": "Malware payload (Mirai)", "value": "60955dd17e83f90dbcce310ed596f7a96e1c68e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289234, "uuid": "2d47e8ae-9783-4ec1-beab-4c6c7bf84359", "comment": "Malware payload (Mirai)", "value": "da4341f48fd4800d9bc6b019a3e234bc674c5157f27de2267909c12b8f3a4dd2c7b308e6272ee42ffbeeefab55c14651", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289234, "uuid": "360b7c95-d974-43a7-8215-98a1a949c9e6", "value": "T14203F12BF4E893CDD25E46F61BB6650F02A4C11931C8A4DB2BC472B95E85BB43C0C367", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289234, "uuid": "cdab5f32-d882-4442-9439-2e003f531964", "value": "768:71CgdkrWdd6T2EueaKYaYQzlw9im06ZMOqFIPs++JayGe4vMM3nbcuyD7UHQRjH:FgGQ2JTKOP9X0CMTMglGeQMM3nouy8HE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289234, "uuid": "86d7a7d2-2344-4b4e-a5f5-2b2100af508f", "value": 40548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289234, "uuid": "f84d6c55-df69-460e-979b-971f113259b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289234, "uuid": "5bb7583e-bca8-4675-9944-8961a166fd10", "value": "nwfaiehg4ewijfgriehgirehaughrarg.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55fe379b-14e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772310635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772310635, "uuid": "4e3467df-9e5f-4257-9d6a-d86ac7d7e037", "comment": "Malware payload", "value": "e48eef84a866491d2928ad7f7cc4eedf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772310635, "uuid": "5114c922-9fb1-4828-ad45-a5af4ffbf4ec", "comment": "Malware payload", "value": "d51ef350ddbc990d6ca77d90b69a3fc7b959f921abc20423268aeefa7e2c92e3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772310635, "uuid": "c7ce683d-b935-4f45-a8eb-4bafc0c67b45", "comment": "Malware payload", "value": "f02f0314c8e31aef8066ae1f6f03fbf0df973083", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772310635, "uuid": "aa8e00c9-bb94-4d87-94bc-1447cc7cc92a", "comment": "Malware payload", "value": "08bb8d22b980307694420b920d0c5ae9e9dcf78f506b4eebe6cb1480e7b65bddb98988799071f11993b9b0d420452fe2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772310635, "uuid": "8db53ef2-899f-4f65-93d8-47e978806252", "value": "T144925CB512896C79FBD1CE39AF3C6F4CADE882C42124A3ADBA0F39215A1166DC70535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772310635, "uuid": "05f863cf-8678-4cac-ae70-3b0d9db24002", "value": "384:yDccuQpWx+BL0SWL0gEzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:yDc8i+BL0SI0vzsP4cbddr7zsP4cbddo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772310635, "uuid": "3d5a9a1f-f0e0-4e54-9488-f25650e0d005", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772310635, "uuid": "a76b796f-635b-40e9-8535-ed91224ce05d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772310635, "uuid": "5333d4c1-69e8-4f4c-a685-377881444706", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a49afd-14eb-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1772313907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772313907, "uuid": "89a9c278-a0e0-400f-aa43-1b4c5f1874cb", "comment": "Malware payload (Stealc)", "value": "0e31c218aae5531505cfaaa78c17c984", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772313907, "uuid": "0aaee6c7-ce24-4683-aafc-bcce03fc3d1b", "comment": "Malware payload (Stealc)", "value": "d78be5f292a9960774dca7a02fb0ae61135ec7e10d5fda0069084cd25d6e3a82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772313907, "uuid": "7e1c4cd8-bb4e-45b9-88e2-cf49655ab634", "comment": "Malware payload (Stealc)", "value": "55d365790f765def55c05a8b47e64ab5a63e3cf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772313907, "uuid": "65cefaff-ce2b-4656-ba6a-e79b04986b33", "comment": "Malware payload (Stealc)", "value": "dfd545353b52ff3264252232dbd92a89abdb7a9445538b610c405c8e296d7081b9685379b8005e05b513b6cb07709de1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772313907, "uuid": "81a38ecf-8b23-4d4a-a15d-c0894ebae186", "value": "T1F0A5062DE366A1F7E851DEBC260C21DAE12949723656C062FF715F05A8F00C29CD9BDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772313907, "uuid": "9b2b8899-1fcd-4ae9-89eb-cf67abc80284", "value": "c2e4487f461edff82f81a902e3e4f0b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772313907, "uuid": "627704be-067c-4dfe-a0df-a48efe86bb1c", "value": "3072:IVXanARWDj69qsMMmiVnC+WaQ/VWajFpEO:IIDj69qsg6nWaUVrhpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772313907, "uuid": "90034808-7269-4a97-b2a0-04e772c5d4c0", "value": 2176512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772313907, "uuid": "ad26acd5-0670-47f4-9895-11d9f0e24815", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772313907, "uuid": "1ab5eb4d-a7ff-4eb5-8ec5-b6cbe3d68895", "value": "0e31c218aae5531505cfaaa78c17c984.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41865ddb-14b3-11f1-a769-42010a9c0008", "comment": "Malware payload (DiscordRAT)", "timestamp": 1772289555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289555, "uuid": "cc73dbad-0f7c-41f2-92ab-462b230a1a4e", "comment": "Malware payload (DiscordRAT)", "value": "e66989dda444394de91e6ff1fea78763", "object_relation": "md5", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289555, "uuid": "d5da881e-d630-4a8f-a556-ac85b70a6550", "comment": "Malware payload (DiscordRAT)", "value": "d7921ef310464910ca491bbfdb233f8db76da514312931a603de3a24d5707df2", "object_relation": "sha256", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289555, "uuid": "fb4b7644-9425-44a5-93be-c0e41251334f", "comment": "Malware payload (DiscordRAT)", "value": "7bb7dce9531a987582ada23cceb69a10a5a5984a", "object_relation": "sha1", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289555, "uuid": "a59f84e8-e194-4e60-b2a5-0bc7825eaadd", "comment": "Malware payload (DiscordRAT)", "value": "117a1beb903bf7edd2d077dcde7a0576d60e681a119d8ae5cd88a1e38610ab817f2a5b3d14993da26bc5060a9bdc592e", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289555, "uuid": "40d2f9d4-4b8a-4992-bf9b-97f8836e4241", "value": "T17373B8C877AD8903FBBF5EBD147141524B72BB17E935F68D088C54E611A2B828C42B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289555, "uuid": "db8d0656-79e1-444b-b465-8ed318fba40f", "value": "1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+nPIC:5Zv5PDwbjNrmAE+PIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289555, "uuid": "1a771eae-a5a7-4f07-9b59-3eafd7472e06", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289555, "uuid": "77d971d7-0e92-4825-9a18-a4887ac7d2a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289555, "uuid": "61bf0e38-2fbd-4f22-8553-2ade32672e68", "value": "articspoofer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2de7ecc-143d-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1772239038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772239038, "uuid": "acb25130-e6df-4b4a-90c0-b2a0d3e83c2b", "comment": "Malware payload (njrat)", "value": "e408019d1e0d8ce0ff2bee2517aa6982", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772239038, "uuid": "d1e21fd1-d460-4f91-b6c4-df8cbeb56d36", "comment": "Malware payload (njrat)", "value": "d875ec9aff3b10d8af93141b42a3a627d695809e16f1cb4fa32bff59b8c5cb49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772239038, "uuid": "b98a4a97-0d7e-4318-925a-cb0e835d2bc3", "comment": "Malware payload (njrat)", "value": "671fe6984989f7be13fc67c861500b0f138a2250", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772239038, "uuid": "c3d67385-8951-490a-8a67-818b36f4759c", "comment": "Malware payload (njrat)", "value": "4dcfcdce0dd4ed9268863aa82d9c6ab21d224249face6465197cea83d170ae0325f6de0a5d75806305244e78de2ca4ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772239038, "uuid": "b2b37c69-5ccb-4c04-a2d1-b94a47e43606", "value": "T1FCA33D0977D28424C5EDA6364F62E2330376DC0B5A32CA0E6AE47D573B7F5834A295F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772239038, "uuid": "399b5099-1cee-4cc3-be8d-666680ddd1a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772239038, "uuid": "521891e9-3e52-4727-8b8b-a24ca6cb923e", "value": "384:ZJ6Nb7LsikZ9zNf/1uyU71evdjsOaP0rAF+rMRTyN/0L+EcoinblneHQM3epzXok:KNf4l1lU71e9FacrM+rMRa8NuGFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772239038, "uuid": "41c372dd-35a3-433e-afe2-98484ed2a813", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772239038, "uuid": "7caa4778-173f-47c2-a3ca-7c6771ab4335", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772239038, "uuid": "da826720-b9ed-4449-8c30-641dd2970bdb", "value": "d875ec9aff3b10d8af93141b42a3a627d695809e16f1cb4fa32bff59b8c5cb49.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d68e9a1-14ae-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1772287508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772287508, "uuid": "442d8051-0917-43b9-9568-1155e3c1363b", "comment": "Malware payload (ValleyRAT)", "value": "0b82b7c4ad21f54e62c93b8976e62726", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772287508, "uuid": "6d5a4458-4054-4b86-bb07-3b0da2a3f0bc", "comment": "Malware payload (ValleyRAT)", "value": "d8ae95705379f6f0233c294d5d9d841ebccb6dae75736aadd0ff25d6d350b9ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772287508, "uuid": "e166e858-3e34-492f-9cac-098b2e498075", "comment": "Malware payload (ValleyRAT)", "value": "027356938e96642c6bbde4c24b99bf78db6052e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772287508, "uuid": "bbaf3e7c-c308-4677-8311-7e184788dee4", "comment": "Malware payload (ValleyRAT)", "value": "78a2ec69583ba3bcbf361a28be904209618fbda49c609f20aed3f184384a98bb4bbcdf0f49519011bc9b9a3ef0c918a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772287508, "uuid": "ad34021c-8312-40b5-8c26-86527dc1bf48", "value": "T100A50133B5E28533EAB640B02E541B469FBFE6320438CC5B97D86D496764DC3E61A393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772287508, "uuid": "e3ed0d73-c852-4f2d-9564-b9d1fc6286c6", "value": "0e652378df288841b14dfee918572556", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772287508, "uuid": "831c861f-d5df-418a-a13b-810ecda3de90", "value": "49152:IAR6pHImCXi45lSevpEiegzoQ49aXZmMAGWaoDuNvaUtDaXmpIW51I:IwI7Wl5Yei1LQ49unkuwUtYq51I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772287508, "uuid": "ee97ba3e-ece5-4c14-b2f5-e650871d2b10", "value": 2247677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772287508, "uuid": "c99d3b5d-19e5-4779-a056-8094e3b299ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772287508, "uuid": "b40ac0a7-2185-44e1-9c4c-3c45e58af8c0", "value": "0B82B7C4AD21F54E62C93B8976E62726.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30260829-1445-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772242281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242281, "uuid": "7e8d1cc6-ce4a-4496-9103-3ab6ca904627", "comment": "Malware payload (Mirai)", "value": "172a4ac778999cc394bb4b2d9fa750ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242281, "uuid": "dd0e2cc9-2d79-4809-afe0-c6d0bdaced4d", "comment": "Malware payload (Mirai)", "value": "d8d6857290df24b7fcf87617f67cb3f13151cbae440aac8189f6d96c8bf74361", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242281, "uuid": "7abcd6f0-7aa3-4a9b-966b-ec87195cc5af", "comment": "Malware payload (Mirai)", "value": "8a63077d5ec4edd9b02eb43e62d01945019b0338", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242281, "uuid": "d37bf779-bb9c-493f-ac16-e815440e74ea", "comment": "Malware payload (Mirai)", "value": "6fa8e1c1459dce73fb136172deca45cb8df85de56216334724539867294eaef7727db13c6220c1e3a955b012629d10e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242281, "uuid": "26c1f316-90a2-4a2f-bcbd-4fbf66b59a66", "value": "T17593D451BC82562BC5E423BAF6BE668D336577E5C2CF722BC8614B217B8551F0C63B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242281, "uuid": "7170389b-6803-4eb8-8557-5a2daba3ef66", "value": "1536:4d+dOKCXt3/NDDkrw24WG1uLatp60EbrT9y3kZcBuA+bYQl:C+dQXt+r6g0OcBudFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772242281, "uuid": "34ffac63-d3cf-4d16-bc42-c2b2b8e54a44", "value": 93784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772242281, "uuid": "725cd9a0-16e7-49ed-a677-b36d3904a673", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242281, "uuid": "16368d79-13fe-4437-86d0-279deda72d7b", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef4fa49f-14e9-11f1-a769-42010a9c0008", "comment": "Malware payload (Coper)", "timestamp": 1772313040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772313040, "uuid": "00d0226a-09c8-4a04-b62d-752f2f7b4513", "comment": "Malware payload (Coper)", "value": "a17b06d4aa39ef2e1f3596cb72cb3911", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "FakeChrome", "colour": "#A5868B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772313040, "uuid": "abdbf2c1-03f0-4b1f-8a19-50d5106bf555", "comment": "Malware payload (Coper)", "value": "dc2a780f6abb9f0ec0a6675f20acb91ebe2a8748297682a59daf9164fbea2ee8", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "FakeChrome", "colour": "#A5868B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772313040, "uuid": "1e9743d4-6480-4ad9-ac2f-60e88677a6ec", "comment": "Malware payload (Coper)", "value": "dd4aefc0c93dee4b63e8271c091eaf773b401737", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "FakeChrome", "colour": "#A5868B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772313040, "uuid": "ade4dbd2-9a88-4b44-83c4-cb7efcef5b6d", "comment": "Malware payload (Coper)", "value": "a0fdc800d9248b2531b5b26efd181771eb326b7ce04fe4a1c263fc64537180ecb791515f35432bc92a5b81719b37a703", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "FakeChrome", "colour": "#A5868B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772313040, "uuid": "18a4d56d-915c-4984-885d-a3fb6a44f3b2", "value": "T1ECD5333FF869528ED9D4E37B98890DBAF071765CD323951E2CA032582E453CFC9249B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772313040, "uuid": "bd50943a-2f28-475d-97f2-c280adc34a34", "value": "49152:8+PmTcc+j4+srCdSgqzVg2ZCXbkKw0/M62vEHGJogKjOAUPP9AWtyus7q/:8+sc14JWdEZpg9pMrvPJpKjOHtAWY4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772313040, "uuid": "8f69910d-2d2f-4002-8169-23f111e4ec3b", "value": 2938129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772313040, "uuid": "2e5fc356-222f-492d-ba57-669f7723eb6b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772313040, "uuid": "0bcc50c7-b090-4936-8e11-833f7c59ca60", "value": "Chrome.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d8755c-1446-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772242720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242720, "uuid": "f30fcb8b-16ef-481c-a672-0f6fd01bd3e7", "comment": "Malware payload (SalatStealer)", "value": "27a27c130d6358a158fd78ab9a8cd892", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242720, "uuid": "477b98fb-f658-4ad5-8111-c8625959556d", "comment": "Malware payload (SalatStealer)", "value": "dd8ef450940be82431cad2513d971176c75365f73089d05b342f35bfaf30087b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242720, "uuid": "8555b434-8087-4138-bd5c-56c98d1feed5", "comment": "Malware payload (SalatStealer)", "value": "1df5b44635681dca3e066a98f94475c362734e60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242720, "uuid": "1d194da8-c6de-45ca-8213-56961e57d060", "comment": "Malware payload (SalatStealer)", "value": "f8b3574fd3f23ff0f3c9e3bdd8a6362ad7982d41398c6f2484ed84c89b588d8237591fdd7e857251f674c6a2f812e190", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242720, "uuid": "e5414a28-810f-49a0-ac51-048f2e92875a", "value": "T197062345F9C35DB6C6A656B108DFB3BAC7356A09041ACEE3DBDD9D11FA2F321190820B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242720, "uuid": "0a776c72-2e9c-493b-a367-de8c5015d4d9", "value": "fc648d00fda0b8c1f218b9e9e89292fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242720, "uuid": "2a1ceb49-b076-4d73-a3ea-b2fd475e9a5f", "value": "98304:afu7hNf7ych+8yFG297it9LAPxwifWl5:afKTTCvFP97it+PeifWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772242720, "uuid": "d2872989-9bf6-4b21-aa23-0c05df11fe2a", "value": 3708416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772242720, "uuid": "b829f7bc-1011-4965-83cc-834878405fab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242720, "uuid": "ebb93204-b0ac-4f8f-b0e5-58b02c581a6c", "value": "dd8ef450940be82431cad2513d971176c75365f73089d05b342f35bfaf30087b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbaff7c2-14e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772312201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312201, "uuid": "7677c831-810f-48bf-9f1a-21366e506407", "comment": "Malware payload (Mirai)", "value": "d4aae3712597358501d0211ab61de9a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312201, "uuid": "2f047cfb-e6ca-4826-b1dc-4bbf9f1191fd", "comment": "Malware payload (Mirai)", "value": "dde077063725c5543d14a1a7f59dcbef10f97919a562859992c27ec96327cde1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312201, "uuid": "223035b2-c595-4685-a0cd-da2d1b00a83d", "comment": "Malware payload (Mirai)", "value": "43b1404bc538bf990566f2984e81ecfdf1c579df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312201, "uuid": "a745ca29-0b35-4c69-a94e-db1d5901a683", "comment": "Malware payload (Mirai)", "value": "ab078f056175718a219be9edb193a5696f2abebe1679e0a93909d6f97c207e783b60f6b27a330aeb407aeb0ab4334bf9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312201, "uuid": "dafbac85-14c2-4646-a0c0-61b90f6b0a87", "value": "T1E9A3964E6E315F7DFBFC823547B74A21A64533D62AE1C5C4D1ACE9012EB0249742FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312201, "uuid": "2ff6667c-99ee-458b-bd9e-9ddb4f8a0340", "value": "3072:I272wLlOiYG+eLMWTVQ25g+QNZTzjG+JX7RPbCZ:tCwwmIW5g+QNZTzjGsL0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772312201, "uuid": "44a619d1-f155-4435-a90d-5e2a27b2c5c4", "value": 105216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772312201, "uuid": "68d432b7-83fa-4dd2-9ba9-811a7917b5de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312201, "uuid": "d4625310-62a8-48ed-aa7d-6c6c91892362", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e36377-14a8-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1772284860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772284860, "uuid": "3a227cc8-ba16-4114-bc84-ad6242ce0d87", "comment": "Malware payload (ConnectWise)", "value": "2bc1b7430c5ec46193d3c20c55824c24", "object_relation": "md5", "Tag": [ { "name": "95-216-63-67", "colour": "#FBC290", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772284860, "uuid": "4f2ec46a-75aa-44f0-b56b-e2e71ba5f8a3", "comment": "Malware payload (ConnectWise)", "value": "de315df2aa914325b306184202abced5f4aac5dc87c680f2f99595c250ceab8f", "object_relation": "sha256", "Tag": [ { "name": "95-216-63-67", "colour": "#FBC290", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772284860, "uuid": "0b127860-b61c-4e5f-92de-60923b7e440f", "comment": "Malware payload (ConnectWise)", "value": "6b6a5791dd87854ee68facbf5359d037d1daa704", "object_relation": "sha1", "Tag": [ { "name": "95-216-63-67", "colour": "#FBC290", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772284860, "uuid": "f2c0809c-d9a4-42b3-949d-3a553d1da932", "comment": "Malware payload (ConnectWise)", "value": "aa613ef156389469fa77635d7211d5e4f7766180b409691c17226e7558e76181dcda64013b2da36471dbab8c369eb5b6", "object_relation": "sha3-384", "Tag": [ { "name": "95-216-63-67", "colour": "#FBC290", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772284860, "uuid": "9207ce40-7f62-4059-9621-7b91201d7719", "value": "T1EC3623317AA0D139E2B4293DC83AA6F0A56ABD21D673452BA3747E1D3D70DC04A73736", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772284860, "uuid": "1d9dceb8-a530-4aea-9d6d-1c24d3bb3fc2", "value": "98304:CIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlVIdoaxcp8wy5c3teIF:LHxcp9ym3nltDUJVUHxcp9ym3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772284860, "uuid": "2487eed0-f3e6-490a-8366-ab121455cee3", "value": 5000929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772284860, "uuid": "b1e4d7ee-04a3-42c9-9f5b-513a82c6bd3c", "value": "application/x-ole-storage", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772284860, "uuid": "997beca6-ebfa-48ff-8345-92edba85d659", "value": "de315df2aa914325b306184202abced5f4aac5dc87c680f2f99595c250ceab8f.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff14caaf-147e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772267110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267110, "uuid": "b4880ac6-8b6e-4a09-8b6e-f3d0d68d4203", "comment": "Malware payload", "value": "a94766fcd2059a2cca8e7a5e33b3fc4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267110, "uuid": "f5ed490c-f9eb-41c9-84ca-1d8e29f0974e", "comment": "Malware payload", "value": "de797c324f42e610eeb38d74e0c21bbf1f010691c7883c0a2cec7869c85086d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267110, "uuid": "e51b2a46-26bf-42f6-abb3-5d4a2ca06253", "comment": "Malware payload", "value": "001e608eb2188b9627e51d4fce1a6bc2bbf6d932", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772267110, "uuid": "5e6e1421-59d9-442d-aee6-68e3945315f4", "comment": "Malware payload", "value": "05f7ede455e4e83bf8669ed049f3cf81d117c6c7896dc1bc841492901270a680261f9914fab97f7d15910c7d99ebda0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772267110, "uuid": "76290208-3251-4d62-8dd1-66eb3594c8d2", "value": "T1AD25D0A776538F21C14A1377C0CF8980A3B99765B1B3E30F758513E219463EECE0A6A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772267110, "uuid": "68826782-9d2a-4fe0-8c1e-58e23610e491", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772267110, "uuid": "10632096-6a4a-4c55-a676-7fc011a00987", "value": "12288:YwqvkvPSlb8gTGPL/t2RRyjQr/c3nK4GQtOCSd/LKmyW28V3atuG6JNlXy:rqvkSl+Pb8Dyj6eK+OL52aK6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772267110, "uuid": "bfd18af2-b779-4123-8301-8a48cb8b97d4", "value": 979968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772267110, "uuid": "2a1c5bf6-aba0-44cc-ac8d-a0733aae59f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772267110, "uuid": "bab23d89-b30d-4ff5-8e1b-a5aa9bf611c0", "value": "ecab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2f5cc2-14e7-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyNote)", "timestamp": 1772311932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772311932, "uuid": "73bc02ab-dc69-4bfc-9f6f-d80f50b6517b", "comment": "Malware payload (SpyNote)", "value": "ca8474f8f59d1d401a02b593e13ae7fd", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeTelegram", "colour": "#FF4C93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772311932, "uuid": "b4baf7c9-4641-46a9-b4cf-0d06538726fe", "comment": "Malware payload (SpyNote)", "value": "deb2cc80a190e73d81758b738bac4e8f0f116b587b07d65ddc8b668f0b89b0bb", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeTelegram", "colour": "#FF4C93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772311932, "uuid": "29c08a00-2e5d-4549-9a65-2f0f8786eeac", "comment": "Malware payload (SpyNote)", "value": "6bffd5e45f1fd3b2a044ad42067dc972b9ccf645", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeTelegram", "colour": "#FF4C93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772311932, "uuid": "9e68e98b-3ec7-440d-9b09-53f4be0e3450", "comment": "Malware payload (SpyNote)", "value": "85f55d68a2fe3f14cf2344c2b6044667640e630cccc359b6cc6256e228ee7a264741f80032838a67eb962b97cd567752", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeTelegram", "colour": "#FF4C93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772311932, "uuid": "53de2cb4-670a-406e-8ae2-a2ec491f8a05", "value": "T1FE26F103FB44CA87E4AA93F66B330DA91A174F28C742AAD30555763E2E771D10DD6ACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772311932, "uuid": "34dc6103-f92d-43eb-9a68-967009675ca0", "value": "98304:W4a/0ZXZBu/JCoWN3do7UwbZAxhymzXzB4Ta0tkhNwIxVb:WR03BIclN3doICy9zu50P7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772311932, "uuid": "6ce17302-cd73-48a9-bb4a-a53f272ab242", "value": 4734418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772311932, "uuid": "fce5a324-1522-45c6-8612-f3d7db4d3532", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772311932, "uuid": "a1f2d658-d88d-4cab-adfe-7df5f4535fde", "value": "Telegram..apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e98cf4d4-14e7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772312171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312171, "uuid": "3dc610d1-81fa-483c-afbe-ae0d05904b6a", "comment": "Malware payload", "value": "58e52ba9d72b0da07dc05070beb1ea4a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312171, "uuid": "cc49d87a-3c6a-42f3-8731-c7a2a5bf0a13", "comment": "Malware payload", "value": "df0ab3c1a608ffe359cf63374dbb09659a82e19d353be675427bbd9bade43b26", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312171, "uuid": "44c7b009-bddd-4f0e-bf18-63fa8b1c2324", "comment": "Malware payload", "value": "5d933f4b02726b53f1ef60c8e20b3a44d4cf4071", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312171, "uuid": "e7b8a8d8-f12f-4bc1-b23c-f076797bf426", "comment": "Malware payload", "value": "e5d84aa48906f358867dcbb6911159dc67d9779e8f1c4bec22b8ff988aa52b7208d203d52f08c8727bbe009cf9dcfa42", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312171, "uuid": "0c692828-b0c8-4de2-8329-1bd3be14cd51", "value": "T100D33CBBDB52602BD3F64BF090FFB3444226F5629702E598F586D81C45CEE0F812766A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312171, "uuid": "a3e44192-57d7-4331-8686-4c55ef4e6283", "value": "3072:9rQBrQJrQ/rQZrQorQdrQjrQprQMrQZrQYrQdrQrrQxrQPrQ5rQ4rQlrQXrQJrQs:1QhQJQDQ5QkQVQ/QpQAQ5Q0QVQHQxQzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772312171, "uuid": "ee20e74f-c31a-4f5c-83a0-8613ed8fbd48", "value": 141285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772312171, "uuid": "8bbfecea-e513-4510-a131-03833513f15e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312171, "uuid": "fe5b410d-26f6-4d34-8050-7605d79c757e", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec0a45f-1446-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772242870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242870, "uuid": "9eafd1ac-066f-45c1-867a-3cdbdfa37994", "comment": "Malware payload (SalatStealer)", "value": "c48c1c0efab4121f44ff2ab5c6d67546", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242870, "uuid": "33d5ec60-a21b-4075-b4a6-6b6e7bac61c7", "comment": "Malware payload (SalatStealer)", "value": "df2ffbaa65f2abfad6793709014189d039fb22effe83d7ceda3be64ed74cd4ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242870, "uuid": "fec2b449-94ea-49e7-81ee-bba595ed5288", "comment": "Malware payload (SalatStealer)", "value": "82035f26dfe551125f9c8262fb4d99c097182590", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242870, "uuid": "0c030ae0-b82a-4d10-b2ea-6213ef500689", "comment": "Malware payload (SalatStealer)", "value": "518ad3dc58432fc7a49d5ac1c3f80238c9f60d03a77c985a09e836c5c73ccca5cbfc82f168f4a2f98f02d3a23e1fb247", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242870, "uuid": "3417da92-66fb-49cd-bb6e-fd071fd42377", "value": "T1C1C65B41FA8BA4F6E9031835415BB23F63316D058B38DB9BEB547E2EF8777811827219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242870, "uuid": "4f4cae0b-c792-473b-b059-84d168d4298e", "value": "49152:87hfWzEY4lPS1q3pj1jksP51of39EAjexcuudVamNp5CWV7v74QRXHYUZolR7/ri:6VWzE8qv/KdVqWVfNVZqoyXt0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772242870, "uuid": "3456c926-e3ce-4fab-8e37-1619f9c7f80b", "value": 12255744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772242870, "uuid": "51e454ca-fd1f-4b8b-89fd-d4970e09ce71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242870, "uuid": "de54a000-1d61-458c-8428-3bf05a9904bf", "value": "df2ffbaa65f2abfad6793709014189d039fb22effe83d7ceda3be64ed74cd4ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc90f5f8-1446-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772242973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242973, "uuid": "c897293e-b877-4cd7-b42c-e6d98cc6225f", "comment": "Malware payload (Mirai)", "value": "fee57fe46bacfa18223a250d51ad8e0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242973, "uuid": "d976f9b7-2c8e-4c31-baf2-60b6514d7298", "comment": "Malware payload (Mirai)", "value": "df85e597f5f153e1f8a92ee9c05a647aee08bb18a98d21ac6e095ca7e445f25b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242973, "uuid": "601ac83a-c92c-4575-9ec1-f4834acdc7d5", "comment": "Malware payload (Mirai)", "value": "3c9605e92cb769f22dfa96fe7590b9b3c5d060f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242973, "uuid": "824fc1ab-70ca-4276-a4bc-0088eb9d5e67", "comment": "Malware payload (Mirai)", "value": "eed80844932a96c3b9878db9f579983d555912b78b0f4a6f90a597f3d907114c98eb2e4db07ccbe5d5710b22949e5b4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242973, "uuid": "c841a7f7-eb73-4d71-96e4-b95d870cd637", "value": "T18C14E916AB550FFBDCABDD3706E90B0139CCA44722A43B3A7674D528F54B50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242973, "uuid": "0ee5ae00-817c-4138-b791-bd57fb773175", "value": "1536:LAJG3zGgblZqCHMw/cl90ajxO29evXt4kMFK8aKbkNZvdyeflUqbj2ZgneDF8HZX:0JG3zxHq1iq0sjnAlN2v6Z1lGJbsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772242973, "uuid": "e243a28d-fde0-4a11-9ca6-3d470561ac6f", "value": 194432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772242973, "uuid": "26cf9907-e341-4e4f-9543-a99bb767c0cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242973, "uuid": "0d864ecd-9d67-4671-b58b-a45714fe35df", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feb39865-14b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772290732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290732, "uuid": "1b926173-2f1d-4779-9ecb-2af6b9110c1f", "comment": "Malware payload (Mirai)", "value": "722c417e427b9584075cb190ff0233bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290732, "uuid": "13700448-0c23-47f4-b482-6396a35904ec", "comment": "Malware payload (Mirai)", "value": "e03aff91cca3efe5c7f9d8c0232f1c4ee4718529d4b6970ab4ab1a102f4bcefb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290732, "uuid": "1ccdd647-5dc1-405b-8d9b-3ac27fe5ffc2", "comment": "Malware payload (Mirai)", "value": "7b28723cf2d51bf32654f964424f549121e17f29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290732, "uuid": "a3d310ef-759c-4b87-a85f-18d5acdda75c", "comment": "Malware payload (Mirai)", "value": "e4b338d869b0ddb37ca43c13a813dbe8b7e02fc7a1db1b2d4f7d1f8c0521870fc5f963d69a6fea42f3375c8d4d129894", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290732, "uuid": "7f52c9a2-a9dc-411b-aa7b-9a579b08de8d", "value": "T1C8138DB3C46DADC8E1498674B5354E781B93B1009A5B1EF95B56C4A39083EECF60E3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290732, "uuid": "3903be73-1084-40f4-bc69-b79cb4f1a656", "value": "768:Ha8wtgoeFTr/WWeaCvME8Se/QTfzogwxCI:Ha8wtriYv98SfEFxCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772290732, "uuid": "86911f00-e799-4d98-ab84-9e4595c5f9b2", "value": 42428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772290732, "uuid": "86e33d38-3469-4672-b453-9ba530eefa3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290732, "uuid": "68650b69-279d-4cc1-a14b-f387f1721d4d", "value": "hoho.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b2e093-1496-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772277139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772277139, "uuid": "9f9dc94f-f316-4287-9dc0-8b4919692e09", "comment": "Malware payload (QuasarRAT)", "value": "c271009273466ad51af6a356f38bd0fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772277139, "uuid": "1b944697-ead2-4d27-95fe-6b54f5e619ad", "comment": "Malware payload (QuasarRAT)", "value": "e0ef6dc2fb7583972095b79f339275112f046a6cde2f4232baa3a6723874d437", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772277139, "uuid": "288f5d19-07ca-46ec-bb1f-eaf89dc15496", "comment": "Malware payload (QuasarRAT)", "value": "2c4824ef86ff867ce24acecf7bcc77b5d3041f35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772277139, "uuid": "2479aafa-0749-42a2-81cf-d6f26e4cbba8", "comment": "Malware payload (QuasarRAT)", "value": "b30c4af09880f753c216f005cf5ed4c204bb4c945796ff7d19890143d2b8c91351b35b80bd3a255ab3e34e1ea04a5a34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772277139, "uuid": "eb1d35db-419b-480d-87a5-a4c6f3378a99", "value": "T1F8F24A09A75CC22FDAAF0E7D79620A2116B2D7511513DBC61DCC39FEBC977018A12B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772277139, "uuid": "3612bbb7-1234-4ab5-9d7e-a5e436c2ed9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772277139, "uuid": "6957a968-6bbf-4de3-a02e-8169e7a63289", "value": "768:pmQZqx1lYcTYbFiAnSSfajEXUXbYC1QklV:p0lY4eRfaYXsbzlV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772277139, "uuid": "e3a6bd5f-8590-4e4f-b3a4-dc057209cff0", "value": 35840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772277139, "uuid": "8d21fd7b-26fa-4a95-88d4-6029fb735915", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772277139, "uuid": "585adb65-4339-4d0d-bf10-5385ad0bf625", "value": "Eulen Cracked.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae0d141-1486-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1772270243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772270243, "uuid": "2841994f-d4df-46cf-896e-d47f800abe2f", "comment": "Malware payload (OffLoader)", "value": "077b2bc3d1e5b8a7d6a50c0b00a599ef", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772270243, "uuid": "257c1b7d-e930-4698-b0b1-89f0aceb5651", "comment": "Malware payload (OffLoader)", "value": "e14ced9a9c2b56400dd98d52b8cf72509ea2fc37d5c96910e384a7b741ec850c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772270243, "uuid": "798e9021-f2e4-43a1-be49-1091887f8d71", "comment": "Malware payload (OffLoader)", "value": "0bfcad5975c9fc5ec0031d94958faf3a3725b7fd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772270243, "uuid": "43571060-3ddb-4a1b-9ffe-a4c9d34fd104", "comment": "Malware payload (OffLoader)", "value": "7d0f4e88e1ef2263a646256e648f56e3586af31fc83df75e6ce858850b0f45a750b714c27a2b7c548061b5babac7946e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772270243, "uuid": "066ebbaa-f0cf-44e1-843e-cd1210c7937c", "value": "T17A961223B28A633DE46E5B3B5AF2D2205C3B6F21651E8C1696F40C4CDF691602D3F667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772270243, "uuid": "b3d1747b-172f-42d2-b0c4-7616142ecb42", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772270243, "uuid": "349ffcc2-86b6-4ebc-b6df-ebdf7472c2d3", "value": "98304:3N66zGMMsR4MM43hFP9MH2fWBD8U5G8I34NU0zgR6aDFB4D0Ry:PddRFPhFH4XovGU0zxaDFBW0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772270243, "uuid": "83b82648-c7a0-4e87-882e-8254128af555", "value": 8666990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772270243, "uuid": "f140475a-59a7-4959-821a-d56310b42eb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772270243, "uuid": "a92a75c6-2ada-448e-88b1-c4396c49b0ad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aaf2eba-14d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772303261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303261, "uuid": "e310b4eb-3fcb-4f26-9be3-4af3d810afd8", "comment": "Malware payload (Mirai)", "value": "79e07128a1f9e03a394e9f7117e46028", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303261, "uuid": "f2acc1f2-2537-4148-b6e4-250e60d0a459", "comment": "Malware payload (Mirai)", "value": "e1a2b8cba265c6141876894e32114362775f90b20d23419fdfb49dda52734cb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303261, "uuid": "7745e2c1-4d49-4eb7-b1dd-e709d8bfd106", "comment": "Malware payload (Mirai)", "value": "021c6b1496408143b69b2e3768808c3891398068", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303261, "uuid": "bd36fec9-957d-427c-a15d-a99ee25345df", "comment": "Malware payload (Mirai)", "value": "cb4eb1d10c2c5b37503902a5324f2d2e351c817a3d5d08ba03ee6a781239f7e846aaa2bdbfdbd134048656bd888fde66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303261, "uuid": "4efb2164-362e-4121-845c-d03f9e3da9d6", "value": "T1AE039E53C93A2D94C63985B4F8219B7E2B53E949A5936FD6D826C274C003F9CFC2D2B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303261, "uuid": "61fb00be-c3a3-42a4-bc4b-423e704efbb6", "value": "768:iTUc2eBs3+EuYG6TKjj53iGP/AEF9AKblZ3ay3VJ5egoS6VnYUvC5YMy3:4D3BsOEw51LFQS2rCje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772303261, "uuid": "4d47a20f-5787-4cad-973e-164a023fe1d9", "value": 39908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772303261, "uuid": "deecec81-5a8c-49e9-b1b1-440157d9c591", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303261, "uuid": "2ff093d7-c6cb-4ad9-a098-946e454c2540", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "114fbf28-144c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772245236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245236, "uuid": "ae7f6a17-becf-441a-97f7-6bea70aabdf0", "comment": "Malware payload (Mirai)", "value": "97ad32720c79303b793b4ba9589b25c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245236, "uuid": "66488161-5ae1-423d-be6b-8a9c05032d74", "comment": "Malware payload (Mirai)", "value": "e42f411a1d4bfec2fe318359da936d33061c822cf3d7444203bff14813ff5951", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245236, "uuid": "003908b8-f9cf-4ab5-af9f-4987056c8878", "comment": "Malware payload (Mirai)", "value": "9bd92e547d1a05e4ea92533ba22e9e25ca38dbcc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772245236, "uuid": "afa24d27-bda1-4c16-9b6d-78fd535171cc", "comment": "Malware payload (Mirai)", "value": "9d77c8cd6d28033b9adf26a650c3cd54c665d6549a5946256a3e57972aeda0d0436d013968eca13f559019e6ee6add7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772245236, "uuid": "ab37210d-2300-4c82-86b6-59f08b2cab2f", "value": "T1ADF31B45F8814B12D5D112BEFE1D128E37231BB8E2DE72129D245F647B8A97F0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772245236, "uuid": "452b92b6-1bec-4b0f-9f13-1e9a7c8c7e2f", "value": "3072:ZcLaYBU6hhoTXubj7I4XaO7PGJ8VGYvDYbY:ZuaYBpQTXuv7IyaIXGYvDYbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772245236, "uuid": "46944268-58d2-4dd4-9eba-f5c7b47285ba", "value": 157596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772245236, "uuid": "a9e16739-8193-4525-b760-9dab06f71437", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772245236, "uuid": "9afdd26c-6921-4917-932c-a240b41f72ea", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3471e141-14e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772312297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312297, "uuid": "de866335-6cb0-4204-99a1-2273f376b286", "comment": "Malware payload", "value": "cb3878dfbb07756f8df16c6b95462d01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312297, "uuid": "fdd96e75-8962-4ad6-9744-057930a2779b", "comment": "Malware payload", "value": "e464d8b40e6838be2a8d4956d59d63143e898da5d1c4da98873405c5742d07e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312297, "uuid": "d99d753a-9084-4352-9d17-da69edd185d7", "comment": "Malware payload", "value": "9fbbe6624a907ceb5ffc4abd3d551cad9730ed86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312297, "uuid": "0394a86e-2088-4391-80fc-a7eae9080461", "comment": "Malware payload", "value": "070604155c4fb21201e5e32cf5297a2c6566c014d8722d820e28625b1ef81e5e8d0bc8db838e071ff8bdd0703647169a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312297, "uuid": "7a012494-ff4a-4883-97d5-dcd1c7046904", "value": "T1054533D2BAC385CFC5F3FB39A414877C74262D695A0712079A6D43B37A19C690B87D12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312297, "uuid": "71cf7ea3-df5c-4973-8c49-4d0fb34c2f72", "value": "24576:dO7EQb5XgACLCKdjpfYnWN+ZPhTUu5UPsDGyMVYNVZW:dOZnWkZP1dUuMVYHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772312297, "uuid": "c17c42a8-2a16-4ee5-ad45-79fab52a7cba", "value": 1250600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772312297, "uuid": "e464fdf1-50b2-4a00-884c-bcde967f56af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312297, "uuid": "cdfb9b90-4c8e-433c-b123-737bf9d69c45", "value": "poop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a01076-14fc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772321155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772321155, "uuid": "b694ea78-1fc2-4053-9bdd-10eee4d52625", "comment": "Malware payload", "value": "05e7be4de1d07d33eac3dd80f6908069", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772321155, "uuid": "dc5574b1-97fb-4d2f-96ff-3ba72c62782d", "comment": "Malware payload", "value": "e46f9f123d9dbecd82ac310d818fccdb0318e24810e9c76b4b4de8339880e0e3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772321155, "uuid": "b1888d37-3dc6-44ad-b14b-20810778495e", "comment": "Malware payload", "value": "54873404a70e5f158d809bdcc10bb0f2b53c0bb8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772321155, "uuid": "e6ebee12-5f5a-4fab-a557-7cc49b75b697", "comment": "Malware payload", "value": "cb98e61dd8ac1e6bcefcafd405f6077a4f328185129707ec5289a9ced291ac61d7ce6e18b5e9952ed31941374a5a2012", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772321155, "uuid": "5d6a4e81-8384-4d16-8156-00909965403c", "value": "T1EBF7594262EA05C4F9F7DA358AE65217D673BC166F3081CF325C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772321155, "uuid": "b0927cc8-8630-4bcc-9b77-6d9fb7d01efc", "value": "393216:jn1XQgPR2k3m5C507G9ITEc5eAlkLbQurxMWhAsIyNOPS0B4AycWsCYaxFzwW/th:j1XR7AsxYqt2oRGj5rs3wb8/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772321155, "uuid": "1f861ae3-27a0-4cdb-bc51-a095cee6c0c4", "value": 71422091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772321155, "uuid": "9ace9a3e-ea82-4983-bae7-2dd4352edc0f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772321155, "uuid": "6cccfb2a-e2ac-4a0a-90df-e90a5b762563", "value": "Git_Latest_Software.v4.0.0.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c0262f4-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772289143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289143, "uuid": "779bb2d5-a749-4dac-a804-eaf5f2f0d610", "comment": "Malware payload", "value": "1887ac3e360bc4bd9c91d320b1487be3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289143, "uuid": "fc6681bc-cf64-4cf0-9641-9437ff4c84c8", "comment": "Malware payload", "value": "e4a06d62b052d1ebf5ee101d2542f870a35d3bc64afb20172c88ece729737638", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289143, "uuid": "7b7a2355-1407-463b-9013-d8b632bb58bf", "comment": "Malware payload", "value": "8e0e210397d67ab437931e65491f648af97e2617", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289143, "uuid": "4d738e88-3799-456e-acdc-23e11c271c94", "comment": "Malware payload", "value": "feb71bef8c42b00f14832495e08df6e97e8c6dabf534d18e2a930763a9ff9d433c2101aff6844d68813ba5cd61ac908f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289143, "uuid": "55865008-4bea-4f89-9af3-5710dc2f9b2b", "value": "T145D3CF4B766740B8C421D3B07AB3C47A5B31F8712622EF3E7255DA344C60E605F9AE6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289143, "uuid": "dec3073b-ff74-4bec-8b7e-176bc4441442", "value": "d0211f71ed6994a21532e888c12d1098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289143, "uuid": "7bb51849-32cc-42dc-bfa9-8003d2649b40", "value": "3072:uxFSU4WdDdJNeTqtxMaEFcb1cZC09gOAOkphD/:aoUnJNBvMaEO4ClFpt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289143, "uuid": "2ab2a25e-87f0-40e6-b23d-0a68c89d622a", "value": 135728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289143, "uuid": "d7d267fc-e614-46e2-a72f-5e8532a40fa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289143, "uuid": "131fba66-d62e-4c6a-8054-fb900722dfc6", "value": "e4a06d62b052d1ebf5ee101d2542f870a35d3bc64afb20172c88ece729737638", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed4acbcc-14e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772312177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312177, "uuid": "35382991-5924-4ab3-9409-4101e6c6eeef", "comment": "Malware payload (Mirai)", "value": "7539c48e367d172f9dcaaf79295cf00c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312177, "uuid": "5c6a97e1-d903-41a8-81f4-f452828e6e2c", "comment": "Malware payload (Mirai)", "value": "e4a8695056cb8312a8fadc12c313c52b38903b89ef1a9cbef75db87e2f21a5cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312177, "uuid": "0ed20eca-98f6-4b41-a5d6-79e04802de17", "comment": "Malware payload (Mirai)", "value": "f11f7959a2d081d5fa1be5b0556f26a3b1924590", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312177, "uuid": "723308dd-eb6f-40c8-aa51-41195afef9f6", "comment": "Malware payload (Mirai)", "value": "cfe40f2e255e762463dfe919c35325fb101d7fc79adee8899c4ec2942c1168546d5a60c39bcdd050c3e2c10b50410996", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312177, "uuid": "a240a265-38b2-477a-9c17-4942391184a0", "value": "T1C0F2E06DE152BCE5CC1C087950CA557B66C1B293B3BCCA5CE311860EB71A65FFB4C8A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312177, "uuid": "3eb3f1b6-2b97-4db7-a059-5bb8e235cfc5", "value": "768:kRAlGU4lDYb3u0zyRL88gFv10HoG7+hnKWg4ur/nXnTgx5+276Wy:kWlhjmRL88Qv1Sc6/Xsx5+276", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772312177, "uuid": "87bed6f0-abff-413c-8abc-6c1b23eadaee", "value": 37032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772312177, "uuid": "c577b967-4a66-4658-8e81-23b0b63225ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312177, "uuid": "a832e5c4-7711-4a29-9484-aa435e7baac1", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d87e918-14d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772303265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303265, "uuid": "d404e09c-7d84-4295-9a0e-3281b50bf580", "comment": "Malware payload (Mirai)", "value": "1f8c42412dc409899a1e015cd4ee8b21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303265, "uuid": "8af6687a-2d89-4f44-bb2d-78d5f87a7b5d", "comment": "Malware payload (Mirai)", "value": "e55e5a3a4e133e342404e45087abc9bc2220a17dc3e23ed30b940f0994d3fe00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303265, "uuid": "9c47da07-f15a-4ac9-902e-e3dcad4fac6b", "comment": "Malware payload (Mirai)", "value": "a4820d2954c42ee4292cba297a57b82ace4e0ca1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772303265, "uuid": "93f452e2-79c1-4bee-87e5-7a881fa3c339", "comment": "Malware payload (Mirai)", "value": "9e205a6f4333c441741439f3430aca8d78dbc4671a5e3a58bb088c6e96a8b8400e08d81a36373aa1d41ab4a21bbf642a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303265, "uuid": "70e2eb96-ec35-4159-93db-5ff5b24db8c5", "value": "T1D553831AAF650FFBEC6BCD3745A91B49349C640A12E93B367934C818BA5B20F45E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303265, "uuid": "1fe7ff13-655e-4d22-9de1-114ebf9c9375", "value": "1536:yGtQ8AKyjOz8lI3DXUAFXMSL3bKL2LZgsF8qD:yM6KyazQqDUBL2LB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772303265, "uuid": "3e390ef4-880b-4368-b0e0-86ef75d29c9f", "value": 64380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772303265, "uuid": "0c97a640-9458-44b6-8161-536f6480acd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772303265, "uuid": "c88653b1-ec37-4546-b7f3-33ce19a60830", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ed4aa7-14a1-11f1-a769-42010a9c0008", "comment": "Malware payload (WallStealer)", "timestamp": 1772282016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772282016, "uuid": "3291445b-acfb-4ed5-b2ec-234ed9fe4f74", "comment": "Malware payload (WallStealer)", "value": "4cd375e418630fe4d3ff7caf08a15788", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772282016, "uuid": "8e6ee862-2721-43aa-adc7-950598a0a374", "comment": "Malware payload (WallStealer)", "value": "e694f26b249050dc0001e48911c1381ebe9308a85e86afce1699d730eaac7b77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772282016, "uuid": "003dbcd9-bb7f-4ac0-9336-00bf3edda891", "comment": "Malware payload (WallStealer)", "value": "f523100bde0ce2dc8ed8b56fbb9a9e8679460b30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772282016, "uuid": "877e4206-4459-4b8b-b7a8-97c04094830a", "comment": "Malware payload (WallStealer)", "value": "5784260a401129033412493a6ea0304c9a09dcec27c7e1bf75f8137e133673a7d39c57c65919beb0a3bc4365432acc57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772282016, "uuid": "cc483ac6-c9e5-40f1-9540-0a06aed1b517", "value": "T1D9847D06E6A504FDE16BD138C9525902FB727C4E47A1DBCF23948AA61F236E09E3F711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772282016, "uuid": "a77ec069-141b-4ae1-9475-a2283b591c3a", "value": "ad84e9bbec1f11ee76f786dbd8fb80f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772282016, "uuid": "75afc16a-7388-4207-8e94-aa34170e7a84", "value": "6144:ZbKtVwDpnCHHi+46FXg6qF1B/zIUkYieBoVhl4slHWinoVHNLXs:FK88HHv463qlzbieqDisxfok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772282016, "uuid": "994dcf09-4bd2-42b5-9ec1-1245651347e0", "value": 383488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772282016, "uuid": "efba5928-d016-4471-9525-2f986f90b6d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772282016, "uuid": "4f8cfbb6-19d2-4659-a5e6-b97359cf2ce3", "value": "AuroraClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa947399-14b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772290725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290725, "uuid": "de9f7acd-813f-4e46-9d1b-9d98604bf97b", "comment": "Malware payload (Mirai)", "value": "bea2f70fc08e3a564deed8113c39f127", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290725, "uuid": "ad3acf31-0b96-4aeb-b7ea-98660884e32f", "comment": "Malware payload (Mirai)", "value": "e7e71fa4f2ced7c3ee250f444b2a3b01920556d99157046c2c2ce6f8002a53e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290725, "uuid": "dbbb9691-9f26-4220-bd2b-6ed983da9c8c", "comment": "Malware payload (Mirai)", "value": "0da1ebe158b54e1dbf59c08ed8436be76aa56bdb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290725, "uuid": "4d68512b-fa5b-42e1-b554-a46850461280", "comment": "Malware payload (Mirai)", "value": "ee132770e2eb3df39178e59543c37b8e844d93eb197479ea2f99302faa25973ac2b4a895df0fb2c9dcc466ac3bf73e6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290725, "uuid": "6dd360c0-2e1e-4d10-9fd5-639bd8d12de0", "value": "T1B4E34B46EB418B03C4D62776BAAF42453323E754D3DB730699186FB43F867AE0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290725, "uuid": "71785ad1-645c-4f39-a32c-07f36cb194d2", "value": "3072:xXauWh1lYBji13soFxh9inXBs+ZQ8M/9Ii/:NaNh1lkiZsoFxh4nm+ZlM/9N/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772290725, "uuid": "8eeed6f4-8483-42e5-8cd2-51f6a5d3acf1", "value": 152235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772290725, "uuid": "a1847a0b-1aa0-43f0-a84a-92d998f4fd36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290725, "uuid": "5f55d635-5194-4080-bd30-238c555ddf99", "value": "hoho.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "483d4a4e-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772289137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289137, "uuid": "9b46e722-1265-408c-8370-0d31b6949f0b", "comment": "Malware payload", "value": "aa6e437e6935c2f2b5c9421d18328500", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289137, "uuid": "3cde9ea0-729b-4614-9d8b-2718746e423f", "comment": "Malware payload", "value": "eb121d2684a2f515f433af54b25a068ab11e10c1e853bb78f1d963030b0babbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289137, "uuid": "fd0a1ef6-7e3c-444e-b22a-fae5998f7e55", "comment": "Malware payload", "value": "f1f8617c50f5b633ec4cfbc7b43ad4521e7ee028", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289137, "uuid": "a74e034b-26c5-4894-b281-03a6fda698be", "comment": "Malware payload", "value": "63acbd38b79d5573d6b16a14b2356bb6c64a4d2c13240b7b4aa3fc2d4c0940868ff4950d36b6af72ea13d87bf4856770", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makeneg458-workers-dev", "colour": "#112279", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289137, "uuid": "fb72d2d3-ae10-415f-8075-3be80857572b", "value": "T188D3D04F7263643CC061E2B466B3CC36A771B4A60121BF3E9295EF345DA0EA15F59E2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289137, "uuid": "126d9ae7-1b68-451f-931a-f2d7403b4d94", "value": "d0211f71ed6994a21532e888c12d1098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289137, "uuid": "6ccd6578-de77-48c8-a7d1-9d08ec8fd19a", "value": "3072:GnfCFSw4tYanhKJjaWbnyZ7zBQX89c/CIGL/CCFFpVtc:GnaowtNJvyVBQX7CT/CC9V+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289137, "uuid": "c51c013c-85da-41c1-b62a-595d7823514c", "value": 136752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289137, "uuid": "8ec02f31-fc71-4d06-8ef4-23c3188f32d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289137, "uuid": "bf8eb196-c13c-4d4e-8fb7-ec497ef50c2c", "value": "eb121d2684a2f515f433af54b25a068ab11e10c1e853bb78f1d963030b0babbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d0a60a6-14a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772282756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772282756, "uuid": "8cdccd3a-c8e3-4559-9d3e-c9ac1dae9d0e", "comment": "Malware payload", "value": "dcd12f4c2e7c8222ee989b65f4fa4dd0", "object_relation": "md5", "Tag": [ { "name": "luckyware", "colour": "#7632C2", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Source Code", "colour": "#26C326", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772282756, "uuid": "1cf437f6-8733-476f-9ad4-9ca8f1e2a329", "comment": "Malware payload", "value": "ebce322282a51d1010217733cc3a98f07add3e86913d91118bb5854cdd5d0dfc", "object_relation": "sha256", "Tag": [ { "name": "luckyware", "colour": "#7632C2", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Source Code", "colour": "#26C326", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772282756, "uuid": "2def22df-85b7-421f-b9fa-0556d7552023", "comment": "Malware payload", "value": "afad7b1411eb1ddbc9ff8bae86aadc1f82c70818", "object_relation": "sha1", "Tag": [ { "name": "luckyware", "colour": "#7632C2", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Source Code", "colour": "#26C326", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772282756, "uuid": "189449b9-6550-4fec-8dca-d1f53680b229", "comment": "Malware payload", "value": "22e19fde45f4a0adbd43d33d1464780b0887cbf89e746262fa33d4b250eab435a7f5c04aef8fd1912ebcad57e34589ad", "object_relation": "sha3-384", "Tag": [ { "name": "luckyware", "colour": "#7632C2", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Source Code", "colour": "#26C326", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772282756, "uuid": "cd61065f-aaf6-4182-94aa-0cf87097985e", "value": "T118873304B1865FB2CB315AB92A864710E3B903A6E159F067FF15633C5BC94E72F1F24A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772282756, "uuid": "5fca6e89-033e-4cfe-9d18-24b600f2814e", "value": "786432:UBYz9q6Ds6hCO8IAZ7cztFFaloHzXpETGBK5URHCN7Q8M5WvzffjB/YoP:UEc+lCLIQCtFFal6Zd4URiNvM5Wvzfff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772282756, "uuid": "a3ccc468-3059-4394-8f4c-41e6b1425565", "value": 38172309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772282756, "uuid": "c4f48c32-f52c-4c43-86d4-20ff0981c99d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772282756, "uuid": "e3390d16-0c02-4b03-8dd4-7fd8bda7b338", "value": "Luckyware-main.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1c9ea9-1444-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772242060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242060, "uuid": "56f05c4c-ad71-43be-9852-75e588a27ac4", "comment": "Malware payload (SalatStealer)", "value": "06f6f441810b14984ce126a1329ff814", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242060, "uuid": "2ee1a8ce-c73f-4e51-a40f-83d704c4ef7f", "comment": "Malware payload (SalatStealer)", "value": "ede5bcc1cc03aaee0f49572739245c249dc04d7875cedbb1572a574f34defcbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242060, "uuid": "13e2eb4b-df56-428a-a694-5c23a0748893", "comment": "Malware payload (SalatStealer)", "value": "228a026807bcbc3ca9384e4bb145afcce8a581d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772242060, "uuid": "479d1332-2b4f-4385-988f-9bcef225ba94", "comment": "Malware payload (SalatStealer)", "value": "2356dbacef161be06f4f9a383d0e3d0703531140be48e1a131c3452b8238c646f53184e80ae822790b7101ea0c5141da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242060, "uuid": "4d87941d-336f-4cbf-8005-0bccf5d010ba", "value": "T187C65D41F9CB56FAE9035831416FE23F23306D058B28DBE7EB143E2AFC776921966605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242060, "uuid": "38b6c1ae-5c14-4e54-857e-d5d99c1d2478", "value": "49152:12YIlaSGKrnlYj/QjCQ7oQwVzW+2rgxtc1d/VY78IoNS70R44cikOOHFohcKwyfv:6QSGK2j4/UQG8Dc1Kw3VMbUOwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772242060, "uuid": "da2a3f5f-bf31-4b05-9b1b-65ed42ca898f", "value": 11851776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772242060, "uuid": "6caa49fe-f26c-4bff-85d6-fdd3c364517c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772242060, "uuid": "e4480658-8c45-4ac1-a5ee-ce68d8dcb8e8", "value": "06f6f441810b14984ce126a1329ff814.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a9f240d-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772289248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289248, "uuid": "e7d46575-0f03-4f84-8fee-38dc5be9e361", "comment": "Malware payload (Mirai)", "value": "8ce2e1146bba53b0a38ae8ddd6b55731", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289248, "uuid": "b5768629-d507-49e1-94a9-d5c9f545c382", "comment": "Malware payload (Mirai)", "value": "ee8db174593f16dade2933f2dabcddbe8b6aec77b1cc1bd2c76f5e70d0d9fd1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289248, "uuid": "76f5330d-4728-4448-bb6d-14619ff81895", "comment": "Malware payload (Mirai)", "value": "ce068e67348b8294ce6b2e60930aa2793d25306a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289248, "uuid": "2e958d67-8214-4a4c-84eb-dd561b83f325", "comment": "Malware payload (Mirai)", "value": "adb6cf08a2adbf810a549d6a8b8e427016c1aa07d5a56bbe8458cb5feff1d60a1132eb30c4401d00067d533d36a894ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289248, "uuid": "7b3307df-fb5b-4145-b9b2-48b3f03b0ed2", "value": "T12303F14BF399068ACCFED13564A4A62E18E2DF09278D38C1D544496EFE09BB9C4F8790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289248, "uuid": "d65f24f9-8634-4122-8f70-0633d1b5adb4", "value": "768:DN7j8iMu1qKEMkbKgLcYXYIaMTclEeFltZQ0LfzQHlTWEV5ZjZ2nbcuyD7UtQRjJ:DNn9NzExbKgLcAYIaMTclnF1FLKlTzVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289248, "uuid": "982f5fe8-7376-447f-93e8-50d90fe6b3e4", "value": 40304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289248, "uuid": "868f1205-77f3-4e3c-85df-88f83f42052d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289248, "uuid": "17f69649-7e04-4d35-bbd0-549b6f18bee1", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1f9b84-144a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772244394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244394, "uuid": "7b4af482-dcf9-49e7-8b30-8ae80de0d1e1", "comment": "Malware payload (Mirai)", "value": "40ba4ee867cdcc6bd89948e9e8216286", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244394, "uuid": "c29e92bc-4f40-44a5-98c5-0448824c2d8f", "comment": "Malware payload (Mirai)", "value": "ef33007cf9a51c8eb1e84b8baa7b8db021fabcb746c123fe0162a6eae4148186", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244394, "uuid": "d72a81fd-7b7d-4825-a491-ffd1e5af7e6a", "comment": "Malware payload (Mirai)", "value": "99c57f18b48721b02de4c49fdb130713de9a5ecb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244394, "uuid": "e9a26d22-8e47-4aa1-8135-2565c404119d", "comment": "Malware payload (Mirai)", "value": "0b85467e9024927d2ecf74a729dc7cd286ba954e8897d6859285eda047d67073291c6591a648971f87a627330c576933", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244394, "uuid": "9e7ec5c3-504c-4305-b71d-6d8d67da5a52", "value": "T188B339C1BA43D4F5EC1641306177F73B9A32F0791239DA87E7A89E327C92A419D0A39D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244394, "uuid": "170bd7ec-0c94-4d4f-9fc4-a8cb34d540c3", "value": "3072:PbKW4dCLFaGFBu3/45g1rcV2wezSr9bMFfln:Pbj4doYGFB0/45gdG9uln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772244394, "uuid": "4606d73e-02b8-472a-bc99-33b57e25079b", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772244394, "uuid": "9da05c80-5cb6-4c81-a228-8b0abe8ba589", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244394, "uuid": "199ad283-ab62-477c-b2f7-3af651243bce", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b00186-14b0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772288381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772288381, "uuid": "afce2a58-316d-49fe-a7fa-b8dfc8576c62", "comment": "Malware payload (Mirai)", "value": "13be3a5f657cf7c4dc646e5be2abbe3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772288381, "uuid": "108882af-5617-40a2-a718-aa3ead0ea02c", "comment": "Malware payload (Mirai)", "value": "f09b6f5b34b070fea926dd9cf377626d2cea79e8d23862bce34e4a477b7e5485", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772288381, "uuid": "fa0ca06d-f74d-485e-a7a3-8397a8702250", "comment": "Malware payload (Mirai)", "value": "d7d1f4025b9b9e7871d3d4cc9c79d64654a1ecef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772288381, "uuid": "84577119-d712-4006-bd85-1fa4cd69a0ba", "comment": "Malware payload (Mirai)", "value": "3b7b0d94add677341425f4db1bb9f913e316cc15cdd85c7c3a64f65549cac85a9abf8e91faf33b0ea41e24e50266d8de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772288381, "uuid": "b1c32ea0-499f-40c5-8624-4b681c8bc75d", "value": "T112E31A45B8405B23C6D622BBFB5E42CD372A17E8D3EF720399216F21378695B0D3B646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772288381, "uuid": "7db61cb5-c2be-41df-9e79-35be8580a6bb", "value": "1536:e451+mp2YK6lmoTu3mbMAFxvWMf338uApPm4VKpraTWzqsN/OVCOk8q2lEWKr+g+:e451NtMErOwn8ub4mG2qsN2zsWMBMLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772288381, "uuid": "f4279705-17e3-418f-bce4-aecd05644664", "value": 150304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772288381, "uuid": "d85ce4ff-49c3-418d-bdde-08f6c8154b62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772288381, "uuid": "4f9d3c15-0e90-498f-a4cf-2cd5af0ba918", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f21c1f3-1494-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1772276398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772276398, "uuid": "ce87ba89-ae45-4532-8735-95fc19a85785", "comment": "Malware payload (RustyStealer)", "value": "103a648eadd067ae42c853264e0851a2", "object_relation": "md5", "Tag": [ { "name": "pw-KModder123", "colour": "#9AF50F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772276398, "uuid": "66ad7388-bbf7-428f-9c6d-7c3156a1a54e", "comment": "Malware payload (RustyStealer)", "value": "f10d4f6c5e41e9c6e60259022ea43341959d5a699bc20999e871bed643a8d42c", "object_relation": "sha256", "Tag": [ { "name": "pw-KModder123", "colour": "#9AF50F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772276398, "uuid": "3a6420e5-341c-4227-9f7f-ca21c7f8d094", "comment": "Malware payload (RustyStealer)", "value": "e59873fedf5c2859914e01e5929d0a6f0e14922f", "object_relation": "sha1", "Tag": [ { "name": "pw-KModder123", "colour": "#9AF50F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772276398, "uuid": "141a9215-6aea-4615-8575-385a52e7a390", "comment": "Malware payload (RustyStealer)", "value": "d028c21da97d60d6b301879b0ff35de01bddab5fcced3ed1f17be542d9fb5a0200744317b1d9cd9f2e7810a472c35a42", "object_relation": "sha3-384", "Tag": [ { "name": "pw-KModder123", "colour": "#9AF50F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772276398, "uuid": "540803e0-50f9-48b3-a058-3732b06513cf", "value": "T1477733282577CCAC1D1CC5BAABA50BD5CDDB7BCC64EB025700B8558200792A779BF39B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772276398, "uuid": "ba3b5fd6-3ddd-4a16-be52-67aae7f020c9", "value": "786432:a22MomviDeneqH33JxjnOUrrq7OGBXGPvRG5sIlH0XrKvN:a2jv/n3Hpxz5rrGBjfx07KV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772276398, "uuid": "67a6a191-1adb-4f49-855b-9e2a2b8debaf", "value": 35032448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772276398, "uuid": "bad82cb0-63ad-4116-9754-88876108e047", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772276398, "uuid": "57d16ee3-45d3-43a4-9731-76a82a7b8060", "value": "KModder.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cece5649-1494-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772276478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772276478, "uuid": "fb855736-c2c1-4c63-bf45-636f75db05d7", "comment": "Malware payload", "value": "fe24d819670bf4c8658671edc1c5a5c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772276478, "uuid": "353bdff4-9a76-40fb-8d20-614643fe7bcc", "comment": "Malware payload", "value": "f150d72c05a6bfeafa3d458368ca2d0cd02966a55a891eec1360984fcbb44c1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772276478, "uuid": "feedc829-09b3-4fd9-81bf-8cfc30756f83", "comment": "Malware payload", "value": "2939926723bce42fcf3361d9b462b7f574ae7003", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772276478, "uuid": "bd8112e1-4916-4864-a252-f6c85d2503ae", "comment": "Malware payload", "value": "3a00208bcb53b1494a25da4cc1a25af87a336d9fa9ec70064757b940125cb90e34b287a2c721d77fa0ea299a46bb70b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772276478, "uuid": "6da37ccc-d41d-4e69-8eb6-9d62e5417ff3", "value": "T15EF25A65A3E40FEEE5BEF7B6DA71A125467A3D238B30D2CF0124169A0DB16D06D34F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772276478, "uuid": "fb7e330e-f357-43a1-a2a2-3c2f65b6d615", "value": "0bd61aeeb19ac6ef39fbf8af285137f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772276478, "uuid": "8c99a6e7-2e3d-4b5f-8e77-737843a10518", "value": "768:qTCTqKkHjg6giZPnT900BlBONhecXnt0PJUZtVlvVD:bpkHjlZ/JZBqbnkUXpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772276478, "uuid": "0b7d3965-f2a6-44ff-ac07-62a4fd73275b", "value": 34304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772276478, "uuid": "4c16a05c-dddc-4698-bfda-c696f5ec34cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772276478, "uuid": "499fca1e-a2c9-48a3-9fcc-ee1a9818f3c6", "value": "KIRIGIRI.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9608011-14e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772312197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312197, "uuid": "accba467-e287-4e90-986d-bf39085d771c", "comment": "Malware payload (Mirai)", "value": "0921e5526e076d57f8b4221cbda64a19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312197, "uuid": "10a5b351-ca64-4bb0-ac81-86c8651c7172", "comment": "Malware payload (Mirai)", "value": "f163f10f3eb7f1ecb431bc7254a3bf5c0ac3cce4bd9ae385a0f78cf8ad52255b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312197, "uuid": "e3c5e54c-e8b4-41e6-8832-b342429fa0ce", "comment": "Malware payload (Mirai)", "value": "7977932a03e5e65874698657c9df95aeda9bb74c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312197, "uuid": "7086f6a2-514d-4fb4-bdd0-1090db6966da", "comment": "Malware payload (Mirai)", "value": "9b4097ff43056a0821ee4e6a4edda571561935a432c06957bd87bb37aa2f82efd8a229e03fcf087f11ff03afb9b9e1e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312197, "uuid": "e4a5215a-bfc4-44d9-a405-5443a9cec17e", "value": "T1BA735048F928673EC7E172FFEB5852CE733A1B88B3DA71259E32465637C8B54A425130", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312197, "uuid": "66a82e5c-e63f-4095-a733-a69cd890a21b", "value": "1536:VkKdPoHiL3Bh13o8bOjEFWskDxFSTUNXEDxaifSQy0:VoibOj1skDxFhNXfiny0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772312197, "uuid": "3e0af973-4652-4229-b6a5-c7e624da15b7", "value": 75975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772312197, "uuid": "22862807-45a4-4b49-8219-5a158ebb6ae4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312197, "uuid": "99b7c95b-c00a-4e92-b9a4-3f31a3cd182f", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2d62a6-1441-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772240557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772240557, "uuid": "bf6a9e0a-bc72-41b1-82c8-f59774e73095", "comment": "Malware payload", "value": "6570a665d493fd6574be0167f3a19363", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772240557, "uuid": "45dd89ab-2d59-40d6-8c6b-728fac9bade5", "comment": "Malware payload", "value": "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772240557, "uuid": "e17b9a37-24c7-4ee8-b79a-20758bbd2fa9", "comment": "Malware payload", "value": "6f9a7f573d591c0e3e0d0cccc7a51eac7d98a585", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772240557, "uuid": "22a53f01-5bb6-42b8-a489-48db28b66dc3", "comment": "Malware payload", "value": "ebe90fb1be69dfb21b79c4e2dbec9f815cc77d28d9e77e13c672d46046aaccbc1e25943f9f222754c904906781b0b06a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772240557, "uuid": "698b8d7c-805f-48cf-ad75-217c33ce8e7c", "value": "T17A854A07BC9555B9C4AAD2318A665292BB70BC980F3123D73B50B3F82FB27D45E3A354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772240557, "uuid": "bb7cf29d-3420-4fed-8fe6-6276e605a3bb", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772240557, "uuid": "0dfface6-fb4a-4b2e-93c8-bc49569c18c9", "value": "49152:00MDpF0egrb/TxvO90d7HjmAFd4A64nsfJCew2r5gCYPCBgwiz1xu2:vean1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772240557, "uuid": "d42af9a2-8aac-47e7-8a51-fdb277f6f30b", "value": 1828145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772240557, "uuid": "ec27db22-b8c7-4c3b-b563-18c9e30fb1de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772240557, "uuid": "c7f775cc-0575-44fd-a8a9-5fe91c9b401e", "value": "z2vvi96y.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a2af8c6-148d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772273383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772273383, "uuid": "2a8693a5-ccd7-471a-8166-dd97e48141e7", "comment": "Malware payload", "value": "ac030473809f3d109da9cb72bd25a0db", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772273383, "uuid": "51f0f4ef-90f7-487b-a8e0-b65dff926ba7", "comment": "Malware payload", "value": "f3d7fc0a8406001eba44760832c23f6097ee27e183fa4a0c95d7b96962d6c9d7", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772273383, "uuid": "5a6e4f46-6e52-4fda-a74a-e391382adea4", "comment": "Malware payload", "value": "bb586b4e59e153c14b66f58be63f180c0b9d827f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772273383, "uuid": "76dd34ad-707c-403b-9ad0-ed50876031b6", "comment": "Malware payload", "value": "7f8ed88fd9009d7c09f8c033264c2f59242817cb0ecb08b9ab00f2ff7c88577090ebcb2be1862fe5e9bc725dd24fa5f9", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772273383, "uuid": "e94b5910-72aa-4bcd-ab1d-d6df8d753968", "value": "T1D8F5D757ECB940E8C0EED575C626E223BEA13449433433E76FA19A601F56FE0B6B9710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772273383, "uuid": "f00e0bfd-cca1-4ae2-a5a7-0b1bb357ca22", "value": "49152:TPeFAnNAmrXguU8sJcsi1KcF0ZNHHMhWvmfesKEvut1E0iJoJtyjA6:T2tzY+NvvbsKCCN4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772273383, "uuid": "23cfc25e-31bb-4a2f-8042-e5ca6c497416", "value": 3639987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772273383, "uuid": "31fa307f-77bf-4058-9923-74325e390250", "value": "application/x-ole-storage", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772273383, "uuid": "d842ae83-8ecc-4200-8c32-e8e90ba930ac", "value": "5a9e6e0a.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "372fdc2f-144a-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772244441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244441, "uuid": "f07e29bc-695e-4ba6-8933-2b419f754c49", "comment": "Malware payload (AsyncRAT)", "value": "718af4aebf82c36fbde47481d3d73e85", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244441, "uuid": "63c069dd-c7d6-46b5-8598-b5e7bd62dc20", "comment": "Malware payload (AsyncRAT)", "value": "f4e25989b6feff13ef9c9175c09cc0e4b0515e91da1b13bf4283261d4d8d8746", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244441, "uuid": "2f86b101-98a5-4895-8a8e-9ff431fc344b", "comment": "Malware payload (AsyncRAT)", "value": "0570f4505fd08f0d83bb3dfe4c6e5a6118c25bcd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772244441, "uuid": "9075b479-c7e5-47a4-9627-664f5f27b53b", "comment": "Malware payload (AsyncRAT)", "value": "bf9909b104118901637d4da648c19cca337d4b657a37097d85edb259a8fac5f6036428bb401bd0b4acc3d87a0c542e96", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244441, "uuid": "5ddd0beb-5a6a-4fee-a8ec-1423e772a743", "value": "T190F423229467BC3AC72B9130BAA6C27BC737D3F17A5E8925135EE5317FAE0423639414", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244441, "uuid": "238288ac-761c-4501-b051-96be08f5ac73", "value": "05aef0bd2a5a346cf7b29eefc9bc31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244441, "uuid": "dab312a7-428c-4964-ae16-ddfed3a68377", "value": "12288:vp/3+qAPN9rU82uRpSHKJaLzaMuOKRiUTHHof8DLNIf2lbLAW23rewE0vrWR:vRqPN6YRY5yMuoNf82eNkW2benwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772244441, "uuid": "d7f2ae9f-dda5-4cb3-8c24-a717f5fb0747", "value": 769024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772244441, "uuid": "f339b2a4-0ce2-4be1-a1fd-268a31e6f065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772244441, "uuid": "7d1bf458-0050-4c6c-bb23-7b2165f622c0", "value": "ultimate_test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e827fc4f-14e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772312169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312169, "uuid": "163b45dc-8ec6-47b5-b85b-345631eb1319", "comment": "Malware payload (Mirai)", "value": "63fcf71fa74080535413679aa4a5bbae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312169, "uuid": "bf43b7f4-3984-4330-9784-53ba6a7fed4e", "comment": "Malware payload (Mirai)", "value": "f56a8b969702c6e14fd6be7fa8b680273814c41410525cf514664d097554bc91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312169, "uuid": "cc0e3fbb-3eea-4e11-a7c0-b60a012130c5", "comment": "Malware payload (Mirai)", "value": "2704f5ddc0950285c6b33a3b01db65df33aeee8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312169, "uuid": "8d95be1d-9a94-4d86-ad05-e33dd9ffe7ab", "comment": "Malware payload (Mirai)", "value": "b6efb05a87515514752c31686f886c9ad7fd711b9457552aa703f12dbf4b0cf7b7e5604f345eb801c969a2b33a0d4d8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312169, "uuid": "09feffcf-9337-442e-bea2-c947e42c9e0a", "value": "T17EA2D02145135861CAB67432BDB8C3997EAC9B7C91EF70662544875CBED30823BFE24A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312169, "uuid": "f8589a12-369c-4b29-bde8-e46e240fe467", "value": "384:gypI/By7+nZXwZpTEwXqWhwSIOLqcric1mZ4Ghl3AHF2o7wh7qmdGUEpiaEO:gyv7+nZyVhIIJrB1m3/Ako7w9q3UELH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772312169, "uuid": "1d8d5cd2-6bb0-483e-9af2-900b6e7a9c06", "value": 21700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772312169, "uuid": "0eb55ac8-4096-456b-96b5-540c0c655b25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312169, "uuid": "10d96b1b-bda0-40cc-bd48-5a8f1c035a79", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ac77d8-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772289297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289297, "uuid": "18ce0ba1-83fe-41ee-a8e6-ee32a96042fb", "comment": "Malware payload (Mirai)", "value": "d4a97d2c5ceb7a11e41715d2f9b239cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289297, "uuid": "f9cb437b-0323-44a5-ac41-fe0f91d8e648", "comment": "Malware payload (Mirai)", "value": "f67ddc1877424f9729c8ff95046f55559cc68e2a68ce20f7b1c38041e4d7e26e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289297, "uuid": "fe0a854e-d9e9-48ba-a1e5-f542725a2588", "comment": "Malware payload (Mirai)", "value": "f39405dd8ed5347e9fd63a9113adc2bcfef5b63c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289297, "uuid": "49b7e27e-76e0-4ce5-9aea-2e2c062ad9fd", "comment": "Malware payload (Mirai)", "value": "dcaa6be82803ef7de6a18b3d7c5a97d2bfe8c8bc96b69d7cf5a8b70c523685406db99165bbb61a009338d0743e7b0cc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289297, "uuid": "f9c8f554-2c7f-45de-a22b-13fb4520d938", "value": "T105736CC2AB47C4F4EC2605716077E7328773E13E1029EE43D769AD36ED52A41A62A3DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289297, "uuid": "e2fce394-31ce-4f37-85d3-5a032ee7ff8a", "value": "1536:dbwcQ0p+cLBZFQKP+Nmv23PkP98U755e+Kj+i:K0VZSKP+cv238PO0Pw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289297, "uuid": "c679a65f-48d3-409f-b895-3fb46b9561d8", "value": 79504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289297, "uuid": "09346ae7-b373-4976-b741-c8a20b5b57bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289297, "uuid": "ea08ce1c-9350-414c-9cb7-86c25b6ee1ed", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "446cdbcd-14b3-11f1-a769-42010a9c0008", "comment": "Malware payload (DiscordRAT)", "timestamp": 1772289560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289560, "uuid": "dea17d99-fdae-42c6-918f-625c9151161f", "comment": "Malware payload (DiscordRAT)", "value": "4c4b20bf28e050b0b49d9ccdfce68590", "object_relation": "md5", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289560, "uuid": "bdba8ffe-3384-4a31-8eda-07ca93699dcc", "comment": "Malware payload (DiscordRAT)", "value": "f73dcc879aa2d1b6ccae766201f9e24aae547258838bfd1200b4a51b9ffe0b23", "object_relation": "sha256", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289560, "uuid": "b018daf0-ff7e-4824-8e18-48dc8a81422d", "comment": "Malware payload (DiscordRAT)", "value": "e3d95e863064a839b15d284260202e9c44da391f", "object_relation": "sha1", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289560, "uuid": "d21879e3-7b04-44a9-8dd1-f475daca4984", "comment": "Malware payload (DiscordRAT)", "value": "6c4afb2ac1bd8bd7b9505e5abea7df2458c4784ab65f858f391f70ad4b5d8a2cd18e2955a4e0a2514c97088c7632be1f", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289560, "uuid": "4d944786-b446-460b-ab7d-c5aee5312a0b", "value": "T11273B8C877AD8903FBBF5EFD147141524B72BB17E935F68D088C54E611A2B828C42B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289560, "uuid": "8af391bc-183a-46f4-b2c9-5ba18e1f4f58", "value": "1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V++PIC:5Zv5PDwbjNrmAE+6IC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289560, "uuid": "93c22b2e-a87d-47d9-8f3a-b9710628a908", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289560, "uuid": "1fbd77db-86e2-4557-9969-45903fb5d94f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289560, "uuid": "3a568cc9-c93a-40a8-bcba-7534274fb6be", "value": "Client-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1113f2be-1484-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772269287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772269287, "uuid": "1e4b14a8-6224-4378-bb57-610a246e55b8", "comment": "Malware payload", "value": "89e4e95a23dd7aa33c9afa7bea3a70d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772269287, "uuid": "2ca4b3c3-723a-45b4-a012-0d22a4f81547", "comment": "Malware payload", "value": "f79efc8a7b635cc8a56185f067d93b6a77cea63a7820d73068c7a6f45adc7626", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772269287, "uuid": "6a4fd541-f885-448d-8798-afc4ffa156e7", "comment": "Malware payload", "value": "3bd5cefcfdd9ed8977c8c68890391d7119e12fea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772269287, "uuid": "138a3699-8b6b-4644-adff-c59793c9ab5f", "comment": "Malware payload", "value": "d144eb1e9219dc6704ed4ab16868da227f8f13a0e7e4a688e09c4a491a438829f7fbf2ab700a82f9dec7255e22848b0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772269287, "uuid": "68bd9c31-60dc-4ef2-aa29-2737d109e10f", "value": "T1EE422B4EFE218DFAE9ADC278883B014EF076B71AA35153CB276C50152FD17D06A1D6C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772269287, "uuid": "f44eaee9-d28b-4c80-a535-cf32567e08dd", "value": "adabf252301b1bdb6f562574734ac07a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772269287, "uuid": "bb5d0129-c5b5-4bcc-aa87-301cb0b3c8c6", "value": "192:4laIicOesu8/0P2EWkzfPj6nY63Q5tfbgIsh:GAcHsud2kD633Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772269287, "uuid": "2e102714-e16b-469f-aa7b-2d17c7842e9f", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772269287, "uuid": "d9cf0dd0-1e9e-4164-a57a-3a16c68855b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772269287, "uuid": "b273449e-4f47-4b88-b0ee-874d7889434c", "value": "MBRKiller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0989857f-14c9-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1772298910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772298910, "uuid": "6c57eb6a-7133-4656-bad7-6d633069e81e", "comment": "Malware payload (ValleyRAT)", "value": "0bd36daeea529db2664aaba1e68bc43e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772298910, "uuid": "4bfb92c6-ffa4-4567-b6be-214e2dec1a83", "comment": "Malware payload (ValleyRAT)", "value": "fa047153c00510a6e55bea4c1aaefba5c29db6c58969ff8d3b7cc234abf28d4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772298910, "uuid": "8fead4d5-afa2-4ec7-b00a-2cd808e12f45", "comment": "Malware payload (ValleyRAT)", "value": "17d262233a764abe106c283787b1f77a415ff77d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772298910, "uuid": "72c5d2e3-c573-40c8-8363-bd76939a82ca", "comment": "Malware payload (ValleyRAT)", "value": "3834e46727cce64cf319244954e51a778649d82173db0f940bbbe06c755d4c0dc5189ca106888c6716b086394c12aecc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772298910, "uuid": "8fa6240d-5021-4b2d-a8aa-d4f97285d30f", "value": "T18CD37D4733A450F9D4A78279C9A25A06E7B374660735A7CF17A086B62F137D0BD3A331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772298910, "uuid": "ed9edc9d-630d-4f7a-9441-aaeec63547f8", "value": "fb51ede541a9ad63bf23d302e319d2a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772298910, "uuid": "84561732-be95-469f-8059-55fabe9fbad0", "value": "3072:lO55k/y5dAj+BMTYlgEQnB+Y+pek7+3OrFZeUqe6oO:lO5n5d56TYZQnB+Dpekyyqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772298910, "uuid": "0a538260-fd33-4867-bf7c-bd050b9995a0", "value": 133632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772298910, "uuid": "a0950f48-f742-420e-9679-134114632aa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772298910, "uuid": "4642e596-1f36-4b89-b516-d90fddc96620", "value": "0bd36daeea529db2664aaba1e68bc43e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f92840e1-14b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772290722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290722, "uuid": "fe273f9c-483e-4564-a7f8-63f19bdd2ab0", "comment": "Malware payload (Mirai)", "value": "1fe998e32f8b9cf5a865a39902671451", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290722, "uuid": "d7d07e3a-3512-4cb7-ad2b-d9c3d7e70968", "comment": "Malware payload (Mirai)", "value": "fb63b653ee78cfab2a4d845f659372870e1fb5f6d4f0970bdbad1b217f2d6d84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290722, "uuid": "f279b43d-93b8-48a3-951f-a69aef408b34", "comment": "Malware payload (Mirai)", "value": "d3f6611285b760b9196cb9cd6f751fc4c0d8fb94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772290722, "uuid": "c2e9b60a-1d70-4f00-bd5b-9b027e2e8a83", "comment": "Malware payload (Mirai)", "value": "45ab715d7403e59236538ab6f249749778be67e7b30e9c667c828b6fc8e69bcb226caa3c82ab68edad2da2d14fc244a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290722, "uuid": "0318f0c9-7d31-4d8e-bc00-eda26bc6cbd3", "value": "T19E53931ABF650FB7ECABCD3745A91B0524CC640A22A97B357D74D828F25B24F09E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290722, "uuid": "5f18f6e8-a4d4-4ef7-a521-0e018ca8fe90", "value": "768:c36Q/QzskV8B0wRwgCUYQaqZNg6KjPlD0Ie5egceD/wg6DDXiiMUPyf:cqsCsI8uSBkrxIlcE/wvjP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772290722, "uuid": "788075c5-ac3f-4d1c-91b1-8715a8b0b63c", "value": 63644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772290722, "uuid": "6c390e89-2239-48a3-a360-81815ba49fa5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772290722, "uuid": "eb6ac481-c0a2-46e9-bb6e-1d7b1fbfbbec", "value": "hoho.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f05fd629-14e7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772312182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312182, "uuid": "0129bb16-e6ca-4401-aa61-4daa773742f9", "comment": "Malware payload", "value": "04f1eb0ebaf71f827da7b1c4656960ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312182, "uuid": "dd9f2e39-1dbe-4d35-84d0-e732c1c08d57", "comment": "Malware payload", "value": "fb91de5a3ce80ac51fded1719dc72c6c71acadc65ada3262e7bc74dac41cd65a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312182, "uuid": "d734138b-a982-497e-b6b0-a55dd167b041", "comment": "Malware payload", "value": "4e8466ed384dec05aa8f524eab12aa5b723ae919", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772312182, "uuid": "bbcb9ba4-4d41-4df5-9687-6af470976874", "comment": "Malware payload", "value": "e52d23383b3b60c0bd819238f0d9243562906d832b67ec3abf9a5b4a6d739532fd4ca7b8d89b4d534a4ed05e0a18719d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312182, "uuid": "b0b19d2d-84f9-4556-9485-92935bf39ea0", "value": "T1D276337677C06CB2F19C1A39CCDA7E566632FAA09D55582FF0ACEDC76E1A000905C6E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312182, "uuid": "f84305a2-f9c3-4498-92ae-785bc923f750", "value": "ad1a33bd97238a4adf5548ab2780abe1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312182, "uuid": "ac6b1c96-b346-4c66-be3c-4ef5a0c93a29", "value": "196608:g6T3C4LnVV1KlHGL+av/BeK59dnR1T8cbs3noJo:DTS4Lb1KlHc+av/Bem9/1YcoYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772312182, "uuid": "f182f48d-e232-48cf-9e75-1d79e01d42d8", "value": 7797127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772312182, "uuid": "d7eef28b-ea3f-404f-82f9-c0c75aca8458", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772312182, "uuid": "557211f3-8fa3-4563-b4ad-4cacfec4c5c3", "value": "remote2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09f307c-14b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772289285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289285, "uuid": "74caf5b6-48c9-4f34-9a25-d6c25d9caaf9", "comment": "Malware payload (Mirai)", "value": "7bd81118cc86874d0942bf954ad01f1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289285, "uuid": "d564147f-3d40-462a-a132-2d5d2a47bbfe", "comment": "Malware payload (Mirai)", "value": "fe67a3cf09da3b20aaaea549cc8a5800e89e53569e45c7cec20d89843cf6d068", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289285, "uuid": "8fa693a1-e067-4402-aae6-56829690309c", "comment": "Malware payload (Mirai)", "value": "9adafacf85a657383c90908314070f57fb0b0d3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772289285, "uuid": "da2ddcb0-28ef-4ac5-a173-d79a5fbca7f9", "comment": "Malware payload (Mirai)", "value": "50b87b60e61ba69cb4ec604959145eef18ca995545e6447b0bf290e3c9f5b95bcafc4b15373f012f52a1d98e837b089c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289285, "uuid": "b7d2d67a-3a9e-41a8-a493-f99d05fede07", "value": "T1ACB3C81E7E218F7DF768863047B34B21A35933D627E1D685E2ACD9041F6034E285FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289285, "uuid": "2783c0a4-3811-43f3-8908-a528a3418991", "value": "1536:jTkwHlCS4RqbYLajrSdBizA1KW5rLRCNW2MOg2TakewrlHDSbABwT:XH8ebpjc1KW5rLRClMO372blT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772289285, "uuid": "dbb6c491-842c-47ac-ad6e-af709c114428", "value": 114280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772289285, "uuid": "90586ebf-e947-4e02-a0fb-e6776c2221b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772289285, "uuid": "de9cdeeb-6f2e-40d7-8959-db1320f3c4a5", "value": "nwfaiehg4ewijfgriehgirehaughrarg.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f40d0f5-148f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772274116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274116, "uuid": "b17a7d57-a84a-492d-9e76-bd8f07770b2e", "comment": "Malware payload (AgentTesla)", "value": "24db8212966c9a0ed14570594ed2443c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274116, "uuid": "3752c8c4-ab86-4f0d-a190-4d012f5baa3e", "comment": "Malware payload (AgentTesla)", "value": "fee7f21f0069f983c1840d6efb6abd268c8b22e8b01f1afcbcedbbdcc48d12af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274116, "uuid": "ceed1d39-9b9b-4a2b-bbff-a7d9901d1f1e", "comment": "Malware payload (AgentTesla)", "value": "a9664a07c02020bce7766f62cb99108c15f4e518", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274116, "uuid": "01804d7e-957c-4a5c-8a3e-bb1b0d13a9c8", "comment": "Malware payload (AgentTesla)", "value": "cc6c74d45efe6600b982b8a508d38b2f6444b83203a7fcffef5a33eefb86d0683673f613f7d17d8ac3177cae07f72cc7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274116, "uuid": "45c45d39-0e40-480f-93c3-3f1682c32126", "value": "T14A55AE0433E41BBF436B5F7A292C88B794B40A4D90C297D8FB5398F92F82E84D59F195", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274116, "uuid": "ed3d57c6-4018-4ea6-931f-7532e1fea4f3", "value": "24576:vkJgLpoIae49RVkqvKb6paEEVCe0K46j1:cR7a9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772274116, "uuid": "d17af5ec-df76-46f1-a05c-9e02f0fdc78f", "value": 1352683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772274116, "uuid": "09b0c241-63f3-4154-b9b7-d1807cf68beb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274116, "uuid": "83ae1b17-c860-48a3-aa4a-0e3e0a771e8b", "value": "24db8212966c9a0ed14570594ed2443c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a53d6f-1490-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772274416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274416, "uuid": "ac83f24f-e7ef-41ae-9bba-db1e24be4775", "comment": "Malware payload (RemcosRAT)", "value": "7a44131145250b5e0873103136f3bbe3", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274416, "uuid": "3f10edf3-f07c-4632-967f-15a8988de2f2", "comment": "Malware payload (RemcosRAT)", "value": "ff3b454c53b41c997d0ffea6eb74f4863720ab81a9c059ce9fa8fb2cee519278", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274416, "uuid": "eb42d8d1-7027-4611-a8e2-46a705153ecb", "comment": "Malware payload (RemcosRAT)", "value": "19389e8b05838de1c204fa6d1a8f9e9ac828dd49", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772274416, "uuid": "66edec20-a427-4294-b32c-d0886be01bf5", "comment": "Malware payload (RemcosRAT)", "value": "d6c49219341229bafdd1ee6cfece6ed851eac03606b66ab3fa0586fc8149f5d8bdb720f1e838d3d9ff9237bd1c9dd992", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274416, "uuid": "8e9ff943-e392-481e-be79-5fbe281db4be", "value": "T12EF242217D163D88CB834A257E44C8593FDE7BE0F4A7B07A81C6178998AE9ADC70CD71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274416, "uuid": "46034666-9975-44a0-b5ba-55450a880a40", "value": "384:hTT5CH/iCassRNb++/5V11WhvXM0W0x5vzK6IlHDdE:hTTP3sC++/vWhvM0W03vRUxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772274416, "uuid": "5ea031ac-5b58-43ad-bf57-41a8499e33d9", "value": 34729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772274416, "uuid": "59f2fca0-f21f-49ad-b6e3-4cfe6a6c327a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772274416, "uuid": "4e4e6acb-e255-4030-a4bb-eef2aee49944", "value": "7a44131145250b5e0873103136f3bbe3.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }