{ "Event": { "published": true, "date": "2023-04-07", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-04-07", "timestamp": 1680912182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "b5581b42-b6a6-4ae3-a8b9-c30a0a635295", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8e299c-d564-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680886519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680886519, "uuid": "0bd9622f-7721-4755-8818-17d402c05177", "comment": "Malware payload (RedLineStealer)", "value": "9abbc04d1c9c11d018214ec30143928a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680886519, "uuid": "4791dd2d-5b49-4052-9001-dcbc91ca65f4", "comment": "Malware payload (RedLineStealer)", "value": "01b2e5bedaa0dae6e06eaa0fb655fe2097861751d88329665001469d27ba800c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680886519, "uuid": "6e0d9e46-9ebf-488e-93f6-039a197b8579", "comment": "Malware payload (RedLineStealer)", "value": "468e202bff82ee2b6ff4e4b3b52f2aed97255ca8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680886519, "uuid": "888d6157-00e6-4ea7-a812-17882feca5d3", "comment": "Malware payload (RedLineStealer)", "value": "302286f458a3d45699bb11c6532001bcf54f9ed9cb5454d4ead4baeb04a8d4276e9128eb001449cf30e12cd4e96ecc4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680886519, "uuid": "c7b86f4c-099c-4828-b101-46aff7633e75", "value": "T1B254F6A8171FEFB5C6DD05B4CE3171132AB40D0616426E338D7E3E5BF9A9A8268C5F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680886519, "uuid": "9253f3f8-ecd5-41bf-b065-504dd9e32f00", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680886519, "uuid": "7e0e8f1b-6aeb-46a5-b142-9f5d8dad5dea", "value": "3072:/bG7N2kDTHUpousn4rzpFQX7mYR4DPk+aSF4Yw/TfaLNzr6L/pmAXvv1eg:/bE/HUknQF6X7mYCDPkK4YmqX6Thfv1f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680886519, "uuid": "ee7914e6-ba2f-44bc-8b74-9850e5b2822f", "value": 278813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680886519, "uuid": "3d06b011-a5ad-4bb5-8021-0ee1a57cb05f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680886519, "uuid": "83e96485-fc9f-4232-b0f1-a3b4b3f7fa22", "value": "01B2E5BEDAA0DAE6E06EAA0FB655FE2097861751D8832.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f81694-d54a-11ed-88f6-42010a9c006e", "comment": "Malware payload (ModernLoader)", "timestamp": 1680875346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680875346, "uuid": "e8008899-77ab-4f79-9455-e3923b5baa01", "comment": "Malware payload (ModernLoader)", "value": "1d14d8570f63755cc54720da54bd51a3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ModernLoader", "colour": "#2CE23B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680875346, "uuid": "b8db6749-071a-46c3-95eb-85371ab1a197", "comment": "Malware payload (ModernLoader)", "value": "0276c7cb84718b072f43be1600d93e1fa488cb8b35efdf443bafe074f89c1c20", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ModernLoader", "colour": "#2CE23B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680875346, "uuid": "6d6b65a0-a7b1-4480-8750-6e922a6b40d1", "comment": "Malware payload (ModernLoader)", "value": "eec7607d6c9788305855adbc0dad3f99813aa743", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ModernLoader", "colour": "#2CE23B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680875346, "uuid": "f323d546-5264-4af6-81cd-1a1324ce1b3a", "comment": "Malware payload (ModernLoader)", "value": "e3fd22a6676b3414649660633104b029aa8f46b7121c2c52608bf1fd730fbe798df5b892886156f77102f6ba9f84d299", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ModernLoader", "colour": "#2CE23B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680875346, "uuid": "26f2e94d-d4dc-432a-8308-361ea2fd3cc8", "value": "T17B23C28C69D3A458923FB67F630E9D54F0590B27054A0E87B87DD070EFB2664B392DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680875346, "uuid": "51055e19-98cb-4b52-b4c9-d268a40ebfd9", "value": "768:ndEmCNkCPaEbFz7dQ939FriE7S9XOYQ6JSAAz+FvwnmVoMZ2ccg4dK4UdVbCfvi5:ndE7uFriE7S9+YQ6JSAAz+FvwnmVoMZd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680875346, "uuid": "284a322d-1f9f-487f-a910-5863826d9189", "value": 47486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680875346, "uuid": "3da5272a-3427-4fd0-be8e-e073113cbde6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680875346, "uuid": "20abfe57-3dff-4fdd-8c0e-e34c2eadc1a3", "value": "information_7_apr-7015137.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df00be5-d4de-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680828704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828704, "uuid": "4a948e77-c8ad-4b3c-907c-aefc1e5b2d8e", "comment": "Malware payload (Smoke Loader)", "value": "a8c13052d5f7d95c797c2793f59ffa36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828704, "uuid": "9bba5255-74e8-458d-826e-7f96b2566cbf", "comment": "Malware payload (Smoke Loader)", "value": "02dbd6d19398fe3a0fedb029e201f1bb86870b3b7787f03ed63a6f77d559e468", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828704, "uuid": "250b2208-47b3-43c5-9ba8-7abd978223e6", "comment": "Malware payload (Smoke Loader)", "value": "83766deb7529e2d02bfb3a6d292b6f87d9cfbdd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828704, "uuid": "3306b607-8059-445b-9290-3a52b030d609", "comment": "Malware payload (Smoke Loader)", "value": "8a4987c5e9393b76365de73538f35441432cd754c41eee9efb8fee5d65386663ae9645d6fae2ec21bdc3e9d845e796c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828704, "uuid": "27cb44f1-d611-4b9d-bf91-9fcaadf32273", "value": "T1D2645C0262E16824E5124E338E1EF6F4BA2EF871FF57EE5A23695ABF0D70171C162315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828704, "uuid": "9c95897a-c6f6-40e9-85db-a6cc58a4ae45", "value": "f7140606d6df84eba7ff66ad8de9955d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828704, "uuid": "a3b56764-10cd-4d74-a3b2-29552ab72d73", "value": "6144:6zz3NHt4kaYlvm87XtDArIIetAm4mcUW:6f3NN4kLvm87XtDhy5mcUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680828704, "uuid": "0bfafb03-61de-4fad-bc54-960b8fbe0f53", "value": 333312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680828704, "uuid": "f45ee52d-fe8b-456d-8764-30e5ee627189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828704, "uuid": "86aaea4e-bc9d-4be9-a6ef-91fac7d833ed", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf6d09b-d4df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680828997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828997, "uuid": "5cb7ccba-45a9-4256-a985-614c48f10048", "comment": "Malware payload (Rhadamanthys)", "value": "5e20550ac13b6b635165b5ff99df7a81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828997, "uuid": "b48c7bdb-ac43-4791-82d9-471135aad7eb", "comment": "Malware payload (Rhadamanthys)", "value": "04fbf6c7817be9715c70d852150c1cfa168c0743411bdbf68644ea5217f38355", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828997, "uuid": "23b242d5-5c03-4cde-abac-5388756760df", "comment": "Malware payload (Rhadamanthys)", "value": "bcc352619fbbbb4502db8eb0ba435ca5932498ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828997, "uuid": "3e80eed6-9a4f-4538-9b3c-53a3d543f865", "comment": "Malware payload (Rhadamanthys)", "value": "bf33c99136b3788e7c78db1201b4d5c4b11d54d6a48a0e280cb92335fcc3e30cc0f074edad0237cf136f4053c97abaac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828997, "uuid": "163910f0-e461-4ff0-8952-8de06c59510d", "value": "T15C848D4262A16870E5124F338F1EF6F8B61EF8B0EF67FE5A26695AAF0D70171D112314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828997, "uuid": "23ed3adc-fc23-4a1c-94cf-c233367f8516", "value": "2b092cb2db51c3e3bb5667c747571bb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828997, "uuid": "489e2e26-138c-4058-8ff3-1f55baea710e", "value": "6144:97dj+k+11TMEP/xczCcDgQjuLnrDBJ4RSUW:9Rjf+1RJc+cDgSKDwRSUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680828997, "uuid": "37abce4d-f05d-48f4-ad1a-31e557d4340c", "value": 382464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680828997, "uuid": "9f281d5f-9ee5-4028-949d-070759a696b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828997, "uuid": "3f1370db-eae7-498e-a899-5fa599be3229", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9180e4e-d532-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680864934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680864934, "uuid": "273a85b4-4bb9-4a0c-bbe4-0a58fffdbc34", "comment": "Malware payload", "value": "366a116dc0bb7755a43d3721a1c26fe9", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680864934, "uuid": "e006580b-08ac-4a15-aa8d-a8c538b844b3", "comment": "Malware payload", "value": "063976a7608e11b75d35b68b4c156f5907f1675d0fe9ce3c30101b82b0155793", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680864934, "uuid": "c45aa28f-780b-4812-b6cd-1d11e1c32e20", "comment": "Malware payload", "value": "4daf8e3af5b6363134d8ef8269b6f96347a4c788", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680864934, "uuid": "dd07ea46-ac1b-4a55-ac1c-64092134fbfa", "comment": "Malware payload", "value": "9e987a976b1052a206b51a6d0505abcbe00a9fd32eda2f80af8aa96d996040d64a711b01f158c41727821cfe5915a5ac", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680864934, "uuid": "ff659007-80a1-47c4-b436-1d76a637fffe", "value": "T17943F115CEA6680CE4C38612A937379B4477B943CDC466E338B5C79ABDD9C40A722DB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680864934, "uuid": "6f40fa3f-9e76-4f5d-a2e2-97b9b589d396", "value": "1536:4behub4txxo+SZxiSsiZIdug8t9fbCTvFqu:4bycBBLvXHFbSIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680864934, "uuid": "919d90bd-47de-4c25-9081-1e6390bbda11", "value": 56983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680864934, "uuid": "262b370c-f586-4408-942c-aa6e3144c6ad", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680864934, "uuid": "61b1b319-1527-465e-9f0c-d7e4e4e3fff5", "value": "NM.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b92abc4-d57c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680896480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896480, "uuid": "a29f2b3e-2a28-450f-b690-6df5cfaaac45", "comment": "Malware payload", "value": "eff81f7ca44c515a950e01d8f0228f91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896480, "uuid": "b6bbd6c6-7f57-4b24-a2ae-742db82fd7e5", "comment": "Malware payload", "value": "06e252a29a89eaf2428e577c39cee1801c549d639c5a02032cc0a5a1523b6649", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896480, "uuid": "728dcbe7-d0dc-4c0d-878f-22a603aa88fb", "comment": "Malware payload", "value": "1e5558868bd62191a3ce81631e879b76d2a23c42", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896480, "uuid": "c8aacfd2-3390-4346-bccb-f50318af6a60", "comment": "Malware payload", "value": "999977837cbfe319f807984041215c06001f8cc9a36cdcadf37334b8abf5b32b1870cfd5cf45fd70d45fcd5887c6b232", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896480, "uuid": "2897fedd-c817-4bcc-9b75-3eed6abbebec", "value": "T1FA331996F9816663C1E016B7FB4E428C7B2603F8E1DA7303DD159B3037DB9A90EBA451", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896480, "uuid": "48a842f3-0193-4cbe-8f56-fd62271bbadd", "value": "1536:mEQAijHkGoZNTHno8rdSWLdC/H413HMCSq7o/vGq:mEQAijHkGoZNTHno8rdS+dC/H23H5MGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680896480, "uuid": "82408557-07df-4403-938a-1900cc1c29e7", "value": 50912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680896480, "uuid": "82946f58-1aad-441b-b559-78727336d339", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896480, "uuid": "8df5c4d6-7833-4175-a295-322d7d7ffec0", "value": "eff81f7ca44c515a950e01d8f0228f91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b785d10e-d4db-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680827566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680827566, "uuid": "43176d7d-3f9d-404e-bb0a-fdeb67174c59", "comment": "Malware payload (RedLineStealer)", "value": "9a537abbf018c7c32a8e296a4db7214a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680827566, "uuid": "5e6391d0-9748-472b-ba01-88d7ff5c2048", "comment": "Malware payload (RedLineStealer)", "value": "070e7468a9c107c363cc05f7e9842cb75e69bedb67b7d74fc6cca9c45de8b881", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680827566, "uuid": "837da32c-fff5-464b-95ae-fe5fe6e3c110", "comment": "Malware payload (RedLineStealer)", "value": "23cc15fac634a0b23f2a3b0081d85251d85f9062", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680827566, "uuid": "55421593-1fa6-4f3b-8f65-9c23168ba2d4", "comment": "Malware payload (RedLineStealer)", "value": "a2a3fd0a893453ac69003909d68eb1bd5f24a07276285560e4f44a013e664a4337d4781924540fb09eabf7e6149673fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680827566, "uuid": "1e5a6e96-efd7-4057-9438-d98cc75c3e91", "value": "T1E57485316AA90314FAC89BB98D77516F8C1824BC51DFF09F27AA65FC04680C8577AE73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680827566, "uuid": "827a25bd-cd3e-4f80-9bb8-81984e5d62bd", "value": "43071b9efe4beed7959a57116039b3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680827566, "uuid": "559f3d83-7b16-4b91-a351-f6e96fcc63b4", "value": "3072:DSDtHXmGx6zz0n44/W2ytIqvwiPmN0yWy0K9OzOUax7glWBJ62VJQOSXXq5ih:2Bhzu8iIWjkOba7gluJ627hi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680827566, "uuid": "253bf7cd-13bd-4c9a-a883-3488551cafb0", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680827566, "uuid": "b1f32749-1781-446d-b3fb-7d54d7eb8265", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680827566, "uuid": "65615888-1014-4c6f-ac7a-3af531156324", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda8fe32-d510-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680850393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680850393, "uuid": "9eb0cc55-5b63-4c51-a8c4-a631ad53b1a9", "comment": "Malware payload (AgentTesla)", "value": "009ff52b3a82427cae1c75840726fcc7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680850393, "uuid": "5a5e20b3-4863-41a2-9132-b3f0f5d4a627", "comment": "Malware payload (AgentTesla)", "value": "08d6556daf03a82e4933fe528048001bac28c445828189395ea0dd67d2f26c8c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680850393, "uuid": "e2ad8e22-7978-4e00-95a2-1c320946d170", "comment": "Malware payload (AgentTesla)", "value": "cb7ee916c2ddb02851b0f679188228a84a9ac20e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680850393, "uuid": "0a5a7e78-ed5b-4d39-87d8-a08d3b9c1df7", "comment": "Malware payload (AgentTesla)", "value": "d763fb12f3675b8cc45fc6057ae921156d0006529e36089a761bbb04b2077854d153ab72f69dfb2040a622b56d1bc7de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680850393, "uuid": "6f5b0e1a-c9b6-4d04-b489-b089f78e1bb4", "value": "T1CD361819AFF40D1BE2F613B4643597D8FAB5F4668AD3A30A301DB8690F29B450E43763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680850393, "uuid": "9d01673c-0905-4953-97a1-75218b59ea61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680850393, "uuid": "3c08d0b2-bc32-4368-bacc-d4876330ebd2", "value": "49152:uU3os7eGBx2g43q8rkcn9nY7a6mJMAe7ob2941Pt+DTj8hNMr:4srx93+eE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680850393, "uuid": "2e3ce55b-3b9e-4d36-9444-51930f47f8d1", "value": 5205504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680850393, "uuid": "8fb52505-38b5-4b4f-ba18-de86409a37ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680850393, "uuid": "17ec0079-0db9-4e41-aa2d-4af29852ef13", "value": "NEW ENQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "debd9145-d50a-11ed-88f6-42010a9c006e", "comment": "Malware payload (LummaStealer)", "timestamp": 1680847818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680847818, "uuid": "373a52cb-a638-41b5-9a81-1bff7af57e15", "comment": "Malware payload (LummaStealer)", "value": "b820fd39e35747fe310c91ef4912a64f", "object_relation": "md5", "Tag": [ { "name": "b820fd39e35747fe310c91ef4912a64f", "colour": "#17D2B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680847818, "uuid": "a94acb50-4030-4fde-9b5a-a43c9be0734d", "comment": "Malware payload (LummaStealer)", "value": "09c30c7d5fb9a061db47e0f741b523c1e4c92a75bb8df89a7964262ef9ce02e4", "object_relation": "sha256", "Tag": [ { "name": "b820fd39e35747fe310c91ef4912a64f", "colour": "#17D2B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680847818, "uuid": "e4105ae5-a181-4271-aaa7-ec93c66595c8", "comment": "Malware payload (LummaStealer)", "value": "43970aba187bf83938b2b441a271a9d12b402df9", "object_relation": "sha1", "Tag": [ { "name": "b820fd39e35747fe310c91ef4912a64f", "colour": "#17D2B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680847818, "uuid": "8af96319-6b04-4c1c-ae5d-828e7e955224", "comment": "Malware payload (LummaStealer)", "value": "e34d6004f8329088a9b81eb2a5b53ed8618e24287d586b5006f2947e1b7426a1ed05ddc4dc44878437649a82fa7372a4", "object_relation": "sha3-384", "Tag": [ { "name": "b820fd39e35747fe310c91ef4912a64f", "colour": "#17D2B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680847818, "uuid": "601ddea5-5b28-4c13-800c-c7fbd64c2e3f", "value": "T18CE4E10262F17C20E5320B32BE2EC7F46A6EB9619D16FA1A1355F93F09793B1DD22714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680847818, "uuid": "53992b75-ceb1-48b3-b61e-ecd187504f1c", "value": "f7140606d6df84eba7ff66ad8de9955d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680847818, "uuid": "a7eb43d5-dfc4-4f17-b1c0-dde172158c2f", "value": "12288:tOiRRKE+LlyI6If3S+PWn9eYWchx+6cL0MpxhDHQYZublnOHcpmzf:t8Rl0IPz6OcK6coMxQ6ubt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680847818, "uuid": "83303faf-5260-441f-809b-99bdb5461b32", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680847818, "uuid": "60231816-037a-4045-b816-e31ec1936b3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680847818, "uuid": "95ff6731-1985-45f5-a6fa-a681bd60ab1c", "value": "b820fd39e35747fe310c91ef4912a64f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2302bed8-d567-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680887446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887446, "uuid": "de5d0204-99d7-407c-910d-b0123dc85b51", "comment": "Malware payload (Mirai)", "value": "d1f775b8159cafb2a7af7344903980ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887446, "uuid": "773a7468-d3e5-484e-85ec-af0278699533", "comment": "Malware payload (Mirai)", "value": "0a859d9cac6e4a930199a7ef81f4d82da91245d4650087e352dba0a31ddf62c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887446, "uuid": "889e825a-8244-4f6d-8aec-a1d1b509a718", "comment": "Malware payload (Mirai)", "value": "2ceba3dc6a28b1a0705eba7b34b5fd062cc00731", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887446, "uuid": "8a5ce0b2-1353-4baf-959a-14638dd4fd8f", "comment": "Malware payload (Mirai)", "value": "31190bb389e18132ab22d16efcd762c321a18fd3ad3d9f8ae8a215a1ab652b9d3e2cc003f0a3aa99a08e779ddc882812", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887446, "uuid": "bfe8cb1a-061b-43f3-91f3-5c5a46d00102", "value": "T12A93734D3E219F7DFFAC823887B75A21A64823DA66E1C585D05CFA021E7034E741FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887446, "uuid": "f9f6a881-ac18-4965-937c-f359c8cb7411", "value": "1536:1YRdsnDd6C6gb/ZVyDYjMbwqZ9f0vfwW9ufY1C+KBtyRirfXDOiOC3J:CHsnD8/gb/zyDv9f0HD9FC+KBtyR6/DX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680887446, "uuid": "40fd7390-6f20-44b2-87d9-38ec4e1a6a36", "value": 89332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680887446, "uuid": "bf53525c-a232-4191-a212-914fffcab59c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887446, "uuid": "332b2607-f5d5-4a5d-b541-34a8231c5c4d", "value": "d1f775b8159cafb2a7af7344903980ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b631ddc-d567-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680887460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887460, "uuid": "112802f2-9238-4f95-80bf-16de1c992fee", "comment": "Malware payload (Mirai)", "value": "138e74bb19920c7b31dd5acd9b982c9d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887460, "uuid": "ed058834-a04b-457b-88d8-d7a932097d70", "comment": "Malware payload (Mirai)", "value": "0bb1aff2aded0644dfff0f66e68f3d231e3318847974574c590b34453f259bbe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887460, "uuid": "1072283f-1edf-4a67-a710-8f495726bbd9", "comment": "Malware payload (Mirai)", "value": "b50b16e6c7084c6ffc97490d4b2b2ba77cec57da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887460, "uuid": "74b3da8c-d515-4df3-a4c4-a836daf2cf22", "comment": "Malware payload (Mirai)", "value": "9cbaf537920d1b858577ebde1b4f96bee083a6c907cc6ada1b15793347c82c8416905bd85804a49a0e7ce4d3144e8df6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887460, "uuid": "7972f2c7-7f31-45f5-9db3-a5f1166ccb53", "value": "T101332B8D68121D2CDAD358FD50729F0E9E552211A0A3070FA7ABFEC33D33269EF55989", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887460, "uuid": "b836bea0-3cd8-4eec-9450-6d058e4c0faa", "value": "768:mouzcCsm4ru2IGh6HHaihHHeIXXdauZj0CGeWxCyVBXtM7edUo+f1prwGk2Qexba:moqcCyrBIC6HHaiFu/eJ7edJg1pkDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680887460, "uuid": "7d0e6a4e-8729-4cfc-a251-00f9c2b15285", "value": 54336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680887460, "uuid": "4fe7163f-991f-4a0c-aacb-9c2966ed801e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887460, "uuid": "6561be84-7a6f-4ea3-bd63-650bc7f02c5b", "value": "138e74bb19920c7b31dd5acd9b982c9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867dc6db-d4de-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1680828772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828772, "uuid": "6015cd79-0331-4e39-940b-873656557604", "comment": "Malware payload (TeamBot)", "value": "82c3449dd869f10cbc8bac2ddedec349", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828772, "uuid": "f16d53aa-99a0-4776-8715-dbaeea2fbefd", "comment": "Malware payload (TeamBot)", "value": "11238796368e8590275e07ae5adba00e4a3b6284e93de5ea579b06285c309597", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828772, "uuid": "aca0d165-c2d8-4387-836f-168977a44ffd", "comment": "Malware payload (TeamBot)", "value": "b492412375cd240db192e6df86be1ed149cd4dac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828772, "uuid": "872d6f35-0ea1-480f-91ef-dc9b267b9921", "comment": "Malware payload (TeamBot)", "value": "6affa095bd891311e8fcd7b3b19ca1c688b7bad89807c85f41015ec54529eb40ff8785f94590ec98aad27498054b532a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828772, "uuid": "de1facba-a18e-4217-a8a8-b712516764f0", "value": "T196648D0252B16C20E4324A72BE1EC7F46A7EF8609D56FB5E1758ED3F097A3A1DD22704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828772, "uuid": "82a42b60-4e59-4f81-b3c9-c231b06a2747", "value": "12273ceb2554808792ceaec051f155e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828772, "uuid": "143b4a7e-da99-4d17-9b7e-0607c8338150", "value": "3072:rPR5JLyYbWkeGiL2m0Gsf6RxTAj7dVtz5MIVcGJ5wJB+7MpHwxPpNwfRPma:rJLJU90Nf6R+j7d2IVc+5wJBekKPpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680828772, "uuid": "eba18398-b70a-428c-aa17-d61a56ec3215", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680828772, "uuid": "842a2b4e-3ea3-4fae-9cf6-06d7e25db256", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828772, "uuid": "1bfc3f88-e49f-4a3a-9673-cc44f7e33b74", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b60d68ac-d518-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680853762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853762, "uuid": "5acd7cfc-6167-4e7a-bed0-89873bb26a77", "comment": "Malware payload (AgentTesla)", "value": "a8d76b508f953bcaed3cdf0fde52f578", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853762, "uuid": "920cdf81-8819-4128-aa00-47cb4cdc4a27", "comment": "Malware payload (AgentTesla)", "value": "11733e025c60b01fa64c677d151445ed8603cf9835b1aae86a2d2200c5cd15a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853762, "uuid": "2690d1ce-ca79-4287-a27e-b1a62fe47e46", "comment": "Malware payload (AgentTesla)", "value": "d164e3945e85064287bc8f2c4b3d461b30478a9c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853762, "uuid": "797cb0d5-e5c7-4814-864b-35b7d870f8c3", "comment": "Malware payload (AgentTesla)", "value": "d234d41b3a320709b203594fecf10955e8255ad5c64c8419adbe079d46ec4a86d2698828cc4eb2043c37154d1d3b4b9b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680853762, "uuid": "4d4ca6c0-cb2d-4906-823d-0a5b1255f25b", "value": "T1BEA423FCEA58B39F11FB0F8D520AF4506D7C5B46759ED0AA7CC438BDA6CCA57120A218", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680853762, "uuid": "df5b8877-efcf-434d-a882-3b24739efb35", "value": "12288:aOgWx5oO9t3H++CpE2FN2gwOOdk5hG7s1z2P6IbNd7qJTDDBi:NgLO9tXFj2FNH15Mg8NN9q/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680853762, "uuid": "dfca04ec-d8df-41d9-aff9-9b4754575443", "value": 460671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680853762, "uuid": "187ef10f-9a9a-46f9-ab8b-7286f4b2b5e7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680853762, "uuid": "0be72f7d-c65b-41ea-ad01-18ffc1887214", "value": "2202A119-2 packing list.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e426647-d558-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680881210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680881210, "uuid": "741014dc-27be-4b20-9310-0327a67d7cf1", "comment": "Malware payload", "value": "846556813d15c2df3ed0fc05f0f3a099", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680881210, "uuid": "61c85944-4ebf-46f9-84db-a3d9e38fec16", "comment": "Malware payload", "value": "13ce8a370bb7a4204ccde47c014746df4589f779a8af0564fa3daecfb477253a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680881210, "uuid": "df31b503-70f1-4461-9622-769ac7bd8cac", "comment": "Malware payload", "value": "0fda8084b68a7dab9dec45c90eb5c2871ad04ee6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680881210, "uuid": "6881a75d-035e-4e13-8e67-113c56b39d73", "comment": "Malware payload", "value": "b6a6625d08cfc15f00beb650ce039ce32afab3e9a2aea8f718f4618e987f93d97fafe7d20149d6523e24af4cd2c97a24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680881210, "uuid": "bddd0341-31c1-4b98-bb48-b846790c7a84", "value": "T137435B2676A0C03AD0D256300D74C2619B7A7C7257B8D4CB77E05A795F723C2EB3A3A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680881210, "uuid": "7a501d70-6948-4bd4-a64b-8fdd074f8e51", "value": "5675c6bcce2a259e83816e49e795d649", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680881210, "uuid": "0b26fdbb-8ee5-4c38-bb47-2f8b79c110cd", "value": "1536:5cej+yFqDZIJvX6pktZQpSwPpv0Pu2kULcjPeV:5L9eZ1uFwx022kUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680881210, "uuid": "7815e58b-5d7b-4f27-b877-2b7c504641ba", "value": 57856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680881210, "uuid": "64af3a55-cbdf-4004-a2a9-d41f819407e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680881210, "uuid": "423bb144-c4c6-4b89-9124-9408c9e22c65", "value": "SecuriteInfo.com.Variant.Babar.170764.24427.1611", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa81c09-d568-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680888138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888138, "uuid": "9517a8a6-661d-453d-b4f1-737badda9ca7", "comment": "Malware payload (Mirai)", "value": "2dbba9b23f5cd20db2e1b3fe18b45d13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888138, "uuid": "7274d495-3b12-43d2-8362-6f657c25736a", "comment": "Malware payload (Mirai)", "value": "13cfac951736c95a7c700fc05ae6774fdd310dedf1a2c6b85e2656f991449501", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888138, "uuid": "dbdc2b6f-5f4a-42cc-9bcf-633ccf2f2a74", "comment": "Malware payload (Mirai)", "value": "df09261d813368b1dd09863f5c4a9af471e225a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888138, "uuid": "0ca8ac1c-ce7e-4167-ba05-bdb3f928adb6", "comment": "Malware payload (Mirai)", "value": "3ff362c2cfb2168c1758f07cc43a0f5a2f2fd62a0db8c5512ec60e2b8a1740b0b9d7ec85dfc3c573d94ff6a15be04b60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888138, "uuid": "53c1d0eb-1dfd-46d3-8ff4-a4f2ffd8008b", "value": "T1CF538409BF650FB7DC6FDC370AEA270628CD640A21A97B357D35D818F21B25B19E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888138, "uuid": "7eb77988-b16c-48fc-9cd8-0e64a0a31c7f", "value": "768:NscgJbH5csKKNLF4fR7/eY5TdeSeq3evHDAvAXiLIQUOob:NTgpHys1Enj3r3UHDo7UF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680888138, "uuid": "2427c8ad-41f1-4242-8aba-296460dd8d44", "value": 64356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680888138, "uuid": "7a3df17d-d9d7-4494-8cab-dd64e44fd363", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888138, "uuid": "5ae02773-1718-48e1-bb64-df43203faa7d", "value": "2dbba9b23f5cd20db2e1b3fe18b45d13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57d3f078-d4dc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680827834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680827834, "uuid": "aafeb49c-1f14-492b-8d8f-1382abd95eb2", "comment": "Malware payload (RedLineStealer)", "value": "9435725547ca37675e615418f1a16db4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680827834, "uuid": "17cdb2fc-fb98-4ce8-b09f-f72ef6623fd3", "comment": "Malware payload (RedLineStealer)", "value": "14bc2d12cb3ab24aa763dc86b1c67c769a521410ecf53752f1926e8bcd782337", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680827834, "uuid": "83afeae4-6391-4d0a-b402-f05fc4737cde", "comment": "Malware payload (RedLineStealer)", "value": "b4f6e7db9662297e400fd6cd88c90384111d4414", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680827834, "uuid": "51a1774e-cc7d-4158-be25-f9561c3b22e0", "comment": "Malware payload (RedLineStealer)", "value": "900e5cc7db942f5f22873b6a3d6f846bcef70efb55289fd4ea8f73ced1d3f4cbf0909d6b6463c241c1029e3d5cf3327f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680827834, "uuid": "bad82b30-f1a1-44b0-b2ae-baf52edcf441", "value": "T1B1152307ABD985B3DD72173178FA66D31E31BC914938CB0763415AAA29732E06871B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680827834, "uuid": "3cdcddbf-d224-40d0-b699-a3c185c8ccf9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680827834, "uuid": "8c7b6cf9-536b-42e4-a440-4d764b8f4cb5", "value": "12288:IMr4y900td0uVLtvEEa7kATKu1qlTfKuelS3UonCQ3Dodu+M1YVGuvZOYQ0Zle+d:gyFtdHVLR54TYlveQUonCQcU1+7FH7d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680827834, "uuid": "fd51d5d0-ff4b-401d-89ee-e05aef6e8219", "value": 891392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680827834, "uuid": "d8302157-71b1-4a93-8fc2-c9d0313aae88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680827834, "uuid": "82f3c355-bfd3-4029-87ac-44fc164a9c50", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d88db20e-d54e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680877013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680877013, "uuid": "63b28da3-65f4-4b8e-a002-d7722e6d3eb2", "comment": "Malware payload (AgentTesla)", "value": "334a9f14feba00e0ad7814d7150cb875", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680877013, "uuid": "ceca7650-80b7-43ef-ab8e-89f9df10e0ba", "comment": "Malware payload (AgentTesla)", "value": "17324c286269be079193ee0d25e8e09d8d2c49c103fcf429e0e7e29ab1c867e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680877013, "uuid": "ef8b543d-9cfe-4540-8f5a-e44964ffcadb", "comment": "Malware payload (AgentTesla)", "value": "92ce19c5cf774236fcf91fef4348b70849d90f12", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680877013, "uuid": "91f4395e-de6b-412f-ab29-1c515d8b2bbf", "comment": "Malware payload (AgentTesla)", "value": "b34c8297d7f8b1ac6aabb5d53abbb0f5972e1d7e0dfb4f19ed92880bbe6f5311d22a46d866df956d56e6d064308c7677", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680877013, "uuid": "83a86238-f5e6-443b-a5c2-21e3698d9e13", "value": "T127058ED46AC58A81D437B170B04ACFF3C3E71D19E09E86F13897A58990E2D016DF69EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680877013, "uuid": "6bb1b07c-e173-41de-acba-21bc257e257a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680877013, "uuid": "309593aa-e725-4b6b-ad3b-47801cf48aa3", "value": "12288:Z2iNM4AvKvfxUokWY1WGQRjcOchNEenYLpKoru1UJ9QFFKyVgh2eV6pMm72w:Z1XAvypUojOpQR49hNE4Ow+PQC6amCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680877013, "uuid": "617c6120-d160-4b80-b31e-6974f55add07", "value": 835584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680877013, "uuid": "69fd9535-d7c5-4903-a045-3aceb789214a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680877013, "uuid": "59632420-8c84-4ccb-9b3b-d233edbd708d", "value": "Design & Drawing Details-0294888939.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1828e5d6-d57c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680896447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896447, "uuid": "07cb6c80-b5b7-40a1-b3cf-35ba53453497", "comment": "Malware payload", "value": "fbe767e608988f1e55801b38623103bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896447, "uuid": "e6d37412-f9d2-4fd5-bd2a-f1083bcca642", "comment": "Malware payload", "value": "184154e946bcdc9d5b2656f7f05c25e307d00a9275b9bfbe4aa1d2175fc090c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896447, "uuid": "24da3637-4a00-49e4-ac70-23a4f7355b30", "comment": "Malware payload", "value": "03b9ae92d8509c66943421ec9be9ca38101c300e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896447, "uuid": "05911a5e-439f-4b98-b3ce-9b29700a33d3", "comment": "Malware payload", "value": "228b4936bfec49260c7e1ce4f93a27118c2b665697e22f6a8be86bc97e57e34680fddf253e095bdc518004e03c9c73bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896447, "uuid": "b99fd0b3-addb-4fc7-ac50-1945aab02680", "value": "T1703329E7B404ED7CF82DE77F4467040EB131B36054C20A6573A6A997AD7B2990C6EF88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896447, "uuid": "7ff0fc44-beb5-4f4c-890f-147875f129eb", "value": "1536:30t3EAtEw0EwsEAqEAeJEwsiWZKd5j8S+wZNsoTtnfaarso75Z:Et3EAtEw0EwsEAqEAeJEwsiX5n+loRfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680896447, "uuid": "d8b80e5e-cdf8-4b17-af42-2627357074c7", "value": 52724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680896447, "uuid": "5347bda2-ff03-44a5-b2af-39f8075116d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896447, "uuid": "34c62492-023e-4498-873f-5391ea5ff191", "value": "fbe767e608988f1e55801b38623103bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b8d399-d546-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1680873618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680873618, "uuid": "596188b2-9596-49eb-9b9b-80f6f4d4efcb", "comment": "Malware payload (Stealc)", "value": "583818cc15e2b69121f5944f97ed1d4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680873618, "uuid": "51049bc6-bfb3-4165-83c9-ccc97507cfdc", "comment": "Malware payload (Stealc)", "value": "1989b578e9207004dba31c1fe03a075d21754f68f3bb43630783f75735e9f33c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680873618, "uuid": "7b487e02-4b9d-4f9b-ae80-eaba3870a5b4", "comment": "Malware payload (Stealc)", "value": "3c6263acc11f5223d77cf3fd7c65cd53a8c8f124", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680873618, "uuid": "728c46b1-a3c7-400b-b617-44281f7e179b", "comment": "Malware payload (Stealc)", "value": "dc1d024a3a1558433dd5a93cf55783792f8dbc6ad4b842619686d1f206c5e201e7d62afed01d93b40fde19eff72fc83a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680873618, "uuid": "ebdad0eb-3b0f-4266-b45e-7ef25a5039a2", "value": "T1EE14BE11BDDDC8B3D45785304825C2F4767ABC63DB419A8B33686F6B7C31E826A76312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680873618, "uuid": "a14a63fe-efb8-4a2c-98e1-2593d38dd2f3", "value": "71666ce513898b08ba38dfa1dc35ec76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680873618, "uuid": "de515bdc-c703-498d-a82c-8733d9637793", "value": "3072:uLEr7e5jfxb/WVntV2sHK8yPmI7mL3QVjVJteT45DfI//iO1TIx:8R5jdEtEsqn+oJYKsPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680873618, "uuid": "4ff8ab0e-ea69-416d-bd3a-cde8269bc52a", "value": 196096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680873618, "uuid": "0b5e4086-f4e0-4a37-8347-a699d2cedd61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680873618, "uuid": "5ca4537f-67ad-4958-85ec-34f7a1c03c42", "value": "583818cc15e2b69121f5944f97ed1d4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "489b6255-d56d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680890086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890086, "uuid": "54ad0f38-742a-4ee5-9b7c-616fe3e6006e", "comment": "Malware payload (Mirai)", "value": "40faaa2c965d90a09c53cc874ba57c58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890086, "uuid": "df0f1b48-3352-419e-b4c2-90a412122471", "comment": "Malware payload (Mirai)", "value": "1ae1fc3fab8c4fa25c38831c0974d8607ba99284a0f5499bb7af4c136a78fa52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890086, "uuid": "a0b94b16-0fb0-49f8-983e-67b1c9a4eff6", "comment": "Malware payload (Mirai)", "value": "d14d95d737088c0a58efd11bc838e77def160769", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890086, "uuid": "a4cb7061-b542-412d-97ba-f9d3815d418a", "comment": "Malware payload (Mirai)", "value": "f5b5427f4e2be303afeab0e8d014c99209de089e0b86186d5b6c988ffbd9f760eb382a98032bdcf2f67c27b67d904493", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890086, "uuid": "37ae6a8d-fe9d-4562-9a77-9edcd53688b5", "value": "T172130856F8D24E26C2D4137BB67E5A8C3370A7E8D2DFB217CC506B52B98640B0D96E90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890086, "uuid": "ba7afd93-af84-458f-bbee-1ff4b9dcba5f", "value": "768:k2fF2uvG5lMFH/7m4PaNvAk89iLJ7Omtd2v28otE2VdPQO6CyKsf5wqwbZn:/2qG5yJ7m40vuQtdu2m2V1QO6Cyuqwb1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680890086, "uuid": "372c0b1d-d851-403d-a29c-9ac2856a5873", "value": 44612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680890086, "uuid": "c3d38be8-f2a8-43dc-8d64-81d373948f31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890086, "uuid": "b4778c4c-2859-4847-aebc-ce323b2c9f80", "value": "40faaa2c965d90a09c53cc874ba57c58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "865bcdf5-d4dc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680827913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680827913, "uuid": "3324e4e5-83a1-4862-9e82-afb612579fc4", "comment": "Malware payload (Amadey)", "value": "0ba2c6d66ebf30a39147fe15f14a8564", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680827913, "uuid": "d4009e79-6337-44d5-bf83-9a50f293c5eb", "comment": "Malware payload (Amadey)", "value": "1b3db8f682f199c8a9aaf79e170c8d174136cca196fd5ee6ac4c2a1b97f44be8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680827913, "uuid": "4369a9c3-7084-4421-8e05-93327fb34b27", "comment": "Malware payload (Amadey)", "value": "ee40b0ea02fe944e7029fb29451ba745b2a74c54", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680827913, "uuid": "0750f1a4-7ab5-46b8-92d2-1f4587af6983", "comment": "Malware payload (Amadey)", "value": "ec2fd4fd1b80b206473b65cb6cd7e7a9fb5cfdca084b50130ce7f5f2362d01c0f50dc66d486f7afbc2267944e01fa812", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680827913, "uuid": "d538b294-3bd4-4039-9a98-36b2bc672f6c", "value": "T171152383F6CC5063EDF217B4A8F727931A39BD9148B9D38B27419A911CA23C1693177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680827913, "uuid": "487fa041-cfc0-4dce-9f4d-faf6fc053cc9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680827913, "uuid": "2c98bb5d-bfcf-49cc-a19b-362e4d21b54f", "value": "24576:7yI45xPpVKIaeQdpe+tQyCqksaSx6N9WJj6YQ1kHTMj:u3VKR5peHpqpa/9WVmmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680827913, "uuid": "6a0489e7-3c17-4137-b200-2ff6ad64e356", "value": 891392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680827913, "uuid": "5c34f641-4079-44e6-b149-3ce05fc81361", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680827913, "uuid": "7ec820f1-8cd2-4f35-ba89-de8d5794c264", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe8286f-d542-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680871630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680871630, "uuid": "9e04cb64-3a93-4ad1-a09a-883223de92f5", "comment": "Malware payload (AgentTesla)", "value": "0927b8e253a5769be36d71ddb6473baf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680871630, "uuid": "8a097f73-2385-4228-ae30-1d195884da2d", "comment": "Malware payload (AgentTesla)", "value": "1bad74ee3864f62fa44a2a45121679ed1ead32c1765a07c5ac2cf16bb970ba3a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680871630, "uuid": "b9dccd9c-3597-4184-abfa-71eebf2e3bef", "comment": "Malware payload (AgentTesla)", "value": "e56b20eb463170405193fedc4be1b25fa93b0bb5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680871630, "uuid": "c4cddf12-b177-4e29-bf16-1eb0b86c2122", "comment": "Malware payload (AgentTesla)", "value": "0fc8fdf074f9a4449530465eb7bbf3f0236c41b47c8051797a0c7436a3390d9ba810780701859c7914c0fc9ce680e000", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680871630, "uuid": "5a7c5f70-95eb-439d-ac0c-cbc9ceaffffe", "value": "T19BE49D521A624BD5D6B90D6407787A88167CAF429710633E7C83BD3F8CFBB4B50993E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680871630, "uuid": "ebfdece8-fec2-4308-82b7-bd5a8d5cf03d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680871630, "uuid": "7cb4d1d3-f5a5-4b0a-8035-44505c4f04f1", "value": "12288:bKEGQYTB8oIGDSeidcM9m3JmfUHYFT0MUW+bxb804aemnar56e4dIS7vbeMJRD77:bKEGQWB8oIH0ZdYFodbxb804aemnaseU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680871630, "uuid": "61063933-fda2-4a6b-a4e6-c5fc89d0c061", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680871630, "uuid": "8c03c714-c77c-4493-8794-2e550c53c023", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680871630, "uuid": "1de0d013-b7b6-4ec3-9744-928d5a39de78", "value": "Order#SQ031776.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b9b825-d567-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680887429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887429, "uuid": "c7ed1fd6-24f2-4607-906c-25dd426d145c", "comment": "Malware payload", "value": "4d9774181d2540b50f90bd4b7fd3d2fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887429, "uuid": "1817f67b-26cf-40ed-af3b-eb41b4700a83", "comment": "Malware payload", "value": "1bdee523e4a185d42e9f0d61747c009d2e2fa9387e2d11b9398884f5e62ba2af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887429, "uuid": "17248f24-e0c0-440b-b35c-001cbd832023", "comment": "Malware payload", "value": "f3026a7b39ca3a6434e9c7fcc4ca4a1dec119116", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887429, "uuid": "5d074e02-f555-472c-99ff-0e1c4522bd4a", "comment": "Malware payload", "value": "c3713d5f7098c259e1112e8fa66d856cc7a2bc11050ef7fdd54570bcb9ece6cb9f03a373cfef1c14fa88548757587534", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887429, "uuid": "eee07686-2b73-45a6-bfd7-fc5304da6a47", "value": "T11F24C68BB20C0BBFC66B2BB1297727F1CF5AE93012615584E50FFB9403F25705866B69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887429, "uuid": "f842270c-2f9c-4ee5-a505-d45ff311603f", "value": "6144:gUyI2UGLxSw8CfOpd6gXmVgq+o/CEErFPis3Eg:HGw01gXmVgq+o/CEErFPis3Eg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680887429, "uuid": "9d84dff4-5e78-41d6-be05-77c21185014e", "value": 212269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680887429, "uuid": "bca2c0f0-e0fd-41e3-bbb9-30a66731b244", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887429, "uuid": "05a4a948-33c9-4e2b-8ceb-6e7247b327a8", "value": "4d9774181d2540b50f90bd4b7fd3d2fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f96124-d575-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680893511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680893511, "uuid": "ef9beeb4-f0f5-49a9-9df8-25d25c7c6f8a", "comment": "Malware payload (Mirai)", "value": "ed4cddb7703693f0a7354fdf496c9417", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680893511, "uuid": "866e45fd-6703-402d-9878-0a7cab2c8a63", "comment": "Malware payload (Mirai)", "value": "1c9fdc875da76100214d74cf8645778a7f4b63b384ddd1d40f8f2a883542b6b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680893511, "uuid": "0ccd4098-125f-4982-b6b5-d4cfd434451e", "comment": "Malware payload (Mirai)", "value": "9695ada8400a3a83b99a2760ca45a71d46273f09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680893511, "uuid": "615afc85-75a4-4f9b-a3c9-7426d040e01a", "comment": "Malware payload (Mirai)", "value": "d20e5a945344777291e37a04ac9b17af73ef17e073a194f8180783f23e4993cf26b30ec102d0f219a5274cc30c4b9cbf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680893511, "uuid": "36962b3e-d059-4cf2-89a5-8592cd766fa8", "value": "T112332A21793A2F17C0D4A47A62F74758B2F11A5E66E8CA5EBC730E4FFF60940A4136B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680893511, "uuid": "fbd02b6d-b728-4fc2-a75c-888555b4ff2f", "value": "768:Ncu2oSxq9wiNZmPScYRXdgPIhBzUT82EtO+vDIs:eu2FxSwiNZmPSnRXdgQhn2EdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680893511, "uuid": "9c5a761f-de13-461f-9014-212f8bdbd0d2", "value": 51124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680893511, "uuid": "f7a348fb-512e-4f8e-a27c-e5bdffb06ed8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680893511, "uuid": "52d42279-b6c7-4455-9bc9-b0a60f320fb4", "value": "ed4cddb7703693f0a7354fdf496c9417", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c01cee-d4e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680831757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680831757, "uuid": "0ae81b35-ea59-4ec7-a792-3f44d982e30b", "comment": "Malware payload (Rhadamanthys)", "value": "e2d96f8ddec12c1d792a445df4c3b331", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680831757, "uuid": "56d68fdd-357d-4294-bf09-a874d00e5b16", "comment": "Malware payload (Rhadamanthys)", "value": "1d2405447a4ddbd328b92ffe642ef66fa47805ef91fadc45498364bf14fc8191", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680831757, "uuid": "47b1b61d-957f-4afa-b6ec-c5891f6a129a", "comment": "Malware payload (Rhadamanthys)", "value": "12e48a062b0262f1769f0a3c7e8af6d417356f9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680831757, "uuid": "221fedd9-f0f1-4594-9421-2ac03f19f642", "comment": "Malware payload (Rhadamanthys)", "value": "6eb026f85a65b7f5e9d53ec3bb5dadc18c2905ab59227cd51470e219f2d094d8e1e0ca64f9b572d8abef6e88703b09a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680831757, "uuid": "6a050b7a-9ec3-4d3c-a9d1-270e6822847a", "value": "T11646AFB1BA8AE2DFC24534BCE00BED87E55933E247608504E97DB43CB953E9520C769B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680831757, "uuid": "cf9bcc83-8c98-4c17-9e61-a2f5b93f7010", "value": "5502dbdd579c1fb27fd18a21a20af6e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680831757, "uuid": "4792f979-4d71-4ed9-8aad-455ca5d99584", "value": "98304:P+GJpZsLsS713y7etWG0BqoLnB4E6+jmDNBiP5M8OEv:P+GJ3wN7HtwfbBLtmDNWbOEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680831757, "uuid": "3e696dd1-2f49-46b4-bbdf-6d650176af17", "value": 5455360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680831757, "uuid": "f4aeebec-c90c-4a38-9cb5-f72373bf2e8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680831757, "uuid": "bac258d0-d0e4-4e39-be13-c5c71200d085", "value": "setup_online.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d5dec31-d567-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680887410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887410, "uuid": "48da1eca-e98f-470c-931f-3bf7fb8d9288", "comment": "Malware payload (Mirai)", "value": "411763e2f008e64b5c94caf92034b979", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887410, "uuid": "644f987b-e316-49bd-8d98-5b3420c3d1fe", "comment": "Malware payload (Mirai)", "value": "1d5117fb3429bda86e8579860a2418159f84462034e6bb2769d68a56d7f34cb4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887410, "uuid": "3a0cf9b0-0de6-4be0-8abd-047936104979", "comment": "Malware payload (Mirai)", "value": "c157aaef6700b517c8d12e516f1ed5cc8d2314f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887410, "uuid": "ccb9ddcc-c0b5-4057-a21b-4542aa3ee08c", "comment": "Malware payload (Mirai)", "value": "16911e87d679fdda1166bfbbe553fa2fe611ebf1f31ed49680f093c04a86d149ac2e8b0b593a3f0f3af669bcde88e569", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887410, "uuid": "45899ba5-57cb-4e20-abe5-7393741a0f7a", "value": "T13653871E2E119FBCFB9C873547B74E21968C339626E2C645E15CEA012E7034E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887410, "uuid": "d8358a58-6ea2-454b-bef5-d5903c7e2a72", "value": "768:ruVBQl7KPLz+X/rZTnsrZThdUrcOZUehcjx9/IOVJlbplhy7dA+V/z7JcbiB0QRM:QQRKPLz+XdnMwrcOUjnbDI7pZ9R/W/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680887410, "uuid": "974e877f-f26c-4e3b-b990-6c8c9ded73e3", "value": 63364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680887410, "uuid": "66433599-c501-4c87-bb95-4a866387ad0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887410, "uuid": "bd829040-ccd4-4cfa-849b-515c36f096e3", "value": "411763e2f008e64b5c94caf92034b979", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c6cda27-d57a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680895649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680895649, "uuid": "30478435-a18e-46b9-8e64-f136084524ae", "comment": "Malware payload", "value": "f63bbb1b44c431db977d29ac0e3ba509", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680895649, "uuid": "36600513-2e29-4139-ae26-ab9427f18ed8", "comment": "Malware payload", "value": "1ed3389381ea08add3ee2941441cd24db374f070940121d02e2edfb99403d121", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680895649, "uuid": "acbf6875-1cc7-4b17-9ef2-d81462a5a11b", "comment": "Malware payload", "value": "5ed9c6ca6ef766ef63c84e8b2e6d3cab67abe727", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680895649, "uuid": "81232f30-c9b0-46b2-a2cd-f89c513a5313", "comment": "Malware payload", "value": "c3201c35d7d0491ac87ee91419458616332b4f92547e0b7664fd5c06d778473bb91eb59f22e58049c288c1597eb76b00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680895649, "uuid": "0bef2ce5-fff9-4aef-a9c9-ffaefc60a5f3", "value": "T1E7332A31B5624923C4D2593A12E7063AF5F28A8E5CF8873B7DD10F58FFA4A442193EE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680895649, "uuid": "552abeea-e194-4e51-a311-743dad993b9e", "value": "768:L8fRFyblPS015Q+bN2/Uf6hAPZO+75ezmsnc1tsI4:gfRQblPS015CcVB75eets/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680895649, "uuid": "a4a376e5-b980-4354-a1a0-f71ce4e8abfa", "value": 51528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680895649, "uuid": "6ee0dbfb-efa4-41f0-b3f6-24c3ea9c3d9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680895649, "uuid": "d5b8b0e3-7cd0-4a42-8436-c30075a89137", "value": "f63bbb1b44c431db977d29ac0e3ba509", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26547468-d4de-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1680828610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828610, "uuid": "3508f3ef-fbbf-4e2e-a776-fd10a6ae54e1", "comment": "Malware payload (CoinMiner)", "value": "b946730ac4dfc1c11299208be929be51", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828610, "uuid": "cdaa2f29-def2-409b-b724-bdc7fd67b5c5", "comment": "Malware payload (CoinMiner)", "value": "1f33c45f7a95b7c4a3f51927c9981b750ef4fd1bcd8919a405fa7dc6a5d61e3a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828610, "uuid": "e7329f20-49f9-4b4b-8e92-f8e53eba9416", "comment": "Malware payload (CoinMiner)", "value": "e8b846512a28d34555a7b4bca7c46d18aa5b72ce", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828610, "uuid": "f6b084ce-0488-4eec-8507-aeb58ace6ad0", "comment": "Malware payload (CoinMiner)", "value": "246394a36baa5d734f1699d46b86be98ccc842d74597892126fc92a060d24d56f4963c1e61e164da70a9b4c307dfe1e4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828610, "uuid": "0fd01e0c-9ba2-444c-99b5-0d1c4a75c7e4", "value": "T1DC34C02330808431D45FC6FA60E29618911C3610BBE17DCB77AC92975D7B6A1AE7E1BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828610, "uuid": "3a9f9ebf-70fb-4774-ab87-bde1e2fd6352", "value": "bdc5460897466ea2db5d4e59ab3f0e25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828610, "uuid": "fa7bee44-e2c9-4df7-aaf5-cb4d14b68813", "value": "6144:5EYGnUpNaOorrVQt/iIKKLV2IoFlzlfeQ3YDQFq:0eaOorr1IKKR2IoVegYDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680828610, "uuid": "762759db-2aee-4d1d-bd24-2a9cc8aac66e", "value": 243872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680828610, "uuid": "67bee0fc-a4ab-40ba-b413-494d5dca5a2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828610, "uuid": "fdd6ec19-f2ac-4718-b8ce-ee68efe569a5", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba0bcbd5-d518-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680853769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853769, "uuid": "f2f8048f-ad08-4575-ac23-eeb38d28d33f", "comment": "Malware payload (AgentTesla)", "value": "9cfe9935060a5e702cc6153e141003b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853769, "uuid": "ef97fd3a-4507-47f5-8cf6-bd7592e792f2", "comment": "Malware payload (AgentTesla)", "value": "1f8c2feb6b1163a4801631c2824b3f38c12e2db389730e692f3310eb4df6c0db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853769, "uuid": "ef8a9b8a-1e1b-4169-a759-603667cf90c8", "comment": "Malware payload (AgentTesla)", "value": "b2875e09baf637f462d0abcf24de9351269f9a8e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853769, "uuid": "0994a398-b711-4e5b-87be-c3e7abcc7ebc", "comment": "Malware payload (AgentTesla)", "value": "ce832d9b7b4e6aff794c3bba8c68c9b74ac339c25fb0d7447daf12024113b4d555463174d4b55e2fdf0bd4232c934e2d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680853769, "uuid": "ca3f9012-81e8-4d81-bffd-3fc9e7a5cf61", "value": "T127C4D0E08604CAB7EAF80176D01A06A867F17CB4D550F3E33E9975C2F7B27A743A5506", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680853769, "uuid": "fe516627-70d1-477d-8370-bcd2158b8643", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680853769, "uuid": "80e6ee7b-8d6f-4b0b-981a-219f9994f70c", "value": "12288:SGJzDnnFyrZfdjxBnoxqzHuCEHV+RhtWQrDtSsM:vnF8dzHuCMVUhtWgBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680853769, "uuid": "30490e88-f75c-4c3c-aa0a-e4d9e94547ee", "value": 563712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680853769, "uuid": "9eb06b8c-9e95-4851-8c11-108739320fc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680853769, "uuid": "3fe0d9ea-a715-41b8-b070-e46c3b43a2de", "value": "ark.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29089232-d53d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680869417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680869417, "uuid": "656361dd-894d-4ed5-9ee3-8507e7342d16", "comment": "Malware payload (Smoke Loader)", "value": "362e3c016581f6a7034895bd4d3c7dfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680869417, "uuid": "9bad6ecf-be82-4f8f-8ec9-c01dd86f3741", "comment": "Malware payload (Smoke Loader)", "value": "20d3956b0948e75c716408e85545904f8743c69390622b08c752aff7d095dfe4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680869417, "uuid": "9d16b5a6-e2e3-4439-b693-a07e98545ab0", "comment": "Malware payload (Smoke Loader)", "value": "f0d7c257aa1087668a79b9e9b2de2de88ba4ca0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680869417, "uuid": "2033db03-a9ba-40de-a542-277c0a66edc7", "comment": "Malware payload (Smoke Loader)", "value": "a46eafc4f56de74d22f8dfd9ff0db1e267b6ab94922b6a8898d658b069665c4aa0771417682cfbd019912b4a7f676242", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680869417, "uuid": "d78f70d5-1581-4f13-b9af-96c35f68f1fd", "value": "T18D14BF21BA92C0B2D41705F45824D6F86A3EBCA69B85965F33183F6F2D332C257763E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680869417, "uuid": "0cb37ac9-7c43-40db-b39e-154f6264cb9a", "value": "0c473655039a754e9f814d9a583e5330", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680869417, "uuid": "8ba2112e-94e8-4ebf-8fd1-a5be08058878", "value": "3072:RGbASRwd3gNg/zkzlOiuwNjsIr2cIoQ7J5WuznATQ:wA7d3kgoROi/N4Ir/amuznAT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680869417, "uuid": "ab1e1a2d-6429-40af-9e31-961ca7ce7fe5", "value": 194560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680869417, "uuid": "9811fc21-f3fe-47fd-9394-60a2a582cc72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680869417, "uuid": "6f4d3ed4-34c2-4fd7-9a66-47a823a44232", "value": "362e3c016581f6a7034895bd4d3c7dfb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e5a4613-d581-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680898820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898820, "uuid": "9e2cbc8b-9837-4463-ba20-aea7f1cc9dd2", "comment": "Malware payload (Mirai)", "value": "54afcd5b42039b840fab91e52e8d0f0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898820, "uuid": "54c92257-826b-40b2-8389-56592b1a03cf", "comment": "Malware payload (Mirai)", "value": "210529591e02ee268e06544f545889fd93be92e3448fe9dfad84c8e7c26e2996", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898820, "uuid": "a8c5f304-6b0b-41de-bd9a-ffc5f4be0ae9", "comment": "Malware payload (Mirai)", "value": "397cbac7c03f57635830fc814d4ac9e546ac922c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898820, "uuid": "26f3151b-0474-4be3-b4f4-52e9f1677f6e", "comment": "Malware payload (Mirai)", "value": "dd4b51c29529ac7b61acc26c01c3899ecd7074f864aa681838b66bc2a9e386b867f7856c14ff113588c8a4f4ed550838", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680898820, "uuid": "7e7fea32-2e54-4083-9cbd-ff4006d0a1c7", "value": "T1E783B40A7E218FADF79D823547F74E21B75833C527E1D285E1ACE9015EA024E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680898820, "uuid": "4e6f59d3-ccb9-4454-b7ec-c726d78314f3", "value": "1536:/hXZg7Kjc2OGarydMSy89O/78benUHVwbZnr4r:/hXZk4c2OGaKMSy89O/78PHVwbZnrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680898820, "uuid": "22dc5569-4518-4a74-af7a-8c3ad0abcfc0", "value": 85676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680898820, "uuid": "c4c74005-c4a8-4fdf-a3e1-4db3e690a2b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680898820, "uuid": "e98ec872-9edc-48cf-98ef-bc1d3bbb3b88", "value": "54afcd5b42039b840fab91e52e8d0f0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fdcb9e6-d57c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680896487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896487, "uuid": "b42817a9-4e6b-4b63-a36c-aea0e4dd948b", "comment": "Malware payload", "value": "3fb72cf6ff92384233698bfc9fcec816", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896487, "uuid": "a74d444a-fb1b-4449-bd3e-0d220efd1f38", "comment": "Malware payload", "value": "214458c54a742a990fc710791ef528a180b80555a2b1af23931caf7ab2b5c43e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896487, "uuid": "0c5d1f5e-36ca-460e-b913-89da33357646", "comment": "Malware payload", "value": "7a695b27fbcf453cb83185cf4559a8039ae28395", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896487, "uuid": "40541c71-98c9-4df8-b553-b261532e64f4", "comment": "Malware payload", "value": "278eefe284a828f57cb33c5407d5dd33466813302b904fc6f8c7ddaca53886c3e134007713affd803c02e5caef37bfa2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896487, "uuid": "d3addf84-88a6-4212-a300-00868c8908cb", "value": "T177834A02A781CAB3D5430AF612A79B210533F93B1A2BEE16F35D7DF49B190C47227B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896487, "uuid": "5f68e583-4a66-4680-870e-6614fc9dd3f7", "value": "1536:GMHTuUAjXUOU/1uDimfQhcCYFCc7y4sVH20m2mDPraZ7mLIWVOCjXZRsFS:GMzuUiXUOUNuGmfvCY0B4ClsOFmUWVOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680896487, "uuid": "34e8b16c-99b8-4836-8ce0-d9af3f289d52", "value": 80968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680896487, "uuid": "04f215c8-e9b9-4376-a886-696b5e9c28c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896487, "uuid": "a84ca5f0-0265-441f-be10-dcf1393ccf89", "value": "3fb72cf6ff92384233698bfc9fcec816", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a20932-d578-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680894909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680894909, "uuid": "694373a4-d89e-4ccc-8714-374c1c816df2", "comment": "Malware payload (Mirai)", "value": "f6369c71797e67a00a7a54a10d83f052", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680894909, "uuid": "5e75a011-446e-47ff-b527-d86a9f371f6a", "comment": "Malware payload (Mirai)", "value": "24ca6aa1076af2d7b7aeb09b1c941576191bf60885fec7ecdf244cb86dc1a88b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680894909, "uuid": "7d4e5559-f5ad-437d-9ecd-a64089f8b1b3", "comment": "Malware payload (Mirai)", "value": "8790b99dc1516a6c6dfdbbe2f8b7e5a823cb1f51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680894909, "uuid": "60ce49ea-6817-4436-b947-53b9e200c1db", "comment": "Malware payload (Mirai)", "value": "2c2934153303b6164d7760f39e549fc807c16e96fc0e2fdaad81f2f744f3189bfcbb1c1bb5e34e9a6da6ea3b2c8001b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680894909, "uuid": "8b658e13-ff68-447c-88f9-b6ba362f1a0e", "value": "T127436BC4E643DCB2D8171630147BAF37BA76E6E91224E746D3A8A636EC51702D017EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680894909, "uuid": "a63f6681-ad36-4bcf-bbdf-a31860879046", "value": "1536:BF14yTUx6Ahc+IOROP1NEqRaSblcMUiBVFrVJwbZnm:B/4yTUxdvIOgP1CqRt5cMlrHJwbZnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680894909, "uuid": "07694ced-2369-4b7f-ae84-e5eedf842f8d", "value": 59088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680894909, "uuid": "35c00a8d-04b8-4532-a005-886415889d5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680894909, "uuid": "1b2163c9-36a1-40f3-98e6-06a06071db75", "value": "skid.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8151b7a5-d506-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1680845943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680845943, "uuid": "eeb2ce6b-4aa0-42df-93e5-6d8cf8feaf23", "comment": "Malware payload (Stop)", "value": "64e7ee77b42bfca870d244eaa359f410", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680845943, "uuid": "e2e5e504-683d-4a01-8b8f-b7379b4d9770", "comment": "Malware payload (Stop)", "value": "25345420d829852518163412439862df6bebd2f26a114eb2b780103da9dfe452", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680845943, "uuid": "29212c1e-dc02-40ea-8e27-9d91437c8fbb", "comment": "Malware payload (Stop)", "value": "36befcd81396f1adeac14cabff11c8da2413f8de", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680845943, "uuid": "7ab0a06f-4d2a-46db-97ed-361dfd7de814", "comment": "Malware payload (Stop)", "value": "1bcadb380292aa65ef090692ec5e34b581483b41aaec09759eaa97016b0436a0fb8f857b503a721f9c1e44de873cf3ca", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680845943, "uuid": "0e8a5596-407e-42de-a644-ea14f80a02b0", "value": "T18FF41210B665C0F6E52791715839C3F9667A78738B988AC733942F2F1E323D099AE347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680845943, "uuid": "5e8a3b78-a237-4386-9e9e-58e2a8fd625c", "value": "106eb5dbb7fdc2adeef530fb10849030", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680845943, "uuid": "6348985d-ee3d-43ef-8cb2-1b04e0629a76", "value": "12288:wrDhagMs5T6whOaZ+m8CElPVeL8HpITpYYVpw41eg1sHxP1jZAsVHADOia:SDBMs5T6IO6GZPIdYYVH90ZfAsVgDHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680845943, "uuid": "a8c2b244-5e06-4cc3-a1dd-02805d7e6584", "value": 728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680845943, "uuid": "5777575b-4c38-4037-96b8-c53990bcfce7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680845943, "uuid": "294b1f27-ecf7-48bb-af31-2bed47b45a1a", "value": "6D7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fee367d1-d4dc-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1680828115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828115, "uuid": "2d9244fe-aa6b-44bb-9ebd-2497bc1712ef", "comment": "Malware payload (TeamBot)", "value": "f4a180ea32fe97e3f7bb5c5282c16604", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828115, "uuid": "14d7bb7a-a455-4325-849b-f4928825a752", "comment": "Malware payload (TeamBot)", "value": "25a62dcecf6792b51a4209a112e14a86a506360802d3e51edbf123237c12ef51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828115, "uuid": "d1e40824-1580-4cc8-bd71-e135cb0f7602", "comment": "Malware payload (TeamBot)", "value": "fd9e00ac9ef382086e27481e08f283e4a3823a5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828115, "uuid": "6c335f27-2a7f-4138-a4b5-7c1dc55967b2", "comment": "Malware payload (TeamBot)", "value": "cabc848bbd0229f3cb09fd49da7f1b8a5e4b870637c0f2302031b40acba2ab3469c44b41b0ffe893e34c3160a335c7a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828115, "uuid": "677ad2d5-35c0-49a4-b75e-dfdb34564f6c", "value": "T164646C0263A16874E6124E738F1EF6F8B61EF8B0EF67FB5922695AAF0D70171C152314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828115, "uuid": "979d7575-1cf4-44d0-b106-594b76521fea", "value": "2b092cb2db51c3e3bb5667c747571bb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828115, "uuid": "c0bfcdcf-1ebb-421d-923d-fe8866aa4582", "value": "3072:rQvCbxqWuj0TY3k3vmrfnL+A7NMLRSa9bFp4x1Oa8JH6TrCjLAjy:kTj0Ck/KLNMLR/7pg118cTrCjUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680828115, "uuid": "454d5c6f-8046-4728-912c-f1d9ef6d1e47", "value": 308736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680828115, "uuid": "9ef735f0-174b-4cf6-bc17-7cd4efe9a337", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828115, "uuid": "c1cf77d5-f117-4df8-8330-388146481993", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1918d0c8-d52d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1680862518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680862518, "uuid": "6594570e-e694-46d3-8e4e-5d5510553cd0", "comment": "Malware payload (AveMariaRAT)", "value": "e0bfa34f74e3f3f548185181eb442105", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680862518, "uuid": "a17bbb68-18f7-452d-bee5-4f43d2980fe1", "comment": "Malware payload (AveMariaRAT)", "value": "278204424247e95a3276836815e6c9b392364070c91512bf8e97f4f09d411b21", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680862518, "uuid": "dd8a0e2b-a1f6-40ca-a333-717a45180494", "comment": "Malware payload (AveMariaRAT)", "value": "bb786ac480d02fbc15242a1a0b786267185479ea", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680862518, "uuid": "dcc20d22-4950-468a-99e2-f4c8c059b61c", "comment": "Malware payload (AveMariaRAT)", "value": "648df49c549b6eafa9b07401689884095dbc9768ad5ea0ab61e123332ba15cfb8374eb5977096167586ea4f2885fdace", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680862518, "uuid": "d5ebeee1-302c-4569-8dfe-34850a98bb0b", "value": "T14974BFDD628F5B9DC8460E7291B68C1C6BB15ECDA1F3CE67378D02E449C73624C5C2A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680862518, "uuid": "3d7c8320-9d15-4b6e-95e9-da3d88a5bc13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680862518, "uuid": "7ec66abe-2473-4d40-b1df-e098f6942bf0", "value": "6144:B7pXv4992/UNJ3/iCc6TGAv3xCnvUy0O12udoEUAtI:B7pf56KCc6TDPxEswldEAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680862518, "uuid": "1ce5eac4-916d-4dc5-8de9-f8488bf7fdbd", "value": 355560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680862518, "uuid": "ed21a8c4-eb9f-4657-ae69-bf98f2d409c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680862518, "uuid": "8a20518a-dac2-43e5-9302-2aa4f23d7ed7", "value": "List of PN 2612412-1A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "836f97ec-d4e3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1680830914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680830914, "uuid": "2a342ff4-063d-4c9f-9500-50dc8ac6127f", "comment": "Malware payload (AuroraStealer)", "value": "78462baf56c10c4a1aee9dd38eb37bdc", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680830914, "uuid": "844083fd-0517-46d3-8a26-2b94987ee096", "comment": "Malware payload (AuroraStealer)", "value": "29339458f4a33ee922f25d36b83f19797a15a279634e9c44ebd3816866a541cb", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680830914, "uuid": "4977b3f7-2a07-48b6-b8cd-ef8b57814d15", "comment": "Malware payload (AuroraStealer)", "value": "e166b85e91ea4fcd66f0400d9f022bc437eac11e", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680830914, "uuid": "44f35cea-8676-4310-ba77-c91726f8451d", "comment": "Malware payload (AuroraStealer)", "value": "8831bffbd3f84a35a1b589931e47649ef881db3cffe477139e206de9cfd6faa83e4e0f8c1a3c46b7b19522f020d19970", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680830914, "uuid": "4d558f2a-066e-4137-8e00-7cd7d7365853", "value": "T1E7E5F890FEDB08F1E50319351896A37F37351E0B4B29DAC7D9503F5AE873AA10E32669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680830914, "uuid": "9bd87ec9-1809-4857-8e06-e22d0631784c", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680830914, "uuid": "1adb1617-2c8b-45f6-8e17-f677356162e9", "value": "49152:k2vK4D+psO1DSBvHSmL1Xdf5k6N21D5Mgwp1haASvh6k1S80:kotD4sKYvSmRVSQ80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680830914, "uuid": "24f8f37c-24f1-4861-81e3-7ce1652ac06b", "value": 3294720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680830914, "uuid": "c10dc30d-51ca-41e9-a9eb-fb91d29d678f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680830914, "uuid": "3a3a9a35-54a1-4c27-9adb-f57e203f9c6f", "value": "InstallerFilex_64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ae3564-d575-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680893524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680893524, "uuid": "708beaaa-981e-4916-b5d6-0745b5ad6ec6", "comment": "Malware payload (Mirai)", "value": "da22e576d55938e426e8beba720f947f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680893524, "uuid": "3c4726e7-a851-4da9-bb2c-1f2db49e451d", "comment": "Malware payload (Mirai)", "value": "293e00bf381e708bc51ecc5dba126f47e2641c52563f60ca4594f78cb25f2072", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680893524, "uuid": "e254df5e-c5dd-4980-9027-9c93a84702a0", "comment": "Malware payload (Mirai)", "value": "a8d85883d290ae5d2f5ce655a7d2b23c0b56af90", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680893524, "uuid": "5bfead43-dcd3-481b-8735-16cfc19ab39e", "comment": "Malware payload (Mirai)", "value": "3cbb58a221b193178800e85725b773442f26c277b787047ff37a45045a9329c7abecca47742ba6696202167fbf529be7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680893524, "uuid": "185bf37c-94f5-4046-811c-8a5ea7fbb2b3", "value": "T136632BDAF801DD7DF81BD77A4453090AB530B3D512831B3B639BB9A7BC721A81912E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680893524, "uuid": "245edca3-6a9c-48cc-aa53-2020f5c40b6a", "value": "1536:vAgV/sxE+CNDY7Dm8VJyyE1sxQWbxdJ3rWNzE+VQRy:vAQ/sO+aE7DiyE1GQSx/B+Vwy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680893524, "uuid": "5c168bba-a2f0-4871-938c-db0139bb6435", "value": 69636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680893524, "uuid": "a5da9c96-3b69-4759-9e1e-fea0d8a59b2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680893524, "uuid": "3479cd99-c372-4e15-afc8-3066bfa66199", "value": "da22e576d55938e426e8beba720f947f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b49231e-d556-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680880158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680880158, "uuid": "e119ec6f-fad6-450f-a20b-0243be2580d5", "comment": "Malware payload (AgentTesla)", "value": "eb8ed5f1553d8a1fe703c3f63aa605ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680880158, "uuid": "68827b22-bc31-46f8-b47e-7d96268cc988", "comment": "Malware payload (AgentTesla)", "value": "2a2e8d2d561e5f1b3173cf06ae889a5d6aa531b75448099291f7923a572967ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680880158, "uuid": "6ec3218d-8826-4a95-8d6e-56c22bf6c682", "comment": "Malware payload (AgentTesla)", "value": "4e96e7e902618e527e823df7be10961f5cf29e28", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680880158, "uuid": "d375c993-975a-4dea-80ab-5b5e7058ae78", "comment": "Malware payload (AgentTesla)", "value": "cbaf92c34d694d9c5afd6017124df6e6c6976ace8cfd0efcd4611f123aad03ddd29a5fefbb196a39e7071d5f2348a504", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680880158, "uuid": "36b5aa01-a524-40bb-a0f0-20f7b3a4136e", "value": "T1FC05909436DD8A83C027EC30A15587B2C2D58D19F0B9B6EC38567F45F19EB5038ED8AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680880158, "uuid": "32915985-d98f-43a7-a155-067e922e090d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680880158, "uuid": "2929c10e-64ec-43b5-8789-090d3bbee81c", "value": "12288:1D2iN+7REqDw+tuuZ97DVu+z9x/yiP2dDhOVLPq9Go1Z+AUKRiyVgh2eVH:p1oEqU3uZ99u6py/OVW9GoSKRKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680880158, "uuid": "506da18e-f5a5-4806-a2f5-00b5b282559a", "value": 837632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680880158, "uuid": "4f9c3a00-d16d-47e0-aa84-8be4d506d086", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680880158, "uuid": "35d7d005-bfd5-4187-ac2b-86e759e25962", "value": "PRINT COPY pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a8ef08d-d564-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680886170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680886170, "uuid": "9745f81f-7f3f-419e-8cfa-07533ee58775", "comment": "Malware payload", "value": "b514c66d928a7b2d23fab05a481d6d8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680886170, "uuid": "1e360c76-f962-4aa8-8114-3f255e3cc5bf", "comment": "Malware payload", "value": "2a9455f887b93371e07f15c69046771c57d2a9a52ebb34b362b809c6ec77eec3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680886170, "uuid": "8ee91332-70ad-4edb-b0f2-3c1eac4e2b10", "comment": "Malware payload", "value": "580716bf464b3bae98b8ed3afed32c0a7c03a78c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680886170, "uuid": "60c83d72-5e8c-4945-94a2-1c2fd62f8ff5", "comment": "Malware payload", "value": "67d16099e40cbbd1f041f398f301fe6967b059afacf190615a03594bb1fcd1300709a7accef6382f3261f95e2c89d754", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680886170, "uuid": "9e05940a-0fe5-4eaf-a648-9e44c90b6484", "value": "T17DF2B707AF914FA7D86FDE7746FB0B45218EA41626A227263538F87C734B0CE18E3564", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680886170, "uuid": "a4ca3830-321f-4090-94d8-535b030bd0fd", "value": "384:k5QexgQ25lOcirAiKVZj+1mbFD1SfeOeYFePqhFKXiWEtb5qzjDjURNGCN7Styp0:tt5/VgfeOeYFeysXifp5qfEJSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680886170, "uuid": "38e14c6d-f0c1-4b7d-8c51-4b78831d7d35", "value": 37609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680886170, "uuid": "0cb415e3-d2a0-4296-8f13-91a5076522bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680886170, "uuid": "15346f5c-061a-439c-bb38-f78381a9e8a4", "value": "condi.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d30e09b-d4e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1680829535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680829535, "uuid": "7f5b9599-ec6a-49aa-a491-1eb6e26d146e", "comment": "Malware payload (Quakbot)", "value": "a46c696d1afb964a9dc8b838e8978bd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680829535, "uuid": "b84ba8ad-55ae-4c74-80e9-1f003c811eb8", "comment": "Malware payload (Quakbot)", "value": "2d9a718e60238a696d4616ef279c0a99a05d1fbb2efaded26db1f0c3ba5acde6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680829535, "uuid": "5ef4fc79-3dfe-4de0-8010-1597a61a3bfb", "comment": "Malware payload (Quakbot)", "value": "edc5ee2ebb8a7f7563a102ce5ee35c5c50276cc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680829535, "uuid": "53f9c666-8ebe-43e5-98c0-afeeaa93616e", "comment": "Malware payload (Quakbot)", "value": "7d1156020abad61b038899d48793497a4867ba33d73d2d8507e37235eb4e8f70508405a1c6b108f8751bbdfff996bac7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680829535, "uuid": "7f98fa1e-fa61-41c3-9cd8-4c49ba877702", "value": "T17DE6AD1580EC4EBEE719CC30A19DE68333F3FE956678EF852865AC905D1F4A0B136AD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680829535, "uuid": "5d226027-f59d-443b-96c0-302c18bdf393", "value": "7285048754dea1996ef8dd3b183f492f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680829535, "uuid": "8ab85f25-11b1-4e8a-a9e1-74c895b71c84", "value": "49152:LfNqvX0brf57E7CMelJadKe3fUZ5TwEktnXhCLfmP+JhkCXfHz:sv03xQCM/82fUZWXRhqfmP+Jhkkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680829535, "uuid": "65791c36-b402-4b8a-9d79-fd86efa89cd1", "value": 14160896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680829535, "uuid": "83a63ad5-195e-425e-8803-348cc1d83ac5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680829535, "uuid": "f76be0fb-6f5b-4d24-ab8d-6ede5c2d677a", "value": "2d9a718e60238a696d4616ef279c0a99a05d1fbb2efaded26db1f0c3ba5acde6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cbcffec-d575-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680893529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680893529, "uuid": "971ce5c8-feb9-461c-a9f6-d5091cb4ab64", "comment": "Malware payload (Mirai)", "value": "6eb996c336cb1ae9622a91685526a288", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680893529, "uuid": "cbc043da-5d2e-4973-8576-380d770b3284", "comment": "Malware payload (Mirai)", "value": "2d9ad426930e03c4d5f17a412f14aa32b452ae4f24e502aea6ec34bece26dbc1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680893529, "uuid": "e418f267-a3f3-4d44-88b7-c223ddf95382", "comment": "Malware payload (Mirai)", "value": "e6f46fa6ee428e928b7c3954f0385e3954136868", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680893529, "uuid": "b0447064-b877-4b6e-b4ba-0c8c4ef67c60", "comment": "Malware payload (Mirai)", "value": "bb6f73296cf0ab632195e52e789c02703934dbad70e65d1ff52adcb5c5d37d3070023c0ff03c3cb6dec64d76f92b96de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680893529, "uuid": "784be703-db9a-417c-8ddf-4c285938c14c", "value": "T1F4E33B56EA408B13C0D61779B6DF42453323ABA493DB73069928BFB43F8679B0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680893529, "uuid": "a5a4e6f6-563e-4cfe-b60e-7034b35b7dcb", "value": "3072:CJLce3pC5m97/abHbz4NpaIJ8VIJ1FOUXkkTM/9cHMY:CJLceZ/abHbz4NUIJxHOUXkYM/9gMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680893529, "uuid": "42fee0d1-12b8-4da2-97c5-0b633197500d", "value": 150594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680893529, "uuid": "bd42d643-cac9-417f-b962-67c4e9609843", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680893529, "uuid": "3a5c1352-2197-4cd0-86b8-f5ec5bbf10a0", "value": "6eb996c336cb1ae9622a91685526a288", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1da4c54f-d564-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680886148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680886148, "uuid": "4afed3f3-c432-4e0e-a5cd-4fcbf474b865", "comment": "Malware payload", "value": "7e3641023acd0a5fc844cdbd92eb5056", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680886148, "uuid": "0d454064-8adc-49e7-8e54-4b8bb1c85a01", "comment": "Malware payload", "value": "3180e544fb37db17e69c9c5d5b00c77c3fe17dc7f5cb00543ba5289b10e0df55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680886148, "uuid": "73fffab1-d5d0-4c44-b3c7-ff5cfd54833d", "comment": "Malware payload", "value": "c4af2411b032eb50e15c5ed5cf9cde553cc2088b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680886148, "uuid": "d8a1ce76-5546-4d76-a906-70f6301fb743", "comment": "Malware payload", "value": "ad425a71f6f4ab41cd0096aa71341efa727ffa6bc4ff1be9cc07a8d2bb90c1b05be74052978c4737672b0b2387fc4b76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680886148, "uuid": "32d1d714-9f45-4dcf-ac86-b4c09c648f8f", "value": "T1E1922A85FD45C905CAC4563AFA9E828C3B265398D1CE33425F1A7F926B46C2F0E3F954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680886148, "uuid": "615b8e26-0936-4a2a-b0e3-51802c99484d", "value": "384:RxbpJ3r2Tu3K/DJkgs3YMqFCShziQ2n8l01p1W4vuOFx4e:RxbviTu4egSYx34Q2nk4fvuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680886148, "uuid": "b3157dae-462d-42c7-86fa-569e18caa777", "value": 21088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680886148, "uuid": "ea8cb177-745f-4237-a55f-09be9dcf1d06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680886148, "uuid": "fec10cf3-8df6-4441-bf94-ef19dac3819e", "value": "condi.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f253ae-d581-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680898836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898836, "uuid": "16703f7b-8180-423a-be2b-cb223a0e1185", "comment": "Malware payload (Mirai)", "value": "ada48c93fae34b6c5fc4ad0972b2d467", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898836, "uuid": "059ea374-1124-4d80-bf9c-b42fa1d639bd", "comment": "Malware payload (Mirai)", "value": "34a07f42b8763a33c19c91a826d64848d1b4bf0a6c3acbbe87ac8fa562adbc6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898836, "uuid": "32c6714e-6f58-4d85-ad3f-965428a0ab2d", "comment": "Malware payload (Mirai)", "value": "368b3252341ac831f433cd0d76fdbd99c583d59f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898836, "uuid": "c493006f-97e9-499b-a837-1aa2f36fad88", "comment": "Malware payload (Mirai)", "value": "c67f1733564ffa283ee07cc4dd8fe6e45288561d57d43805c0d95afd80d5dcae953b1d197462c57653653ee5d9aa7044", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680898836, "uuid": "320209e6-3668-41f2-84ab-f8a4ed2dc979", "value": "T1BE633A95F9815A13C6C612B7FA6E428C3B2513E8D2DF7203DD216F217AC781B0DABE51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680898836, "uuid": "6ba790df-9f58-44d8-af9a-3f6476f36229", "value": "1536:qnyorX4GaLAiVhWXi8/CAkBfHHo5Yrouvy6wbZnN:qnOZVhysAsfHHFny6wbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680898836, "uuid": "c69dc50a-e2ee-4926-bdd0-44b451752154", "value": 70972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680898836, "uuid": "069a67f5-9fbc-45c2-8ff9-20fedf2c5365", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680898836, "uuid": "c554277c-77b5-44f2-9365-fc9190724ef4", "value": "ada48c93fae34b6c5fc4ad0972b2d467", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6318c8be-d4e9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680833437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680833437, "uuid": "ce59defe-b47f-4ee5-bb90-8531d0d06de6", "comment": "Malware payload", "value": "5e449d7602d149abfbd3f6b5ebbd6283", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680833437, "uuid": "a9438a6c-d5f4-48ed-9430-d010b5581f7f", "comment": "Malware payload", "value": "34a5ac46eb4168e04ea8c831c0ca9767242f0a4c1e95f9b33424a84b3492e1fc", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680833437, "uuid": "23fbaa25-99be-4d79-bbfa-aa4a95bce58d", "comment": "Malware payload", "value": "45169b74ddcfec68dff15478ad2c3fa7a900b91d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680833437, "uuid": "e9cd5d6c-2e45-4946-9d78-65fd0b71eb9c", "comment": "Malware payload", "value": "b5b5425038e2f8b9349eadfce267eab55d942b618cae3c7bf217e6f896304418b93770be52fd5289037e29bce5ff0162", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680833437, "uuid": "8d634b9c-e488-4581-bda5-f922450f97dd", "value": "T1F0D50182F318B42FC877C0335AB6063661568D598A86E7531959B36CBCFBEC44B85FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680833437, "uuid": "f2ab3a06-95f2-4b60-b093-391d201492d9", "value": "49152:pp1+7CVajfzbNdHOESERoiBPeWp9AtCqy805sQwZt70lJ0NtxpUYy:pHFo7zb7MiBPVjAtCqyHq9k0Nby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680833437, "uuid": "c2ef05fb-c5d8-42b2-ba71-be7798b839c1", "value": 3000963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680833437, "uuid": "9ee69296-a578-45f9-8235-707e386d4ce0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680833437, "uuid": "f640f2d6-8416-401b-92d4-669946b1c9be", "value": "ss-kids.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b27423c-d558-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680881178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680881178, "uuid": "b38f3d7f-09f8-4b80-be71-7063b65afc9a", "comment": "Malware payload (Amadey)", "value": "6809ca52cdc1bfffe3496efd3e2409b5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680881178, "uuid": "2562bc8d-4497-4ba2-b763-c4360cdae0a6", "comment": "Malware payload (Amadey)", "value": "36102822cb63b04fe1ae8268519a7a854a4bd8e763c93fe17908d56838944f4a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680881178, "uuid": "89f449db-d32f-4fde-9f23-309ceed6ff47", "comment": "Malware payload (Amadey)", "value": "44134800f629ede1e7152aaceb1789fa43fe24fa", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680881178, "uuid": "c9eaafb1-a6e8-4319-976e-d9363c8540ec", "comment": "Malware payload (Amadey)", "value": "ee04546cfc8508be1297b8191aa1b436b25c40355f9fd0eb20819410be9733c2ab36da7fd84aabc4408395842ab0da91", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680881178, "uuid": "1ed06c41-3b48-4137-86d8-ef6973f0a324", "value": "T14534D021BE90C8F7D41344749829C1F839FDBC939B958A9733483FAF3C362916A6E651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680881178, "uuid": "746059ac-5554-4044-94b8-5271fa02ad32", "value": "0c473655039a754e9f814d9a583e5330", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680881178, "uuid": "82a7f831-c3db-490e-a418-629510f9a791", "value": "3072:MabAlDDNRpGnZOuO+s8GpatTnev28sxiQQpXr0GpT47J5WVmTQ:zA1JREn9ds8aqnC2LxfsXrNTdVmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680881178, "uuid": "b11d6df2-3998-410b-96a9-5ff7e77ad926", "value": 233984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680881178, "uuid": "604c9695-29a7-49b1-bfcc-5ae55bf4667a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680881178, "uuid": "e6b0e338-be0a-4104-aa71-1729b3eec67c", "value": "6809ca52cdc1bfffe3496efd3e2409b5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30676e22-d564-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680886180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680886180, "uuid": "ea05d1d0-865b-4fe4-a7aa-e34518acf758", "comment": "Malware payload", "value": "418f91972eb2fd901b92d02b31e8726d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680886180, "uuid": "36399f1e-87df-42fb-b707-4e3385e70137", "comment": "Malware payload", "value": "38796e0ddc6d8b5535e904e7fff75469628cb2bfd6ab798f80b4e3fec6db3603", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680886180, "uuid": "677cc064-958e-4cab-8f3f-b3b9a1adb0c3", "comment": "Malware payload", "value": "12c079278055594480469f5cf0a5cadd437bc513", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680886180, "uuid": "8b14c8f3-a0d1-4b4a-836e-57de5581d15f", "comment": "Malware payload", "value": "bc4e5893ae26a6c2832e6fe3bf0a8f33d4c474ec67a2d064f41c74720d982b6c11e8de9de5116c08963414da69035925", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680886180, "uuid": "598691ff-0b45-43ae-80f6-99f2dceab958", "value": "T1AB8218117692D8BCC45DC2F8255FB93AE536B42D433A338A33E4FE278D4BD117A2A844", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680886180, "uuid": "bae55da6-f244-43fa-9be4-c9241a1bf871", "value": "192:GWKBHwaDyss4sj6+eLa037wJdn0opaiKnRVVI2Aq9G0lmcaV+9JC3gRC94uZdbOv:YBastsrVnfwiaVVI250V+PXRcH7V94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680886180, "uuid": "a462e4a2-b794-4e75-9301-d5b965640d34", "value": 18728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680886180, "uuid": "e5222377-93d6-4985-bc5f-33e52400c152", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680886180, "uuid": "e1535a2a-1701-4da2-a6dc-826cbcb26735", "value": "condi.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb26d132-d568-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680888131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888131, "uuid": "9668e91f-4580-4bc3-b155-e2871a3d0f2b", "comment": "Malware payload (Mirai)", "value": "65bed1cf866f8333992de580248f6065", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888131, "uuid": "92660413-ac5a-4de1-9aa7-78280ed41005", "comment": "Malware payload (Mirai)", "value": "38b1a326918a58365c137e4a20e813bad8a1fe1a90f45a2446d1dfa0487f1338", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888131, "uuid": "6f277689-cd80-4e5f-906b-cc3c53ac021d", "comment": "Malware payload (Mirai)", "value": "8baad99c8649467eb763d2a79f6b6151c2e613d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888131, "uuid": "1f2fe570-9c4f-4f01-a9a0-9d670e130dcd", "comment": "Malware payload (Mirai)", "value": "497cc0e9c3ecfc4ee9d1e1078d689b73706dedc977eae5e5dbd9817aeeeb866847f1312273f7435d38d90dee585b4811", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888131, "uuid": "b7e44162-88c7-44bf-a2f3-f33dd6c0bdc5", "value": "T16B131B42312C0E5BC6A25AB4253F17E083FFE9A024F4B589691F9B5A4A75E3710C2FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888131, "uuid": "35917467-bb0e-422c-b1f7-e76fe8ea1e68", "value": "768:sYUvo6gTJ1GshCgR/O34NRs5KRJ0IGwblmHOJVM8RbwXJA0Zql1S:0jgl1GuDlO+cKQIfmHzZA0glQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680888131, "uuid": "b7222414-7356-4c4d-a5a5-7e9494e9d22c", "value": 45012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680888131, "uuid": "adfc32c8-1039-4cf7-9681-caf40a9ff1b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888131, "uuid": "cc462be7-d079-4efe-b211-fb9518dfb2d3", "value": "65bed1cf866f8333992de580248f6065", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a730106-d56d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680890062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890062, "uuid": "a40619e9-f79c-4df6-84d3-ecb62701ad23", "comment": "Malware payload (Mirai)", "value": "367fbe3c97cbdd2b4d3d6a6b72927ffb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890062, "uuid": "deb4c597-db87-42dd-9838-f0ea14f6c901", "comment": "Malware payload (Mirai)", "value": "38b58c5e31ee11222b5e2e426feea6581b50a2f8e1924ace53b5bda943ca508f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890062, "uuid": "b080273f-4aa2-45f0-9e30-6afa5b95f74e", "comment": "Malware payload (Mirai)", "value": "470acbed21e4c384a051d8afcb4bcc57b0855d77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890062, "uuid": "8d744380-5625-4774-9ad7-3d9fce2a2423", "comment": "Malware payload (Mirai)", "value": "b03441edbba4781f4a829a80e2c7ce5dda1a1812acf500f6260d888d523046a4f79ca06b8940ca22ace7d0a8e5783e9d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890062, "uuid": "8c94bb08-0ef3-4119-96e3-07865d2751f2", "value": "T1DB832996B900DDBDF88BDB7B4812090EB171B3511FA31F3B636BBD53AD231A54816E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890062, "uuid": "e5fcb41e-5de1-47f4-a07e-f5e324d0020e", "value": "1536:XvxKxbMycNPey3qW6UxONPpCJCFZ9uo8PIaFURCYKJa4Xn7fFMn1eTBnbL:/oKPey3qW6UxONhemZ9uuSYIa601eTBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680890062, "uuid": "0b40b991-b4a0-4eed-9a6f-9942e270ad14", "value": 82300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680890062, "uuid": "d6c92626-37a5-42a6-afcd-cb2dbcd49216", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890062, "uuid": "9fa0d51b-9ca6-4e41-a0f1-6a58eb55a761", "value": "367fbe3c97cbdd2b4d3d6a6b72927ffb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15305730-d52e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680862941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680862941, "uuid": "41b683d5-539d-4a8f-83b9-554d25464e39", "comment": "Malware payload (AgentTesla)", "value": "0c52de261880d5145c811dfb3fa95413", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680862941, "uuid": "549ce257-e6b4-4b4c-b16e-9bc58c43acf1", "comment": "Malware payload (AgentTesla)", "value": "3a8dbfe9000ffddd2f6ae55535e43bfd2b422772445dc27b5777a7bb8b14ebbe", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680862941, "uuid": "c90c985e-771f-4da8-bc4a-ad7ab8e105f6", "comment": "Malware payload (AgentTesla)", "value": "38810bd350ef98c3530c662f205822f0b2d471c5", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680862941, "uuid": "32790a47-7642-4b4a-8061-b75edbaed6e1", "comment": "Malware payload (AgentTesla)", "value": "85742c82f995d5c5569750838b108f7d9af4a84355fa6dd87c3c47b5a78feb5266ce0f8d8f29ee87940dd4910dc5bf55", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680862941, "uuid": "52429dc0-7d68-4fe1-908b-47e080949719", "value": "T162D423A53097758E2EE2B3873191C32B51275D87704FAA63BC556F4EE0B4A58EB012CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680862941, "uuid": "287eaf59-4090-4732-847b-c144a2c531e6", "value": "12288:opU4Av7vSxUokLY1W0QRjcnPhNEvnYLpmoru1dJ9QFLnYDDg/:0JAv74UoYONQR4PhNEvOQfPQxYDU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680862941, "uuid": "9d4111a8-78a7-4ed1-93b4-e89b4591212d", "value": 613972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680862941, "uuid": "f4ed3d35-904f-45e9-9d40-da8d02e73f37", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680862941, "uuid": "eaeb267d-2e30-4c5a-9910-1490436c0f42", "value": "Design & Drawing Details-0294888939.PDF.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b7e4e1-d4e3-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1680830883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680830883, "uuid": "1aa439a7-321f-4252-8ca8-4bfe3b2cf5a7", "comment": "Malware payload (DarkCloud)", "value": "44d794af29a5fd4b181c8df9132b842f", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680830883, "uuid": "f8edfd8d-a352-4748-a1e6-2c47eda350ec", "comment": "Malware payload (DarkCloud)", "value": "3ab507d581b15a3ab4f0069436f49e77d80fb40f00c8218fd5f41815da3b46fa", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680830883, "uuid": "2b808be2-b72d-48c5-89b0-384fe1bb48c9", "comment": "Malware payload (DarkCloud)", "value": "05ac5ceb201d04958623395a56b96b02ba3f6711", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680830883, "uuid": "9fc960b5-4a3b-48fa-9d32-11503b3271a2", "comment": "Malware payload (DarkCloud)", "value": "d2b4b659686b8658615b23df2702cd3542e912603ff098114e75ea7c50817a75bfb4fce60dce8fa1f6f7c0feeabe5e8e", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680830883, "uuid": "41c84663-2bb6-45f3-a321-ed92f7ca76e7", "value": "T1D8A4231113F0E0E7EC53A7B00BBD152BE9FAA0A494B2CA4727D4967C7B161C34A5D3A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680830883, "uuid": "6fe34579-b7df-4bf7-b5ef-eef50d887e49", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680830883, "uuid": "3fdd5323-ad15-4e34-97ad-9c5542a47be7", "value": "12288:/YZQ4LfvXQJ7IRrzuXjCk6caJqGDv1xyrwE:/YZQqfvXQKxzuzCNca3DvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680830883, "uuid": "b5773df3-930f-4bad-b0cc-c7876979fb5a", "value": 450352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680830883, "uuid": "bab14343-c925-4c78-b5a6-729c39767698", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680830883, "uuid": "0e8f99b4-d1b5-41aa-a153-314e1caba6ac", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.18706.3341.357", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62cf6784-d56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680890989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890989, "uuid": "eeff1f0f-1f6c-46e4-8059-9ab979e5a2c1", "comment": "Malware payload (Mirai)", "value": "00af6577bd10f432197b50b3915038b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890989, "uuid": "cf361aee-b3f5-40ed-a01b-cb443cc47566", "comment": "Malware payload (Mirai)", "value": "3abd676637d50c5eeaa5664744a2e96c68c1303a758e1547552705bf0098d64d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890989, "uuid": "196b12d7-a8c4-415f-ab76-93196814bccb", "comment": "Malware payload (Mirai)", "value": "f37d26a759a289002c1787936816bdf1fad96bed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890989, "uuid": "0a60d5ae-57e3-4576-86b6-ebc05462a1f7", "comment": "Malware payload (Mirai)", "value": "bbfc98145d4c149baf3551ab8b0b36785f48a0648ec8cd179e1b0b054c784a9746ac3907f2f35dd93f447c83b5ef5848", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890989, "uuid": "9872a222-e673-4b7b-9e11-7d1354e9ab05", "value": "T133633A21BA761E2BC4C1947621F74B25B2F143DA26ECCA0A3DB10D9EFF719846543AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890989, "uuid": "17fc3da0-bc00-4333-867f-ce10ccca9984", "value": "1536:lGRaTYmol/hGIAs4PNvAOQ4Gm75123tStRl:lya7hJlGmVDLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680890989, "uuid": "b91d8505-956a-46b3-bd32-2e05f29807e0", "value": 67320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680890989, "uuid": "238b91f7-7b67-415d-a530-cc39b609c0c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890989, "uuid": "47ed7683-ae92-4dc5-bb6b-74f96ea3216d", "value": "00af6577bd10f432197b50b3915038b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "985c2c4f-d593-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680906541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680906541, "uuid": "a529eb86-6217-47b6-a204-0159920dfe26", "comment": "Malware payload", "value": "882cee72c88a2e23651e05d2fb0b99a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680906541, "uuid": "8e967465-c935-4f80-99e5-4df92e87c71f", "comment": "Malware payload", "value": "3c236451c832e2dab156e133f508a50359cebfcce8c1761a425ae333a5a2abad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680906541, "uuid": "3510bcbd-74f1-43f4-8ee9-abe9f8f68bc6", "comment": "Malware payload", "value": "bc175f2f56373b40de3329630718c26395c445ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680906541, "uuid": "b8fd4dce-f765-42d7-a9e2-afc999e3de6e", "comment": "Malware payload", "value": "2fc157f6bac5aa0e37c5924b1cb218224687fbc5741bb09fc241d31220be13d9d31dd4c38c06fced4f3b103feeb1aa0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680906541, "uuid": "86141793-e91c-4808-bae8-a0595a6dadb4", "value": "T12EE36C07B3D14CB7F0F30B789D56B225A43A7D102E35934E2FA48A0D2E2E6D45A1D79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680906541, "uuid": "6f370d9d-61c5-451d-8732-e5b257dd9a22", "value": "26ea1b45766fe26f9c40750d36f4cf7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680906541, "uuid": "5008a495-478d-4f35-b18b-c4a78b174f4f", "value": "3072:1JVD1zx0HrJvtuKm8wVKQ3+nBgBDbQID3RjfpbYSiTWNLkkk9:jWFvSH5bQ+hjf5YSuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680906541, "uuid": "67a27e34-6b79-4af0-b779-c7f3b5f66b3a", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680906541, "uuid": "d978173d-d2fd-4b6b-8cd0-f745f50c5187", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680906541, "uuid": "350e27f6-4d26-4d43-9d8c-cb9956d9511d", "value": "Drivers.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b899015-d594-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1680906922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680906922, "uuid": "516b7e71-d8b4-489c-b049-fcff15807fcc", "comment": "Malware payload (AsyncRAT)", "value": "0dc031b250a9f44650a1663a68aaabdd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680906922, "uuid": "1bce4d75-c850-4178-968b-91167b1f51e7", "comment": "Malware payload (AsyncRAT)", "value": "3ca62446334936a4a28b9e02b596899442eb8af568530c7a9f619a8e70a9dc8a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680906922, "uuid": "2d458c6c-8793-4d36-9fbe-7c7955916e72", "comment": "Malware payload (AsyncRAT)", "value": "901a5d7033253a97d2721c54b74fee82262dc69a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680906922, "uuid": "5b5f6053-e062-4c00-9fdc-5ac08693eaef", "comment": "Malware payload (AsyncRAT)", "value": "f765f93934b5748d6e748a33275115c863f0d48804a8d7f6f301c840e8bb8f0b554313cd15b7f9d927afc17be9317f73", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680906922, "uuid": "2938ba4f-dd51-4b51-9246-db2d2576ea08", "value": "T165532C003FE98529F2BD8EB499F3B6444AB9E1577902D64E1CD411CB1A23BC2DD436EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680906922, "uuid": "34eb0667-d1c8-45c0-ad70-250b183c4dc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680906922, "uuid": "dabb984a-8718-4c41-baaf-859e13d6aeb4", "value": "1536:pTnFkQMcYNVT5O0C6BVBjPjbOoTockVf7q7ox:pTnFkQMcYjT5O0fBVBjjbOoGVf7qMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680906922, "uuid": "5e5bb1a8-94ee-4fad-b96a-dd7d83b3b664", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680906922, "uuid": "40fe9a54-e2f6-4717-807d-54562a6d3702", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680906922, "uuid": "58816e80-cbe1-4efe-84d2-4930dffc0f8c", "value": "0dc031b250a9f44650a1663a68aaabdd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d774ebf2-d4ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680834921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680834921, "uuid": "47eac378-91e8-4692-81fe-3421f597c7d3", "comment": "Malware payload (Loki)", "value": "b7b01c3665c3b091b93967c1172a5e09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680834921, "uuid": "e06142a8-a111-44e2-9c12-3c98fda14878", "comment": "Malware payload (Loki)", "value": "3d7476641f4109da7e33298d6d4bbd368e5414d7e92f1ed6542622cb70d6ba71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680834921, "uuid": "514c5cf9-3421-426c-9dde-92069354ce23", "comment": "Malware payload (Loki)", "value": "f6a2b9666e680b368b9ed4c4cf50dddfdbee3e08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680834921, "uuid": "cccf5e85-743f-469b-9735-54c28895e233", "comment": "Malware payload (Loki)", "value": "0ffc58e067c297444cb23f42c9810c67c42bfe73437281d4bff690529c098cc774f71d74bf2445f8c61cbfa7f528ba43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680834921, "uuid": "f6b3818d-af65-48da-a3ff-7ceea484f63a", "value": "T1E1A32942B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680834921, "uuid": "c2fab5e3-fde7-4101-85de-af233ca41881", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680834921, "uuid": "14738067-58a1-4845-8eca-45cdee1546d3", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqaIzmd:nSHIG6mQwGmfOQd8YhY0/EvUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680834921, "uuid": "3073d2ed-ba21-4f9b-a6a0-e443f9e194f4", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680834921, "uuid": "3f4cda7f-2c8a-40bd-9761-4d50376a9e58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680834921, "uuid": "4b45a411-b75e-4e18-bcb9-f9d4b9e02c59", "value": "b7b01c3665c3b091b93967c1172a5e09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c37cf7d-d4db-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680827520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680827520, "uuid": "f128c373-091b-40c9-8878-00774fdd39ea", "comment": "Malware payload (RedLineStealer)", "value": "0a9656d371d36209e07131d15de72bd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680827520, "uuid": "8e90ece8-cef5-4a15-962c-b0cb3880fa7f", "comment": "Malware payload (RedLineStealer)", "value": "4216afa34439965320c098ffa68d622070787e5660ffdb6999239414f902003b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680827520, "uuid": "1f8a7483-c848-486f-af3e-e2751bd464f1", "comment": "Malware payload (RedLineStealer)", "value": "ce936847199db0c0aec06b1583fe8e2c1f375299", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680827520, "uuid": "9474f650-9f2d-4b8a-89ce-d71d3bb8ef40", "comment": "Malware payload (RedLineStealer)", "value": "1736125149da26bc318ea6cad647768f506f5c8fcf5ac6e9f83866e4524f4942751c3ded393223b97bb5b5ae51484aa3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680827520, "uuid": "e4e6494e-2ee7-4629-8202-dac2a8e38521", "value": "T12174738621DB3860E426E3B780F2716E22CB5E61739E7D9F3A98E04F5C1C5111EACD5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680827520, "uuid": "06492404-bdb9-4040-a809-c8bd64a4ff30", "value": "bdc5460897466ea2db5d4e59ab3f0e25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680827520, "uuid": "c4280742-14d3-44b0-a2dc-a0e715398d91", "value": "6144:1o9yjGLjfjUe4rrVQktDSgTV09m9+hxG:zCfjUe4rr5DtTV34x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680827520, "uuid": "ba1a2e13-cb64-4997-97a4-69325f00fa2f", "value": 357888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680827520, "uuid": "4f93636e-68bd-4b77-bddf-eab3914a4a85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680827520, "uuid": "903139db-dc12-4bb1-92d2-33239be334de", "value": "EBAY BRUTE CHECKER (CRACKER).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3df1131a-d56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680890927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890927, "uuid": "ebd561d8-3a42-4e53-b210-4f40b13ec0a9", "comment": "Malware payload (Mirai)", "value": "00ca88c1d707cdb300d91cb0d0e4a33a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890927, "uuid": "66f8536c-1415-4533-ad37-6e5c56339890", "comment": "Malware payload (Mirai)", "value": "44fac14eb208dcba6af84a713be320540694c30d0f5ad38b134bfb10c5189fa3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890927, "uuid": "6f93c27d-49df-496f-9703-74c754f35fa0", "comment": "Malware payload (Mirai)", "value": "6f5fa3892fcdfcc27c185816b142200d2866f6f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890927, "uuid": "19ee1211-f2f0-49a2-b70a-907392c25c0d", "comment": "Malware payload (Mirai)", "value": "c633abad5eaf3b1a9e4585a39e96990ee35ab88c192b2d35b01c696c55d3b00af56984d0992fdbf5a5ddff7cc34617eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890927, "uuid": "41108c94-9c0d-40fa-bd42-d4e2218846c3", "value": "T1D8633AA6F801ED7EFC0BE37A40570909B570E3E456A30B3763A7BD93EC721A56855E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890927, "uuid": "200cdd4a-885f-499b-b77e-444b4e04809d", "value": "1536:KfsdM6VBeRgr0JvB8TKcpCecbRF4BTnr+NHcUreTBnHK:KfsdM6VBSi0JvvMcbR6xFUreTBnHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680890927, "uuid": "07e22ff8-9c57-40c0-a7d6-60a5e8325367", "value": 71780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680890927, "uuid": "09b802bc-3dde-49fe-8986-fcbfd4864e15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890927, "uuid": "8d741883-6dd7-4ecf-b2c7-d41647fcdf87", "value": "00ca88c1d707cdb300d91cb0d0e4a33a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25bcc0bc-d556-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680880149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680880149, "uuid": "7f595343-bf51-4178-93b0-c6f1485b3a58", "comment": "Malware payload (AgentTesla)", "value": "bbad60503c8d596fc5c9097aa08ae80d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680880149, "uuid": "9dcfe05e-839f-4ff7-a425-d1d3f2be3899", "comment": "Malware payload (AgentTesla)", "value": "4a069185348aa2d94e2c450072b0d693ad16e03f5513457fdf716fa115b7c4b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680880149, "uuid": "69365f72-c766-4845-8e9f-d93710d71082", "comment": "Malware payload (AgentTesla)", "value": "a8d578ebb013c349146e1d59153178eb2d3014b8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680880149, "uuid": "6a590973-3c57-483f-99fc-e6466e99e87d", "comment": "Malware payload (AgentTesla)", "value": "c60be9911aa4e370bc465321fd36e9615c32a8f84be50bb5ea75e8b0236144f839d287fb2024e66b4c7bab19de8eecfa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680880149, "uuid": "3f7ea135-bb0e-402a-b5a9-056d5b3c883a", "value": "T1E0D433D3B8C1E9229484CFFC80E24E41B433B9AF999421DA727CB46CA35BB075B5915F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680880149, "uuid": "e3c0f15f-756d-4490-88bf-41d334072d74", "value": "12288:VLrcew4Wjvm86ue2IhADxXPZ02JWp1YeLB1dL4GiwAA6y94HwwBO:VENjSJADFZmnLzdYF9yg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680880149, "uuid": "16098e63-3283-4221-885e-833f6abaadbf", "value": 603813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680880149, "uuid": "f75c9b64-2e78-40d4-961c-d78597ffb84d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680880149, "uuid": "b3bd2b31-bb82-48c5-bb9f-4e01d0dab64a", "value": "PRINT COPY pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f430ef-d4fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1680841164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680841164, "uuid": "c1141a8d-cc4c-4a7b-9e74-16359e10d145", "comment": "Malware payload (AsyncRAT)", "value": "44a35b717f0cd21449ba7a7d3a7d2693", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680841164, "uuid": "26f45b9a-543d-400a-9aca-d5540d9e75a2", "comment": "Malware payload (AsyncRAT)", "value": "4a392991e0925f0a306bb444fd99c780483313da7a4563b308c52bdae265b894", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680841164, "uuid": "47e0d687-c442-4164-ba4f-391c572d24c9", "comment": "Malware payload (AsyncRAT)", "value": "8ec225d50cac301e455616da4c721742767cf80d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680841164, "uuid": "20a97276-e1b2-46d1-9fbc-346179deeca4", "comment": "Malware payload (AsyncRAT)", "value": "16e366af04f669ae0b880a210cb3f40bf5185d2d703c1200c5f9ef3aafb6a774ad862d3763ce2f52d7a30c0d7d33f691", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680841164, "uuid": "d36c9187-ad8c-4089-b88d-a62c34ca964b", "value": "T134231A003BE8822BF2BE4F78ADF26105467AF6632603D58D1CC451DB5613FC69A526FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680841164, "uuid": "983fdd00-c0de-4c35-bf2c-401e5a754fdd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680841164, "uuid": "70655f83-50d3-4fca-ad88-035d789220f6", "value": "768:7uHIZT9xqj6WUs32jmo2qrnKjGKG6PIyzjbFgX3ioXVsYeWnAjBDZLx:7uHIZT9Mw2SKYDy3bCXSols3WnAldLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680841164, "uuid": "b6719536-9910-4339-be76-f0b357503a62", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680841164, "uuid": "ce070c9f-7ebd-4a45-bef0-7d57d3aae821", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680841164, "uuid": "133fac2c-8fc3-4c42-9529-3c073923669c", "value": "xKsMPNbrHE38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23dc3f1b-d57c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680896467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896467, "uuid": "7b2a96ad-7aed-40e2-bfa9-40868d42f951", "comment": "Malware payload", "value": "6aab0dd43fd1e5c99f9c17aa79d904d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896467, "uuid": "231fdefc-cb75-4bd6-88ec-07523d78a2a3", "comment": "Malware payload", "value": "4a8ea9734cddcd66dc5dcfa04f6950e1fc5c23fbc9dfe54d1a4125fe59e997d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896467, "uuid": "018ed5c8-046a-4299-a950-c6a50e694a96", "comment": "Malware payload", "value": "151965b8a604961121638f76c2bae4b2a431e189", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896467, "uuid": "47674bb2-20f6-4cb3-bc45-fc913d482803", "comment": "Malware payload", "value": "734dcd7369495fdc9f08c7b7a1d2504dd529afe1416b2f183da59e844e106343e08179aa8c9d747e00b92c35ab435bea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896467, "uuid": "ce376a8e-9832-47f3-b3f1-68ef60aea676", "value": "T12F833A0399A19FB7C196AAB026B745700713E8105B1F2B897239ABF4474F9CEB81F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896467, "uuid": "895f19c4-a6ff-453a-b939-c1e7aed655cf", "value": "1536:ZGY9jUi/xK1le3dPhlRT16TJC9IBTILDmjHVqYLeRR/8Q:rbY1APhkTJyIB8mjHVqYqRR/8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680896467, "uuid": "fc86e98a-3240-4c88-907f-462ae2fe36be", "value": 85399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680896467, "uuid": "e7000dd9-4898-45dd-b4c8-6350ce7d8aca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896467, "uuid": "9dbfcead-dd42-4827-9ef4-781e3585af8a", "value": "6aab0dd43fd1e5c99f9c17aa79d904d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abdd110c-d581-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680898842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898842, "uuid": "77aeee41-459c-4e93-8d42-cb2a157ca721", "comment": "Malware payload (Mirai)", "value": "db2ef41b26feac490465c8689018f824", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898842, "uuid": "d218f62e-2e5a-4f66-aaa5-bc7d7e400671", "comment": "Malware payload (Mirai)", "value": "4b25ee66c29bc98a584136c23020e0183787556adb8ca23177e12a0b9655fdac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898842, "uuid": "6eb6f2e5-05ff-41df-9a64-53822b03dc79", "comment": "Malware payload (Mirai)", "value": "8edd6bc79cdfa4ba17db037abf6a334ca3c33646", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898842, "uuid": "5a8185ec-fc36-4f56-9038-1cd4c3a80f0c", "comment": "Malware payload (Mirai)", "value": "b60d5990c29932f8846867cd9d73f4beddab2adc645d265b710e4ae6705fc3cb6c87a1548cabd8dc6260d3434eb3114a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680898842, "uuid": "88f3baa4-b43c-4d5e-b288-aaaf3b40b5a3", "value": "T17283F95AB9814F12C5C612BAFE1E018D371357F8E3DFB2239D106F20B7CA92B0E66955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680898842, "uuid": "269fef67-9647-49a7-899c-e0d8dc656bd4", "value": "1536:7FnaMU1hK2bZ2WGJ2MZCt2xiiWEEOyVaP1S04I9ie2ecWKzH9u7d5TYoFwbZnJZ:FU3K/tvmfi5XyVaP2e3KzH9u7dNBFwbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680898842, "uuid": "d86201fe-3532-4f9d-9df1-d13cd7c42a33", "value": 83256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680898842, "uuid": "a9ea9005-c12b-4e89-952b-61a3da8bdf18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680898842, "uuid": "a3ed97ee-67c1-454b-bf6f-65efadfeca58", "value": "db2ef41b26feac490465c8689018f824", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c82d8e0-d4e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1680829882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680829882, "uuid": "ac053bc4-f592-4f68-b917-ca934bd310cb", "comment": "Malware payload (DCRat)", "value": "b93c00bd152117638525185f6d504932", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680829882, "uuid": "b28fc5cf-05f8-406f-b9ea-d7ec5a8bd67c", "comment": "Malware payload (DCRat)", "value": "4b41c57dd25e0e09579619d34f2cf0d4a5c543df229b9ddd5c7c8f6e8d000d16", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680829882, "uuid": "e3eace5f-62df-4b5f-8ec7-452144f3c1f7", "comment": "Malware payload (DCRat)", "value": "b63702c4160b4ba4583656afa5d9a5476a8bf711", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680829882, "uuid": "ef1cbd8d-0a8b-47df-919e-7e97890bac1e", "comment": "Malware payload (DCRat)", "value": "a9ba9eaf55693b956ae7fbb7ab69c0c905dfa329c7c3ad5ba90ae0d596bdfe4bf479a9308438791a714e77a940bb47ac", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680829882, "uuid": "52561c0e-fddd-494b-b8ca-edee1242a2b1", "value": "T133A5332BAB8A0448CEF5803CD8235DE9B27B6A742DE6DDBF465D1AC633B31344265707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680829882, "uuid": "43e6fffa-4e41-479b-87aa-81660906af3d", "value": "74bd0aecd547e283957076b051185e0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680829882, "uuid": "a88c7d91-b98b-4f8b-85e3-a2133562b80b", "value": "49152:Fiu9iQI1qmMRmCmjVm85CMOW41fXvdkJNp2AdTtSRFxG71ITvdDq:FixCkLSW4h/+2AdTIfzdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680829882, "uuid": "cae05fe5-266f-4bf8-9708-c6f5d3e3ae0c", "value": 2224128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680829882, "uuid": "ca7ea798-c471-41c6-9c81-78788606ca23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680829882, "uuid": "b91f2899-0c68-41a6-9e9b-c9a431aa284f", "value": "Result.vmp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf103ca0-d583-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680899760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680899760, "uuid": "a1db0297-bc8d-4298-a1cc-688f16ba4d33", "comment": "Malware payload (Mirai)", "value": "87b4fbb6e20d8fc40bf9a33773d0a335", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680899760, "uuid": "e48f8c41-20c9-4dbb-aa19-7e879299968c", "comment": "Malware payload (Mirai)", "value": "4b5dd1d6ff0b087afad9575940bed1bc07ca7578dda2ef564db2170bc7939eab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680899760, "uuid": "df1aa114-e629-45b8-b6b1-ddf5cccdfeec", "comment": "Malware payload (Mirai)", "value": "3b92e1c78c3d82b3aa82557ad09ce11b80c10d0c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680899760, "uuid": "148d2dbb-97d2-4c09-8da4-db3ffc24d23a", "comment": "Malware payload (Mirai)", "value": "7d40018d8930f4e474168759fd19e210b812d593d53bf27380481f5db8200fb03da93daafe39fe6ec0b4fc0c09d1b05e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680899760, "uuid": "8f582da3-73bf-4160-a367-ac9d6e858b50", "value": "T139E33A46FB814F13C0D61776BAAF4249332397A493EB730699187FB43F8669A0E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680899760, "uuid": "c8b4f85b-01f5-4304-99bf-82df89eda7ae", "value": "3072:MV2briS1Tk3FoCajbeCn85hyyeacItxZwbZnIQXi0yM/9ZYIC:MV2bmgUqCajbeCn8fyyDLZwRIQXiBM/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680899760, "uuid": "84a67117-bd52-45bb-9c9f-a12d82da1f5b", "value": 154960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680899760, "uuid": "3dfd8082-7e55-4299-8a44-e60408bcf4b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680899760, "uuid": "263f4a1b-5210-4d33-b98f-25d96be22207", "value": "87b4fbb6e20d8fc40bf9a33773d0a335", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301d59e7-d562-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680885320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680885320, "uuid": "79fed08d-5ecd-46ca-8f5f-76ad0de8f569", "comment": "Malware payload (Mirai)", "value": "e9c85bd2c49a856887b2fd395c9b8089", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680885320, "uuid": "1a6a11a8-69b2-4492-8c21-3510e04729f2", "comment": "Malware payload (Mirai)", "value": "4bbc0c27b36f210abe05d3ff8f79f2b98d272eea0b4c341edefe769eb6efcae5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680885320, "uuid": "04813dd6-2d14-4014-9a22-33edf954526d", "comment": "Malware payload (Mirai)", "value": "aedbd9ab23261fd74bf600d7742826e0f3a244b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680885320, "uuid": "fe9461df-c189-458f-8064-f91c073c1321", "comment": "Malware payload (Mirai)", "value": "aec0f12d3bf24d6a32f2bddd4398d590dac367b030a8e5554d777a0f41c68245ccaca03732016eecfe4d62d3e17a240d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680885320, "uuid": "1d5f1482-0e31-464f-92af-c24f06388953", "value": "T101134BC8A943D9F5EC1102B02137EB36BB77F43B212DE997C75AD523A892601D50729E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680885320, "uuid": "6649687e-6065-4420-a3da-4fac4984c858", "value": "768:Wn6rgUc06KEpQhnqCgKrkIh+z6mbZ4JI3/W0H8mE3MCFQBysYXUIvucjV+f5E8f9:Wn6rgUD6KEpQhnqhKrkIh+zpbZ4JI3/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680885320, "uuid": "fd49291d-86ca-4838-a632-d03dcf7f2540", "value": 42588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680885320, "uuid": "3d093ebd-b03b-4113-ac8b-00983fb969d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680885320, "uuid": "f2f3e1e5-374b-43f4-bddb-fda048efd035", "value": "TRC.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5014fc-d56d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680890044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890044, "uuid": "853c7498-82b9-4f80-9fcb-4c119400743a", "comment": "Malware payload (Mirai)", "value": "b32220569cfce956c6505759400086e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890044, "uuid": "9335d271-4bf0-4742-ba56-a6011fa85cee", "comment": "Malware payload (Mirai)", "value": "4e8ada08a91d26005268c931a29f90522bd5d39a4244fbda2991580476577db0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890044, "uuid": "824e02a8-89d8-44cd-a00c-be4fef957256", "comment": "Malware payload (Mirai)", "value": "486e8bdb21bdc1777a25b5c3441d7f2578ab1342", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890044, "uuid": "cc2cb39b-d4a6-47df-ab9c-f7a8be9adebe", "comment": "Malware payload (Mirai)", "value": "6a7648690b080ff19cd18da3528c296a733d6c666a26b360a6c970a207d4ad6ef15f02e17aca6232c26b84dae1bf8960", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890044, "uuid": "64532749-63bc-489a-a614-0bcda4b297df", "value": "T12193194ABD818F11C5C512BBFE2D018E331357BCD2EEB2239D106F21B7CA96B0E66556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890044, "uuid": "94e8279e-f2be-4fb4-b595-5043f094009f", "value": "1536:hFpnapSbmfG9+myMlcmfdmPBkWcMJmCaruAozzbM4itHM6Help3l5+Y4wbZnI:hup+gDS1s69McCalHM6Help3l4VwbZnI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680890044, "uuid": "e3144d5f-3750-4924-8872-a1a345bce4a5", "value": 91444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680890044, "uuid": "eaca4e6b-17de-4e41-9d41-1c32344ae8eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890044, "uuid": "a39b27cf-ec30-475a-8285-123b39124848", "value": "b32220569cfce956c6505759400086e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c04d7c8-d571-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680891917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680891917, "uuid": "6cbe1064-e86a-422f-9a61-4c5a545ecfaf", "comment": "Malware payload (Amadey)", "value": "36f4529b3b8bf79c58c304ea15ae1cf7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680891917, "uuid": "3f350f26-ce76-4464-a7fc-6a69d5f0eb26", "comment": "Malware payload (Amadey)", "value": "501b89ccabe9fb05c64f74b3e2d2127fb85a22dbea0eec8a008db17339f71645", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680891917, "uuid": "c1a0d1bb-b6f4-4b26-a9aa-a4cf2d89fbdb", "comment": "Malware payload (Amadey)", "value": "da3397c68952e5fc59630f36615193bd59123adb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680891917, "uuid": "b1339944-64ac-413c-8894-b610aa45c7f8", "comment": "Malware payload (Amadey)", "value": "4c565aebdb6f5f63b62964643ed1bf981814cb608fddf42122c610b3f72f5d1ca5e043bd31346c5317edaba15919a118", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680891917, "uuid": "02450bc8-0915-4732-89f2-c42de8b51ad7", "value": "T16314BE11BAD1D0B3EB1784344830C6F5A93EBC939B8996B773183F6B3C31EB15666252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680891917, "uuid": "55f6cd42-cf17-4709-a659-c9c36a577e4d", "value": "25a1b270f58163554bc7d2d96c00089d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680891917, "uuid": "444517fa-9e5c-43ef-8260-e6e39a89e8f1", "value": "3072:FmAbAfCb1xoI8fhjxry6eUBM8+o3Fq5mslT:XAc1j8fRxrLemMETslT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680891917, "uuid": "ae5e2eab-f784-4869-9537-0c2ab6357186", "value": 194560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680891917, "uuid": "9c4aa010-945a-4b85-954e-6a47e9a27945", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680891917, "uuid": "42fc22b2-53fe-4485-8130-b985cb65875b", "value": "36f4529b3b8bf79c58c304ea15ae1cf7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d44dd2-d568-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680888147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888147, "uuid": "59baac62-1e3b-425b-a948-0364b6db803b", "comment": "Malware payload (Mirai)", "value": "66e07945b5669e429f2aca7f02800d4e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888147, "uuid": "eebfd718-f177-4463-a869-0566239dbbba", "comment": "Malware payload (Mirai)", "value": "52b6661f2f4ff839bd3df2fedc5b7f5e6e7842baac555d7f8cc3dd4197130868", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888147, "uuid": "02fb9cdf-dda5-4003-ab77-e6278dab0470", "comment": "Malware payload (Mirai)", "value": "5e0053f9271294f21ca9c4a0b15364e062c45108", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888147, "uuid": "f0901283-9f20-4353-982b-1fff86d26815", "comment": "Malware payload (Mirai)", "value": "6f45999d6156c63572b983c358bde8a616f784b7477abf2a477e0fa9bacbdb21e007832cbbc1153552f4787f89c54a0b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888147, "uuid": "130a0ac8-88dd-40a6-9e25-3666c9c81aa2", "value": "T115831981B9809E15C6C5177BFA6F108D331247A9E2DEB353CD145F6477CA82B0E37A8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888147, "uuid": "fdd78078-365c-42cd-9551-c2362d3cb647", "value": "1536:29n7/xkRBFg3yFhk20WtEu+1F4YPjaduBcPYO9mrsplDKZUlQBKXAVan1X+F8Jyp:gJTyHknWt/+L4qjmugd9mrsplDKZUlQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680888147, "uuid": "1871912d-b20c-4ca3-bffc-b959650a7e7a", "value": 83072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680888147, "uuid": "5f118eba-5f67-4ef3-a0e4-ed90df0350b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888147, "uuid": "7d8ce05e-669b-4765-b41f-1aa47e74abe2", "value": "66e07945b5669e429f2aca7f02800d4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "362d5c1f-d57c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680896497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896497, "uuid": "dd8c5d44-a82b-4dfb-a5f4-a24a72653201", "comment": "Malware payload", "value": "edf0677dadc5be23830447701089e7c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896497, "uuid": "4f3437e0-d014-4c2a-bc9c-00e79a07b4ab", "comment": "Malware payload", "value": "5331491f01152a8cef7bb5b3b82a8e70be8470c35ec94ddb5212969f60e9d5ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896497, "uuid": "fa4eee15-5d8d-4f42-b9fb-d7793c906fa8", "comment": "Malware payload", "value": "1d3c38ff7ac08d98157210c3ea3f27fa23565ed7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896497, "uuid": "de6ed765-2fe7-4721-8730-1fff374356c5", "comment": "Malware payload", "value": "90a5eba19246adce7d988d8fc3ce52f6b482a56b6fa482e33a88cd2c88d025af5f07e34f62801bf311117b2595aa14ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896497, "uuid": "074c3e23-9ef8-487a-830b-df0297f0faf6", "value": "T196834B42E746CAB3C4430AB202A7A76A4532F83B5E2B9F45F31C7DF4AB164D87227355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896497, "uuid": "b80937bc-d18d-4798-8cff-434b86cf6594", "value": "1536:noTtSv0GgyWHs3swuC7SWnkemPOrP114iJ0VmLIWVOCjXZRsFS:nOSvzcMDlSWkeTBCiymUWVOCbZRsFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680896497, "uuid": "7fb20ab6-2680-48bd-b553-efaf8f392c61", "value": 80968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680896497, "uuid": "ef288451-ac3a-48c9-a347-39eb1da156f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896497, "uuid": "2c920ffd-87c4-45d6-b712-b3abc3e1b38e", "value": "edf0677dadc5be23830447701089e7c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5e4f924-d566-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680887317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887317, "uuid": "69def660-0256-431f-8536-343b5473e3bd", "comment": "Malware payload (Mirai)", "value": "030bc16536333e210ba25b15a670458a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887317, "uuid": "30714916-329e-4114-bed3-bc9394a1bc42", "comment": "Malware payload (Mirai)", "value": "53de80833627afd450c5c47481130ea15223b18c9fd2a9f1d9a4e160907da030", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887317, "uuid": "eb01a320-c4ab-4a5f-a020-b039046ec493", "comment": "Malware payload (Mirai)", "value": "f2514175469c3ff6929de3a7ad9ab3301d676f11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887317, "uuid": "519bbd94-bce7-4140-a3fc-3369c0b0b7f5", "comment": "Malware payload (Mirai)", "value": "a70176acea3903268316fb537c5fdb5f620fccd5db717f08e8c8bb004a912c1245eb4e88511a63dfee0fa77731549df1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887317, "uuid": "ae7056bc-4692-4553-b9d8-1f22ce98d6f3", "value": "T1AC436BC4F643D8F5EC8705702077FB379B72E1E922A8D647D3B4D932AC52652E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887317, "uuid": "dd6ccff5-330f-418e-bb49-b833b60165cc", "value": "1536:JeESt/basV2rcZhG6ySN7naJlSR9zWOIaEjrqMZs:JeESt/basVTgS7naJQRVtXESO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680887317, "uuid": "e14bcd9e-0116-462d-aa7e-25583d44cc6f", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680887317, "uuid": "10f64bc6-5300-4e08-9d48-4b0e19530ba0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887317, "uuid": "8f45f8c4-8155-4410-8820-a320ef10262b", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f0364c-d56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680890972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890972, "uuid": "d273df9e-79f0-4549-a555-e64725db9d88", "comment": "Malware payload (Mirai)", "value": "1c367216e63b7cf5a67c1d19ef30def0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890972, "uuid": "a3c20365-f428-46f0-9450-5254ec353bc9", "comment": "Malware payload (Mirai)", "value": "54f57eac7712862291a4ee9639df13b8bd401910819fd9b1ed97ad7692df135c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890972, "uuid": "4bbf3292-1b2f-45a6-b26f-2906115a6959", "comment": "Malware payload (Mirai)", "value": "ad4e8469561a136fc5f0c7ae7d75701c2b638d0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890972, "uuid": "5c254c78-553d-46cf-95f5-52bec535ed24", "comment": "Malware payload (Mirai)", "value": "b8e4504f60c0843653d196f015047c8bda94552c09253f88e31d79aba6fc5a540b5705c143c6d8b2b82447823679dc83", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890972, "uuid": "dddace47-00ba-4fa9-ba5f-b7bb3771e1a5", "value": "T13793C519BB511FF7D89FCD3746AC1B02388C968622A93BB67574D428F24B24F15E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890972, "uuid": "7d110dde-a135-426b-a2e0-eddb03a46ca0", "value": "1536:NUYHK4GHWD+oBqqG3N4SfxMW4ZXH1RQVkwJ6wbZnr:NUYHXG7b4SfeW4RI6wbZnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680890972, "uuid": "e13c3e30-e8da-4224-b38e-19f04ebeff45", "value": 88844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680890972, "uuid": "9a8c8a22-6592-47af-a4c1-b5fe1e6b2e7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890972, "uuid": "20ccd72f-3fc4-47df-a70d-067e65cea043", "value": "1c367216e63b7cf5a67c1d19ef30def0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4961ea-d575-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680893498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680893498, "uuid": "10d24a1f-8d5d-4b78-9140-5130f65aa6ff", "comment": "Malware payload (Mirai)", "value": "9564b73f55a1530222546a62cd8db3c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680893498, "uuid": "26d28e77-36c4-4cf4-842c-396fa8c545a6", "comment": "Malware payload (Mirai)", "value": "553cbd39fed3f042028373a44d4fdf6f6fa0ea6c6ccda349918fb10ebe9dc1ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680893498, "uuid": "5bc98579-15e8-4c88-8847-023677c1abba", "comment": "Malware payload (Mirai)", "value": "838f9cfa9eceb6d9d667faefd37dba6c93699c8d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680893498, "uuid": "a26e36b0-90b5-4530-bcd4-a2df2576450e", "comment": "Malware payload (Mirai)", "value": "505871b21bc4718264fef9c4f7b165a016025fb37a6be76f8b07bfa179cd0d193dc3ae94e1f8f5d0bba66de0db17c92b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680893498, "uuid": "5ee7f639-5fcc-4e41-a609-8b0e3862f330", "value": "T14323F8417881AA13C6E4237BF96E01CE332563A8E1DF72179D222F54778A82F0D7B756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680893498, "uuid": "f847c674-f22f-4002-ac27-793a6b5158e1", "value": "768:nqB4zwfbRhgoc+FiE+Rfi6q5CqoWTelBF6EVNQ96jviqwVoVMscG37eSi27AfylB:FzubRml40WT+BFnNQ96jviw3Le05Yn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680893498, "uuid": "03229bf7-b729-4a9f-bd56-d78019fa877e", "value": 49988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680893498, "uuid": "9c0d2a0d-fffa-4250-a879-d22338953a40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680893498, "uuid": "eaf2e309-fb76-4295-b85c-41e278897605", "value": "9564b73f55a1530222546a62cd8db3c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "263416d9-d4e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (YoungLotus)", "timestamp": 1680830328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680830328, "uuid": "f3b522d9-b179-4487-8c11-b34d59f6ee41", "comment": "Malware payload (YoungLotus)", "value": "bb8563b2aa2335abe99a45888e2a47d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680830328, "uuid": "b447c580-3417-4b2e-9298-5e0611e8fd08", "comment": "Malware payload (YoungLotus)", "value": "555ff1532b71d6001e270b74611c6ce556eeb422fd8366941e88b141dd200ae9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680830328, "uuid": "5ccbf99c-62f4-4adc-880f-54436ba72005", "comment": "Malware payload (YoungLotus)", "value": "d23ebbd1b7268e1440a57557f19e0b906824637e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680830328, "uuid": "727203c2-c5e5-496d-a3af-853bd3b74125", "comment": "Malware payload (YoungLotus)", "value": "72801367a80ccac2752bc73323f399422b34d0077045eb5ca7d5123727845b5739c1f35bd34f08fa1cf294504b5147c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680830328, "uuid": "d219f817-fad1-4c4a-9476-902535ca750d", "value": "T15CE26D573FA868B3C04189311E049F27EEB7F4B51F1A9C13A7550A8D5CF48C3A9BA54B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680830328, "uuid": "97b4fb22-c3b7-4c3b-b651-6849b104ff38", "value": "127bc68c3d34a048139e9d88ad1484f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680830328, "uuid": "6ad87073-2637-4ae1-bbaf-f14dbf4f5481", "value": "384:uTkWKqDfSFnhadpwhmC+GIYVgg1l+JHnjbIla6U4t9yN1O4dT:uNjLOnhaQhKBgiJHIl04KzZdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680830328, "uuid": "ef065612-9cac-4194-9950-0d43c6b3f5a2", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680830328, "uuid": "685ec9f4-b27f-47ad-931b-cc74979ccbf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680830328, "uuid": "1a3dcefe-10e0-4f7c-abe2-90796d347b94", "value": "bb8563b2aa2335abe99a45888e2a47d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07db0f8f-d567-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680887400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887400, "uuid": "1e8e536f-d184-4c2e-a358-f80411aaa90a", "comment": "Malware payload (Mirai)", "value": "b4f907d1bf3ce5304bead0f7b9254efb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887400, "uuid": "2bef8cb4-cbea-4fe4-9928-ce4d73cec875", "comment": "Malware payload (Mirai)", "value": "56d0acaa7ba387f7f51017189fe2ce9e60ac0a381c7e82092d79405d6630c888", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887400, "uuid": "807fb9e3-8838-4957-8c41-e75fc24ec8e9", "comment": "Malware payload (Mirai)", "value": "b70d9fdc7fbd99da4def13f208871f3d91939f57", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887400, "uuid": "0a1c3b3c-6d39-4d5a-ad1c-dfabda98f96b", "comment": "Malware payload (Mirai)", "value": "49d42b140b4b8c509df6dfa789ebe69168a962fa0ab5360775a5d5125ad6fd3ad4bb577e95c62eafb0c96c6c845e7d98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887400, "uuid": "d80c588b-e028-435a-b1d1-61fe882d9b00", "value": "T1CAC34C46EB418A13C4D5177ABAEF42493323E755A3DB730689186FB43F8276F0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887400, "uuid": "52f38f3b-2c67-45fe-89a9-ed15e6515d73", "value": "3072:xmYJNDTL7QWhWSptf2s7xUqYUXNlHsHI8M/9AYt:rJNDTL7QWhWM2s7xUHUXHso8M/9tt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680887400, "uuid": "16a3e649-5c4f-49f1-acfa-a3da294181bb", "value": 119486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680887400, "uuid": "fdc595bc-7faf-4cd7-90b5-c446724751b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887400, "uuid": "984ae04f-783b-4188-b37e-ffff3f57032d", "value": "b4f907d1bf3ce5304bead0f7b9254efb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9758e775-d568-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680888071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888071, "uuid": "2b81ebff-5260-4e95-bf90-425f7075157d", "comment": "Malware payload (Mirai)", "value": "3e0996f626e0b968e430e4b8c64c2ca8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888071, "uuid": "6fc9e92b-7d0a-4ca5-8229-1115320a02df", "comment": "Malware payload (Mirai)", "value": "575fff023ed812a8628d34315a85a04544d8ba399cd8beccb724276f1328b7a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888071, "uuid": "4613981f-9c52-4e43-a46a-6ffc0e1006cd", "comment": "Malware payload (Mirai)", "value": "287677079a75dcb1f68e5fe69860521baef1c3b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888071, "uuid": "55220a8a-3cdd-4a1f-80c5-31e18201bf6e", "comment": "Malware payload (Mirai)", "value": "827985470e5b431aa554f9216187d4128eadae8d6f50dea8d3f4e3c16340f961c77a54d36661a73c60fb62d74d17e683", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888071, "uuid": "568b3cf6-ce69-4dba-83f6-21cbe3ba0583", "value": "T17B430945B8818A12C5D4137EFE3E128D33126778E2DFB2129D116F147BC6A2F0E7BA56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888071, "uuid": "f0341043-b9c7-4a94-bb1e-cd721e4f3941", "value": "1536:p9ndvNnjHlKpWdKWhwU98jJW3CtCBUMgkuL7IbxiHsiNQc:dpjHQUdphiWyti2siNQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680888071, "uuid": "6387081d-42fc-47bd-bd38-bd7d88c26fbf", "value": 58704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680888071, "uuid": "fb8e00f5-322a-44ac-a390-afaa7a0ca9dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888071, "uuid": "b9ba384e-5daa-477d-94e7-539773c169cd", "value": "3e0996f626e0b968e430e4b8c64c2ca8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a718ca9-d564-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680886143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680886143, "uuid": "e10ca4bd-9937-4263-af17-f559d2615064", "comment": "Malware payload", "value": "36a654d6bf2db58c078bc75edd172239", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680886143, "uuid": "a5b1c481-f825-48be-8de5-5e2140ccabce", "comment": "Malware payload", "value": "58894d009ae0e6e7aafc8224bfac2dcc0844cbadb149d982a8b716ff5c3fb06c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680886143, "uuid": "d11a58a1-e496-45b4-bca3-ac75c74d0072", "comment": "Malware payload", "value": "5836dbce84760661a3747fd76203659df3488517", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680886143, "uuid": "bbda2ea3-d92b-400e-a110-b41bd8da879a", "comment": "Malware payload", "value": "58299976684235f085a926bb09f8a6f9409d8d4da341d5d97ed08d968ba4c018075f6a3237de7f64fa893c4ffcf48260", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680886143, "uuid": "9a56c474-552f-478b-8869-04eda05ecbb0", "value": "T142921BC5BD45C906CAC4467AFA5E828C3B266398E1CE33036F1B7F926746C2B0E3B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680886143, "uuid": "2306ad4a-a1c7-4631-8996-3de1d89f06e4", "value": "384:n1Z0Xjlu7KqwPDw+iRJp/PmJSqHnz4UQ2n8l01zv5vG7Fx4e:n1Z0zlu7mw+2J5OJHHn3Q2nk6xvGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680886143, "uuid": "73665c49-36fa-44e3-b531-3f8670a46b02", "value": 21088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680886143, "uuid": "b6a8aa6d-782b-497b-bd78-826abfb874a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680886143, "uuid": "c0e6fdf4-67fc-45d0-8eef-57d3bf611651", "value": "condi.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cac8af7-d552-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680878416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680878416, "uuid": "3098c24f-b988-4f07-936f-18985b464037", "comment": "Malware payload (Amadey)", "value": "910892f69de36fdf18ee864b7efa224c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680878416, "uuid": "16e10ac7-ac88-4787-8c6c-5d1427711faa", "comment": "Malware payload (Amadey)", "value": "58a04b096b75d1c33ac7455eee5d97cc06a2ffb3cbbe89be5718c64d404288de", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680878416, "uuid": "11ee11e6-2e0b-475b-a184-b7b8d1b837be", "comment": "Malware payload (Amadey)", "value": "454b6216ea70060c650fd982a235903dcf05f15a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680878416, "uuid": "92cfb98e-f00e-4b03-9b62-92b51b02f5cc", "comment": "Malware payload (Amadey)", "value": "c08ab61fbfbb7604d62064ae373a6f6fe054ad61e9595f9404e733b04deb05fd332a85a719ab5518c0da206834c942fc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680878416, "uuid": "d3a48cd2-d19d-4a46-9287-3ff2b955b854", "value": "T1D914CE21B9D0C0B2D81345755821D6F86A3EBCA2BF59CA8733583F6B3C723916B6B351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680878416, "uuid": "d3acd112-d6db-4356-918f-27bbcec824fc", "value": "5b250269b3029bf9f1db422179f30d8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680878416, "uuid": "d6131669-1d28-4b3f-81a3-e2d3c3c00fe7", "value": "3072:RdbAgcpdC6dkEutI3X6xPEuLNBcgtsA5i5WCh+tT6o:7AbdTdk7tI6xDpB6WCh+tTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680878416, "uuid": "e76c0046-a966-49f9-89c4-c5c0435fa358", "value": 195072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680878416, "uuid": "dabd0d35-a314-4c03-b8a1-5d62ebd6ef64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680878416, "uuid": "fb8f4300-2608-43cf-abf9-ac18ce84be43", "value": "910892f69de36fdf18ee864b7efa224c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096ef5ed-d527-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680859915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680859915, "uuid": "27edf890-2fe9-4fc1-b802-94784f74e6d8", "comment": "Malware payload", "value": "3247f93f0ca5f2b23748b4a10d9fc757", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680859915, "uuid": "008ff747-2828-4181-a595-a71f984254f1", "comment": "Malware payload", "value": "58b8a9851a13df848e1f9dfd3cf6ff9a2f62cedc9e9c18053852cdc853cfaf44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680859915, "uuid": "d0bfff64-272a-4b9c-8cdf-94b7884b11a4", "comment": "Malware payload", "value": "82f844829dffb14f0395eb3048ae913ba4b352cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680859915, "uuid": "6b2e2f37-bb47-4b92-a843-5804cec87cd3", "comment": "Malware payload", "value": "a81589b1e767e6a1503460e93cd1d78d1b2aacfd1cec26b7e7500b3f8fe170eb6fd08fe5c1dc0677c78de209ee74764f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680859915, "uuid": "41f51e53-3fad-4265-a807-01634084b438", "value": "T17713F2CCD0F9BE6CCD592C7EF68822F0454B64E223875E9D23814CCAA7F6887964947D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680859915, "uuid": "bc90c5c2-d5b4-4cea-8ec1-91fca9e01661", "value": "768:nJwjs8LillUM+Xcq38eiRdasl3GQfibxme6amPfKyCehvc6gDYsgGWI:JwjwlkORd1l3GIibxmFZH/Cehvght", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680859915, "uuid": "fe278d7b-0e89-4604-bea8-e23f33df0293", "value": 42428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680859915, "uuid": "238fbb7b-0e71-4855-a3c3-a2de5ad92e4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680859915, "uuid": "e1006b2b-008c-4085-9b66-3fedb74cd3ea", "value": "SecuriteInfo.com.HEUR.15172.15827", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb9c3689-d4f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Phobos)", "timestamp": 1680837961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680837961, "uuid": "c6ba0c5b-4d77-44e8-bad5-426049592277", "comment": "Malware payload (Phobos)", "value": "a6092621b7db8dc1f2c1f93a9a7ced9f", "object_relation": "md5", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680837961, "uuid": "71968fd1-5f03-4bcb-ab07-d01602137801", "comment": "Malware payload (Phobos)", "value": "5a96b929383817aa298eec8cca019bcd984fcd71dd8ee353541392c1082756a4", "object_relation": "sha256", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680837961, "uuid": "01cf647e-34be-4319-95ab-ff41b772b688", "comment": "Malware payload (Phobos)", "value": "d4fd035605baa14375c9a59a93849b959df36bc4", "object_relation": "sha1", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680837961, "uuid": "65e28b47-a0be-4d8c-9edc-09ae516fc65c", "comment": "Malware payload (Phobos)", "value": "ffdebbbf28d619a712e0bdc335c21330b7b1ed407d077d5d664247fcf8933f3553a32560b771d5301b1480c043165894", "object_relation": "sha3-384", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680837961, "uuid": "5f5bb104-9d62-4a04-a0ad-dee754054295", "value": "T1D543B05670698071CDB24270193A2F5B4EBEE00540B894978F7D4E863FE5473EB3A77A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680837961, "uuid": "f9ea8dde-b67a-4649-914a-833919f26c4f", "value": "851a0ba8fbb71710075bdfe6dcef92eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680837961, "uuid": "0ab001a5-9a63-4432-aa92-195e71592970", "value": "1536:RNeRBl5PT/rx1mzwRMSTdLpJOycgw04NxJ:RQRrmzwR5Jhcg74L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680837961, "uuid": "17eeb3ea-bb6d-4bdb-aeb4-d453386e9ebb", "value": 58880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680837961, "uuid": "68b3fa54-a661-4e48-9d15-5e09c8ba8282", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680837961, "uuid": "12a2f691-9533-4441-972e-b17f4ad1b00b", "value": "cmd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bb128a3-d513-11ed-88f6-42010a9c006e", "comment": "Malware payload (TrickBot)", "timestamp": 1680851463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680851463, "uuid": "0b5ff8ec-a3cb-4707-b8e4-3dfbf5919704", "comment": "Malware payload (TrickBot)", "value": "bcc12e4c20895dfc52160013aecf76c0", "object_relation": "md5", "Tag": [ { "name": "BlueNoroff", "colour": "#5477C4", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680851463, "uuid": "f6ce53af-1f61-4a5c-9064-259450474201", "comment": "Malware payload (TrickBot)", "value": "5b81f8f1208d2dfccb4dd6946102b61ad8f220c7b1c0a80f7be3ca23e6e59b3e", "object_relation": "sha256", "Tag": [ { "name": "BlueNoroff", "colour": "#5477C4", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680851463, "uuid": "f34a982a-2319-409b-a403-ee9aa73c8879", "comment": "Malware payload (TrickBot)", "value": "cedf1888a05ec696108756825ce91f2081f331ae", "object_relation": "sha1", "Tag": [ { "name": "BlueNoroff", "colour": "#5477C4", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680851463, "uuid": "0638b6c8-4434-4c4f-a2cc-50edf6380d62", "comment": "Malware payload (TrickBot)", "value": "9d34e795965a0684cd070c6b7a53cce4c48641b4078252b733e96793e5b28c2ffed1a87c78b632823fc4c1b449d1772e", "object_relation": "sha3-384", "Tag": [ { "name": "BlueNoroff", "colour": "#5477C4", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680851463, "uuid": "d04fc1fd-2def-4928-a862-4d4eb7c1170f", "value": "T19C837173F67D8B7BD643823A4A9AB7F760A93DEB1926418B3150370CAC75D10C9E3588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680851463, "uuid": "6dbf19be-36a8-4e47-b392-989186d53fe6", "value": "1536:NZTIGLnPijrOsK3eZ7QhMa/5HuMjk/3INK:NtZLnPijasK3xsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680851463, "uuid": "8292724b-15e5-447b-913a-9888e109fa90", "value": 84480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680851463, "uuid": "685e79a2-b638-427e-8017-9eff65a98f56", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680851463, "uuid": "b474d572-5399-4588-bfd3-efd77c312b81", "value": "\uc9c8\ubb38\uc9c0.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bd0e6b0-d518-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680853557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853557, "uuid": "63109031-2cee-4698-9733-64c2e7c0199d", "comment": "Malware payload (Mirai)", "value": "9535f877a5c86c1d4be3a03a385ebf1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853557, "uuid": "1434ca55-99e0-45ad-a83b-3ca4414aa4f7", "comment": "Malware payload (Mirai)", "value": "5c1ff82e381bed340cdbd207fa961cfc72b18bd940291ee8eb5f1e3fda99b4e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853557, "uuid": "20a9c336-6eaa-499a-be78-d317b036f037", "comment": "Malware payload (Mirai)", "value": "be9b04fd614a452dc3990921644dbe4ba7877cdc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853557, "uuid": "8af3e1db-c9c6-4437-83de-3a373ba1c3d2", "comment": "Malware payload (Mirai)", "value": "37fa83fbc6b03e49be95d066e59e75d81f0348a6841284747c4136ed813b567d3368c1fdeb25bf37a1b081741f1aae70", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680853557, "uuid": "08a16a77-c6fc-4010-948a-4444959e3a43", "value": "T14323025189A845B5DDB05C7303B5C0C78D1A9F3BE7AD28A48F784BE4D9E12D1BCE7182", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680853557, "uuid": "4370d8a9-b496-4440-835d-f1096d383c06", "value": "768:F8C2l3iNKwOZt6lrmDoE1QLy7WbveIDH+cFu2qRPEkHvkSKl6tyy9q3UELfS:F8RNiNKwgt6NooEO+vIDH+cF+ckPpE6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680853557, "uuid": "bae8890a-7d0a-4929-99f9-ff62c63f7c1f", "value": 48776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680853557, "uuid": "f19fccbb-5b66-49b0-8fdc-e2938b1944b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680853557, "uuid": "5db859a9-c7d4-4cc4-b16a-1f3da1741553", "value": "9535f877a5c86c1d4be3a03a385ebf1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe19e39-d561-11ed-88f6-42010a9c006e", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1680884891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680884891, "uuid": "f264899a-82b6-4c37-b1d8-1d31e0ae3088", "comment": "Malware payload (RaccoonStealer)", "value": "f36299f055dda59bf7aa59d2f3b3978d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680884891, "uuid": "7eed0527-7c50-46d3-af2a-fdb0e7ef07bc", "comment": "Malware payload (RaccoonStealer)", "value": "5d18935ee25e9828b87abb87856437f21dcf6b78640e3802e0b7b142f9478f75", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680884891, "uuid": "66d77b06-618c-4198-ac85-afae85be6a2b", "comment": "Malware payload (RaccoonStealer)", "value": "12b483e0a05c4e2908f9961d263eff728c620702", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680884891, "uuid": "0b6c0e4c-ae3a-4c7e-913d-937f35fc8e7b", "comment": "Malware payload (RaccoonStealer)", "value": "46603d7a2e7229a9482cfc2e867f32a48783147a13bc91f68192de2b9b24b78e06a70cff17e57da26487b21e0a2a4206", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680884891, "uuid": "26c9f8fd-ca65-4f42-99a1-eafd7db12390", "value": "T1D856237312911245F0E48C798427BDEB32FA036B8B81ED3894E6F9C13672DE5A6536C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680884891, "uuid": "e8ed5354-136f-48c8-b211-43b0eae468f7", "value": "895e5e6e037e9108574fb94ed614d804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680884891, "uuid": "1a7fb3c5-ac4c-4fc3-9199-7c9517811a92", "value": "98304:ExC6B5ctDmdHTSMv1OyyzvSDuMCngiScTFBAUJgTJ54oqq8iTROD44x5zvh5XRuA:Gt+SkyUvdgaTFuszi1ODDx5zvOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680884891, "uuid": "4737ac2b-5164-4e0b-aaad-b25cc8ca7bf5", "value": 6311936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680884891, "uuid": "d84ba7ae-ce23-4772-a0b2-f5f95225cec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680884891, "uuid": "20aff506-94d9-4c13-8466-a6aecdf522bc", "value": "f36299f055dda59bf7aa59d2f3b3978d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70940e2c-d56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680891012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680891012, "uuid": "024eedcd-8e61-4cc4-82db-a9dabda1147b", "comment": "Malware payload (Mirai)", "value": "ee25572d3aebd56aa3d39cd726f9e983", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680891012, "uuid": "b752cbb2-2f03-4b38-a3f4-0ea577e800f2", "comment": "Malware payload (Mirai)", "value": "5d7f59bdbd1e8b95a1c71dc231309cccdb7c4b588aaeb0b25ca3fbdfd9d93baf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680891012, "uuid": "5c72e005-824f-4286-bd1d-92e35bdf841d", "comment": "Malware payload (Mirai)", "value": "77d9100047bedfc0272367da28bf20d822d333f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680891012, "uuid": "6f9d918a-1164-45a0-9faa-d60b26acb3d6", "comment": "Malware payload (Mirai)", "value": "d6a2ab58d0a7e369147bf47c37e14d515d17dd89e4435c0e94789a3a5781df3d56aac464cd96a9113cba8c22515cf5b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680891012, "uuid": "c94e2d4c-d9de-46af-9194-ea23f4ab6441", "value": "T144A3C509AFA50FF7E89FDD374AA91706348C551A21B93B767934D828F64B14F09E38B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680891012, "uuid": "05f3919b-7997-4a4e-b3c5-0474d9263762", "value": "3072:OPN+5az2aviiF23qXT/j1b1ovp6wbZnr4I:OPN+5az2i43U/jzovcwRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680891012, "uuid": "304a7bdb-fb05-44be-ac34-37dc58b23fa5", "value": 101184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680891012, "uuid": "d80bb22c-e34f-4fb6-a831-3bc14db09a68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680891012, "uuid": "dd484c6c-ab64-43c2-b937-8731162ea31b", "value": "ee25572d3aebd56aa3d39cd726f9e983", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ebcc25e-d530-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680863977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680863977, "uuid": "b90314f7-6e62-40cd-9658-2aede40701e9", "comment": "Malware payload (AgentTesla)", "value": "680974005b00698742f72ffe6bfa9554", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680863977, "uuid": "d426346d-b81a-4b65-992d-f6893f439f57", "comment": "Malware payload (AgentTesla)", "value": "5e4557d083284367ae7656c8d3704fe65b8e620d99ba48c641aba32210f80bcc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680863977, "uuid": "b321be4a-8fb9-4f09-b854-26274dc5bef9", "comment": "Malware payload (AgentTesla)", "value": "4d8682504d2ed003b1707f169585044d0087ef9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680863977, "uuid": "c6826c84-dec3-460d-b50c-83dacec03d87", "comment": "Malware payload (AgentTesla)", "value": "cde58441a2495f4529842f6d1accfe9914f1e2ade378d3f108ea6c948651ebf8c40a8cdfc9af8cf0ecdf481b64568237", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680863977, "uuid": "25ff2c77-7e3a-4712-9fe4-a6d40e960e57", "value": "T13A659ED46AC58A81D437B170B04ACFF3C3E71D19E09E86F1389BA54990E2D016DF69EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680863977, "uuid": "fca2d0e7-83b1-45b9-a299-3bc6a7d6d5d6", "value": "12288:p2iNM4AvKvfxUokWY1WGQRjcOchNEenYLpKoru1UJ9QFFKyVgh2eV6pMm72w:p1XAvypUojOpQR49hNE4Ow+PQC6amCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680863977, "uuid": "c8604df3-59d2-4412-9712-1335eaf7b283", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680863977, "uuid": "36a47a87-0905-45e7-8250-4c3bbb62ec82", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680863977, "uuid": "ea1a9d11-cec9-4b18-a599-f8bf0e5a6239", "value": "Design & Drawing Details-0294888939.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e09b52-d55a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680881866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680881866, "uuid": "f43e4e5a-3f36-47f0-adfc-8409e58042b9", "comment": "Malware payload", "value": "544c2cd7d0375883af7fe406763543db", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680881866, "uuid": "504ad9cd-4e8b-4e00-96a5-7d2df27a9c36", "comment": "Malware payload", "value": "5ea762222260997c150811ca00ebaca7708e1bc61e840f8f57ee681dc31555d7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680881866, "uuid": "5409fa5f-74a7-4339-8f23-129049187ab6", "comment": "Malware payload", "value": "568c855569e7ea988a8095572ec7ae63717ae6ca", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680881866, "uuid": "dff852bc-702e-418e-9ec3-c1ee048be908", "comment": "Malware payload", "value": "c6fcf7dabfdf271944c155081b2378dd61c719fe741cea4889ae6ab61b139c4c7b65ad1042d4b3708816259eaad50a9f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680881866, "uuid": "2c1ba851-3358-4261-9db3-c8bdd63613f9", "value": "T194C080D77C408CFCC575C1B40F75D23C8630714386D2930366C9C5130B50714DD83A90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680881866, "uuid": "dab35c62-77f0-4a89-9285-d9707d210a06", "value": "3:qVoBqBcMBBXfieRgHFNIglBf/FFxP4lK2K33v/t7tApVJsRNFmXIMBcacWWGb:q4qqMziekNrB3FFxP0OfPANsRNQYMWX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680881866, "uuid": "d35dcf71-e1a1-4d8b-a115-5126a6d4b66c", "value": 170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680881866, "uuid": "045f3af6-c690-4049-af6d-71fa090bd707", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680881866, "uuid": "52581321-0ece-4c01-bd58-a36ba89b72cc", "value": "hello.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0644e6d-d568-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680888113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888113, "uuid": "dc89524b-cfba-4735-bbc0-d33bcdd53adc", "comment": "Malware payload (Mirai)", "value": "a08f30b97de021e04c9a3359de358615", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888113, "uuid": "7a3534cb-8d60-4b86-88e5-bc9847a87b2f", "comment": "Malware payload (Mirai)", "value": "612232f438d0c9073781cfe32e182bdbc0a299e229a0f87b326b01f738381f78", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888113, "uuid": "a4634d60-844a-4d2c-9108-fc42a501291a", "comment": "Malware payload (Mirai)", "value": "42df6e8c4c50defac6167ac01f1627da2e6e2daa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888113, "uuid": "0b836632-153d-4dfe-97f3-fb8820a3a888", "comment": "Malware payload (Mirai)", "value": "abd5182cc268b850f00e8ed050ee94b86362a15c6c558da645cb0226efbc95ef57cfb61b940387dc903a3d5ade84152b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888113, "uuid": "d5cd08ff-6187-447e-b0a4-7d3d8d014961", "value": "T1AF2329D6F4029E3CF95FE7BE84134908F621335161930B2B57ABFD936C321699E12E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888113, "uuid": "92795189-3adb-4daf-b6e5-d1e03d3b72d2", "value": "768:UmP6GqK2J203kNJnf/UO/parX7Y2KJMEQw96K9/+S8Rf:/CKI20MJfXharLYrMEQwsKFJ8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680888113, "uuid": "7c31b6d6-70d7-4120-8ccf-5c90148cfcbc", "value": 47256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680888113, "uuid": "d2812e07-2186-421e-9d44-981c9a1be88a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888113, "uuid": "1cf199fb-2411-4c14-8394-f6dd457c7225", "value": "a08f30b97de021e04c9a3359de358615", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d9e33aa-d4f1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680836783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680836783, "uuid": "94a4b2be-28d9-4606-81dd-1fb628164347", "comment": "Malware payload", "value": "b634be3c5eb62c87ebbf90f655581e96", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680836783, "uuid": "d2fc506a-3e6d-4c10-b4bd-0b6c7a128c8f", "comment": "Malware payload", "value": "617364875d331ab132bac1e63fb9b5a00ac5a33a22b93749dd6ee384ed435dbb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680836783, "uuid": "275bac3d-067e-4736-9a9a-2b2b2db2b06d", "comment": "Malware payload", "value": "089c2c51a4768925cf5dd0e88726d8a88e861795", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680836783, "uuid": "d0f17119-e3bf-4953-8ca7-3e06f98fbf54", "comment": "Malware payload", "value": "34734caa521c833d1b335faeb4fb713172e72862b3f79d6eeef832eea852c6b4f18a520e025add741e3a5827b46e6114", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680836783, "uuid": "440b5a86-9fb3-4cd7-a6ce-2ea8b76d7b42", "value": "T1A9645B49F201B472C6650070A65EF7B1CAB9FC359909A647E3C8FE1F3831680F729B5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680836783, "uuid": "01c69cb1-9895-4391-a293-4accaf222cdd", "value": "ceefb55f764020cc5c5f8f23349ab163", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680836783, "uuid": "b9474dac-97e8-43ad-8592-f274264c7590", "value": "3072:6SuVNqRgZRUA0S9tRtd6V+h8Rtt05NkkbjyGez1c:6SaNFZRdnxS++rt07kkbmt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680836783, "uuid": "ded12df4-f2da-416a-aae9-b73b1b8f1965", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680836783, "uuid": "058c3d42-3b42-4027-a0c3-c35054b93a97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680836783, "uuid": "ba8084fc-7a0f-498a-9404-ce3d2298dc2c", "value": "2023-04-06_b634be3c5eb62c87ebbf90f655581e96_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f570e3-d57c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680896529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896529, "uuid": "4f558a60-a8b6-46c5-a837-12d1f52a9587", "comment": "Malware payload", "value": "a5e03cd28870ff31ef522161336f17df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896529, "uuid": "78c385f8-c2bc-4676-9557-dcab7263d223", "comment": "Malware payload", "value": "6541c2ae75516d3c33fe14be68b927b982b6ed6a10ae4321673b5746e0886e3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896529, "uuid": "1aa804b7-74a6-4324-813d-b60b4cb09659", "comment": "Malware payload", "value": "2c609a365d08ecabd1b239d978847587c967652c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896529, "uuid": "60a1bd0f-6087-493f-99e6-436630b0c09a", "comment": "Malware payload", "value": "52bb9ea738b571d729da27ff16573a6345faed0b6ce6b210816869b1556e14925de1f57b359ac41df418866e9c95fca1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896529, "uuid": "8443eef8-82e0-4b51-97b7-9555c3a1c857", "value": "T1E3930993F901DFB6F40EE67604D34724B631BBA24E532662731739AA9E362C43827F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896529, "uuid": "e48b8afd-e18c-4a54-a7c6-e79c81e586ac", "value": "1536:xAKu2sO8oOpIGZfRDQmvjbl+D39ZvyeAyjmgNlwNabTmQHVqXjetR/3Q:KCsIO/ZfZTqvvyeAyjm4lwNaHmQHVqXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680896529, "uuid": "2d70e8ab-7b47-4340-b99e-f9f11a8bdcec", "value": 97433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680896529, "uuid": "8f0058e7-e3be-4687-9cf4-d15f0190b651", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896529, "uuid": "4b1b0b33-2f9a-4e62-a876-bb55745154aa", "value": "a5e03cd28870ff31ef522161336f17df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b866656a-d581-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680898863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898863, "uuid": "3c0d666f-7bf5-48a5-9574-12a2e1826f9d", "comment": "Malware payload (Mirai)", "value": "688699c47307af70b2f714b32a8bfddf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898863, "uuid": "5a5bf883-24a9-4ada-8c58-30502a3ced2c", "comment": "Malware payload (Mirai)", "value": "69b26a3ac90b402b82115907b0f017e52babdc749a278bd7b243233330e1b4bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898863, "uuid": "1181ca8b-329c-490d-a362-0c84d06f10f0", "comment": "Malware payload (Mirai)", "value": "4fb170fdece2bc0d4baa86dc692dc6dba83ebdca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898863, "uuid": "55c4e99f-be06-43f6-a87e-4282a0e9b708", "comment": "Malware payload (Mirai)", "value": "f8b61721c696dec3171598655767a7fa5945cedefb756bc663fbea03b0c3ae44dfdfb67c24a095a15fd98ff2e2be102c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680898863, "uuid": "40cf644c-807b-4868-8987-0f7736d8cc85", "value": "T19C131956F8924E26C2D4137BB67E5A8C3370A3E8C3DFB217DD506B61B98640F0D96E90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680898863, "uuid": "757f571d-1656-4e9e-aef5-3d85b7a1c210", "value": "768:8gkzU2FvG5lMFj/7mMPaNzAT89OLJimtI/+PYvotbVMP/OXRfzLGwzwbZn:fd2tG5yN7mM0zZMtIWPYoV8/OXtfzwb1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680898863, "uuid": "56028524-c301-436b-83cc-31e9dfab9f34", "value": 44616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680898863, "uuid": "cb0df25f-8963-4f40-9c49-31c980e1f698", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680898863, "uuid": "2088df80-d3f7-4202-ad6f-a4bc1771072f", "value": "688699c47307af70b2f714b32a8bfddf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f63ca880-d56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680891236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680891236, "uuid": "92a75cd7-d218-4453-ad65-36f70f33b1ca", "comment": "Malware payload (Gafgyt)", "value": "3500258693165311b6889ab65352c793", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680891236, "uuid": "a154ba73-0e29-43fb-9ef2-24e1f131f47d", "comment": "Malware payload (Gafgyt)", "value": "6a042cc68c2047edbd43fd020352b898fd431eba4ec6cab03f9e5029827638b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680891236, "uuid": "2b5346d4-6069-4922-9710-80e729dd3be4", "comment": "Malware payload (Gafgyt)", "value": "7c23fc6593989bf5c7d3fce38e6ab63f20ab2eb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680891236, "uuid": "069da166-504e-4148-a259-527a95ac78a0", "comment": "Malware payload (Gafgyt)", "value": "9566b4fe93a321baccc342cb32bb4dedb9820680a969049c59ee89f3bf15b2b1ba8c215c900f1e4537149b358898071c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680891236, "uuid": "65a84db3-fe4d-4351-8592-67701b6056e6", "value": "T13A933B17A652C57BC08762F41BCB9A11AC13BCBD0B63A30673D4BCE82B159D72DA9F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680891236, "uuid": "f90ba033-2f5f-4ff8-b2e3-ffcd40cd4508", "value": "1536:W7WREyqkQc923v2uNi7pNF+BoD30phanvn00GFmoI5um2Xj5YZA0e:4RkQT3v9EbYBo70phanvn000mr5um2Xx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680891236, "uuid": "e99d6668-a322-477c-bc8d-e01fddf61bcb", "value": 92932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680891236, "uuid": "d8ac7744-c99b-4971-b8e7-4ddd9ad42297", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680891236, "uuid": "664300ae-1b78-452d-b309-0672b95672b4", "value": "skid.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ccdd198-d567-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680887435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887435, "uuid": "93167b6f-0597-403a-9c53-7722da46c899", "comment": "Malware payload", "value": "ade39801827cf5ff35caaf182eb171b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887435, "uuid": "2b65630a-3571-4a1c-803e-5ea23a9a6d59", "comment": "Malware payload", "value": "6a86144414d162c15e2b7260744cccf101f7adf57e312ae82c5ef43761637d76", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887435, "uuid": "9a22cf6e-1f1b-4c25-8b9c-5dd8bf669c32", "comment": "Malware payload", "value": "3af67082c63f628c5f2b81e8de9d416a37e02b8b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887435, "uuid": "a7609752-dc18-44fc-b465-bcc3eef982cd", "comment": "Malware payload", "value": "d5d368ad6d3cbf05c9ef3c5875c8a397d1a072d40ddb3917c3532d7e2a4dc24a7e8618849703e53b3b510c9cde8ba366", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887435, "uuid": "29d8d29f-ddc1-4c2c-8f2d-054d04556bb7", "value": "T1AD14091654B21E73D85B5F7A2D76A5A0035EEE911F4F0E8FA1A9B5B0461BCCCF00E638", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887435, "uuid": "c6e75ab4-f552-4b0c-be27-58515d52a5d5", "value": "6144:jm8sLltZJ+uRoh2Od3Asb6mvWq+H/CpGr1Pis+ss:jmfLlLQbh2+As2mvWq+H/CpGr1Pis+ss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680887435, "uuid": "55555a24-7de9-4143-909f-596cc9ba1d94", "value": 197593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680887435, "uuid": "449b439d-7fe6-4db7-9ccd-bfe65ecea988", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887435, "uuid": "681dd4dc-f87e-4974-b3dc-6c8382eab7db", "value": "ade39801827cf5ff35caaf182eb171b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a6d7a0d-d51a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680854333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680854333, "uuid": "a0212bb9-ddba-4b36-8c53-a1d76a5f6e5a", "comment": "Malware payload (Mirai)", "value": "27b1072fda0cb9c2716db9eb8bac761a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680854333, "uuid": "864285c3-0295-4171-aa95-4481ec901aae", "comment": "Malware payload (Mirai)", "value": "6a9f900252edf6c7617c8d408b077574e2fe2874acb3f46db8821095b7ebeda6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680854333, "uuid": "44d6c7b0-03ba-4c71-addb-9afaf51e313a", "comment": "Malware payload (Mirai)", "value": "c058700bcd1f6b0fe4bd11793834467870b88462", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680854333, "uuid": "893ec4a6-37f6-4c2c-a242-eea4618e563b", "comment": "Malware payload (Mirai)", "value": "374e587bc931f0a202205111471662daa056224fbfc2a1eca67efb4b45df6297ea1d5affc138211c4673c90da0f557d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680854333, "uuid": "557af839-1abf-4148-b450-b98f5f670468", "value": "T161233941339C0947E2972FF5363F2BE593AEDD9022A5F1C4224FFB4A8175A734609E98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680854333, "uuid": "5bd3f189-8f4e-4b4e-8b82-e4f82ea21a78", "value": "768:UbCsSmkaMtbDUcrnGaopR2i+k1iPn6CyMUe6mDn1vis:+iaPNHrMUe6kVx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680854333, "uuid": "1d5fa7ec-5b34-4b82-8a7b-26f4d63fdd80", "value": 46400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680854333, "uuid": "28bde753-b4bc-49a4-a6fc-c167e0e57401", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680854333, "uuid": "7608c104-ef88-4360-b716-b59afa93ddbe", "value": "27b1072fda0cb9c2716db9eb8bac761a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ca0cfc-d567-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680887454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887454, "uuid": "28de5277-efe1-4502-9732-c9da0dc144f6", "comment": "Malware payload (Mirai)", "value": "1fa1fc15f944469af423643b4f108630", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887454, "uuid": "b929e8eb-b34e-4df4-8c4b-9c08f3b95ec2", "comment": "Malware payload (Mirai)", "value": "6e3a5d89e769e89036344e67bcf7d0f078621bcd070d6667c5d7688e203b1bca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887454, "uuid": "73a8779c-4b6c-4d42-8ebe-7428c8ce19a6", "comment": "Malware payload (Mirai)", "value": "03f53aacf41de8158d16c66afc1741b8ce5c417d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887454, "uuid": "2c7007b4-7074-4d9c-97f9-fdf26ca9291e", "comment": "Malware payload (Mirai)", "value": "3ade65dfe7a857c852ca4f50db71803a6545408cdac6d96197ce3dad1badebcb3f479a635b74f5d196a8885111cb81f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887454, "uuid": "87ef6b21-a22c-463b-a46a-57afab75b192", "value": "T165530A817C906A29C7D0577BEAAF108E3354ABD9D0DB7347CC044B917ACA90F0D6BB86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887454, "uuid": "b91107e3-cef0-47e1-8b03-bd981105cea6", "value": "1536:dOxGfyRWiPLacGXWzM9l6yTzpl84ETjpk19y20Yvck6YceZWGzD9MH:dOxkyRWiPkjX0QckVcwL2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680887454, "uuid": "401bfd27-b1c3-4503-9e5e-b62bd9b853db", "value": 62680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680887454, "uuid": "67e50b56-a974-4f92-b1b8-bd2642421849", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887454, "uuid": "18e7c153-fd09-41da-a1f5-187059354406", "value": "1fa1fc15f944469af423643b4f108630", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cacb60d-d58c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680903434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680903434, "uuid": "6854aae3-487c-4ff7-80cb-c627ddb80443", "comment": "Malware payload", "value": "88f88e236505ce206101e2bf9a461342", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680903434, "uuid": "e5ad06e7-7aff-4aa2-9e0a-106965e4642c", "comment": "Malware payload", "value": "6e9d0eab2da8bc25684e95fae693d1d3a712eaca9e25949f749821ece1d4de41", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680903434, "uuid": "2a2031a4-d861-4a9e-8fa7-0f342382e472", "comment": "Malware payload", "value": "e067ba3a27e2ba5ee5eb725f67c2f6a8383ef121", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680903434, "uuid": "6f885336-52d8-4e11-9369-2a3b0ac04e5b", "comment": "Malware payload", "value": "ef737ba8d6a51bef1625c90bb1db6fead36f61cabdda705e8cd20e5806248ed85c00ea55d1d32c426c678c758d87f66c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680903434, "uuid": "918af77c-8b9c-4a73-aabd-94df56bafa9e", "value": "T10A738D4237F58A56CD6ABB7A884706940738D6027D03E76ABCC4A22D0D533EDFE41A4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680903434, "uuid": "da74b5e2-3d5c-4db3-9c4f-e113dd292ca8", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680903434, "uuid": "201f14e2-e0d9-457e-9365-e103ee052dd0", "value": "1536:YBQTBTRq7grw6n3Bjyb5YLGqVw/YjCOu1mpH7dKUdzw4yOED:+QTBTREewg3BjyNYCqVw/cCOn5D1wPOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680903434, "uuid": "12402f8f-afb0-4056-8fc0-f1c5c0f8cbf3", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680903434, "uuid": "d184678e-a008-441a-b272-0262b4f8f58a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680903434, "uuid": "762e9bf5-cae7-4427-97fc-c672586fb522", "value": "friday.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb70fd77-d548-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680874414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680874414, "uuid": "25dc25fb-a27d-4fb7-8271-1e043593f4b3", "comment": "Malware payload (AgentTesla)", "value": "847993ae04afa83d6f6b1413d467f018", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680874414, "uuid": "9d60f26f-f308-486a-9b91-2f503503e98f", "comment": "Malware payload (AgentTesla)", "value": "6f575250ff0a37da51517b0c138b0eed0bde6c986ca7ba76344eb4803b4396c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680874414, "uuid": "0cbe932e-0ef9-4bd9-a47d-11363cd4b55f", "comment": "Malware payload (AgentTesla)", "value": "5665f09747f9aefb16e16287f4e4051758a4a101", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680874414, "uuid": "7c4b13a0-457b-409b-a8a1-e686fcf387ac", "comment": "Malware payload (AgentTesla)", "value": "76798e4e0aca0b1ea82e165d2b9c0619a7f794c081341ae8988c7ca1845b2a0a7d636504759564bbeabc07ceadf96b33", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680874414, "uuid": "f206827b-d3dc-4d5c-bab2-cd4ffae5c482", "value": "T1EE6423092274C0ABF4731FB20E3C5E9B2A66E50B65707F379B757708F522B52980E362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680874414, "uuid": "5f2d6adf-349c-417c-bb13-f195d3cdef46", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680874414, "uuid": "95000d25-619e-46b2-850e-64de2863e948", "value": "6144:PYa6VaJ7R9/jTD4LopFp4eUl1gkuuSUPCem58yMM6Ne4Yqu/4Bqnn:PYnM9/jTD4sSeUEVuNm8DN1uZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680874414, "uuid": "5b0c6a59-01cc-45ed-8986-ca8722814c32", "value": 329646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680874414, "uuid": "2cbb33b8-e1b8-4db4-b409-730d484e1b2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680874414, "uuid": "eb2f02e7-2086-4d9c-858c-e977a18d8583", "value": "RFQ2008817838749.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95e087d-d57e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680897550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680897550, "uuid": "7a7337e7-7466-4c49-ae6b-bc072c8c5566", "comment": "Malware payload (RedLineStealer)", "value": "33b3b92320223ebb3ff0e26023aca224", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680897550, "uuid": "8b33f7bf-f657-448d-ac66-55766a096938", "comment": "Malware payload (RedLineStealer)", "value": "6fe6d7e4b7fedda15fc25e15b457d9a7db6ef9ccb94e1494f30cccd4ccb5e02d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680897550, "uuid": "50deabff-449e-4541-bc78-4b873c4729af", "comment": "Malware payload (RedLineStealer)", "value": "b81785f68c09676e106da82c5d0e148a2af10536", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680897550, "uuid": "75f4899d-5bc9-4687-a864-cb7d9c8a3321", "comment": "Malware payload (RedLineStealer)", "value": "c48b0506062cbcad3557a8ee1e1389d1dd249d80a644a0b212ef9af24354d5c84417d0198c477ea044e9619eb938397c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680897550, "uuid": "53292089-60db-4ac0-99a5-3cfd6e8775ae", "value": "T136356D0F30560CF9F2262239576079D7097AE46258B1CDE717FF84FEBB6C841A913A62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680897550, "uuid": "0266ac1d-71ef-43d5-9da6-9db4e1fcecbe", "value": "534add4c0cbea8afae98064a5b4a30b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680897550, "uuid": "9a275150-41ff-4668-bdc1-706519a5c514", "value": "6144:uMsMDRQh8CktGt8Tnd7YZC0KaRUsmqUZ2LmbXr/5:u9cTnd0HzpSomzr/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680897550, "uuid": "7cffbbe4-dd53-4150-b74a-c73b442afeb1", "value": 1161728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680897550, "uuid": "a25e3003-b5dc-40f5-9f68-a1ddd744ddf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680897550, "uuid": "10b65805-36b9-420d-817e-ebd482d6a4ef", "value": "ChromeFIX_error.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4479b7-d55e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680883757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680883757, "uuid": "5fdcdff7-a823-4e6f-9f9b-355fdda6c866", "comment": "Malware payload", "value": "ef5adf950dbc03fbcdbd4d1faae63d9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680883757, "uuid": "634ce8b1-0a44-4c05-b296-fc3d7c87f5e5", "comment": "Malware payload", "value": "70842b20b2ae35e40db3685f2e9882c6528fbdcebd7297d0c0404e614cabd565", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680883757, "uuid": "0f0d45b2-6c4a-4279-ad2c-0aaadf750ae5", "comment": "Malware payload", "value": "eaabc1f2c97f7d3b77d282ceb48aa6c42dafcb6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680883757, "uuid": "f8844a29-9267-415e-9fb6-3cabbb299462", "comment": "Malware payload", "value": "481c904a4a185027650a3711dd4c365cd50f4f54cca60e6f7f0f0023d75452b43481d7b7ecce418391ef9fffc8efd34c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680883757, "uuid": "07c86969-0658-48df-a921-c0692cce316f", "value": "T12524D80FB6D088FEC0974B75269FA461EC32FC2A072961067356FE5D2F3DD9C994A290", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680883757, "uuid": "d85f9a07-4944-4289-8867-4b7052bc4d70", "value": "6144:6KxNmKuEaLPF8+Bgt0xmGeLn+SyLRy7tFs0sg:6KxNmKu1ZmGeLn+SyLRy7tFs0sg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680883757, "uuid": "be0426e2-29d5-4abc-a411-175e7e3c54ae", "value": 225446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680883757, "uuid": "585a52f3-70b5-4f8f-aad8-fd987c6f6958", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680883757, "uuid": "2121428b-17e9-49ce-a072-6e31bc4f4753", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cbf0f63-d57c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680896455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896455, "uuid": "5a2c26c5-ed41-41b1-a17a-7c830d6e4114", "comment": "Malware payload", "value": "86addcdec473b25e1f4a9c13b82c4f2b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896455, "uuid": "8cfc026b-2214-4f8c-9a49-ebd7460ccd92", "comment": "Malware payload", "value": "708bf328975ea4ceb3e8ca17e0923042bf3dec5fd04b0d776ec807cd048eafe7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896455, "uuid": "41c89e93-b122-4f41-b933-6d755694aad8", "comment": "Malware payload", "value": "15e3527a9ff248e452d2f3a5b8f70b7adc855d78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896455, "uuid": "f2ad3a61-0ccb-48bd-b539-35cfc43d31b8", "comment": "Malware payload", "value": "2e8be743f4294116d86bc794bc2d39602c69abc08d6c94e79dbafe60c008593098bfe4e1e7a9c7f644783c5608d9b89a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896455, "uuid": "7805a70e-e9b4-46be-997a-00eae5f48845", "value": "T144136BA28CA41E14E185C535BC360F32F357A910654B6FBF16A7833D8887DADF2463A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896455, "uuid": "4745a200-1f14-4027-a113-86537ba2c234", "value": "768:svHLLck6cB6/ALceV/36cDKjAiC1kVK35S5aUoko++eCdgNJJfiwbuqI:svH8YM/hU/lmBK35S0DkoeCdRwSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680896455, "uuid": "c14f60b0-43b0-40ab-9a37-1006e14278f7", "value": 42476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680896455, "uuid": "09c453b6-7504-4350-8825-269f2e11a7ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896455, "uuid": "dad62090-212c-4533-a387-93079f56de93", "value": "86addcdec473b25e1f4a9c13b82c4f2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe168210-d589-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680902416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680902416, "uuid": "57cd95e2-2be0-4bfa-a9b8-ae43597a0a9e", "comment": "Malware payload (Amadey)", "value": "5f3f614bbd4a7fd2a465afe0510b3eb8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680902416, "uuid": "919a1b53-3577-43fa-90c0-32b253c96112", "comment": "Malware payload (Amadey)", "value": "7227806e030cc029ddcf455694f3d235d14eed0dbe0a5ab083c4728df2311dda", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680902416, "uuid": "61dec657-66eb-4e7c-be0a-1cc4414b9be1", "comment": "Malware payload (Amadey)", "value": "1d2cbd617df35ee689cd17fdcfad82cea30b7bd2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680902416, "uuid": "1c6b5a2d-6e6a-4ab9-bc5a-87eecf913e0f", "comment": "Malware payload (Amadey)", "value": "e65572c9b208f3a0ac76e7c312092fb21fdf3ce83d0fd231f110a10c226c7e45d4972351797d9f9ca4b0a10a4f946cf0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680902416, "uuid": "2faa4c4f-a7c3-40f9-9808-937b60e109d6", "value": "T13214CF21B9D1F4B2D4E744755821C2F8BA3EBC939B46898B331A3B6F3C723C1566A351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680902416, "uuid": "ba66047e-5910-42ba-b773-0ae8460310b4", "value": "25a1b270f58163554bc7d2d96c00089d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680902416, "uuid": "8809e0d6-a4ca-4433-a004-d06a5a632120", "value": "3072:aBfbAMXlVJWbJlPfxlHkvHeBa27bqye/D8gpvw/EFq5mXNktzT:cA6VEzn3kPOaUp8Igpw/4mZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680902416, "uuid": "a32697d3-4ab4-4ac3-aa49-d208deb9e288", "value": 195072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680902416, "uuid": "e0e22ee1-7bab-438e-af5e-5a34350c772b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680902416, "uuid": "658a4749-7179-4b4f-a878-ce4adb35d11e", "value": "7227806e030cc029ddcf455694f3d235d14eed0dbe0a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf5d7e4-d57a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680895621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680895621, "uuid": "0ae26eaa-2258-47e7-b708-2764ae821426", "comment": "Malware payload (Mirai)", "value": "650b606272e86a86904162c190c31fb3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680895621, "uuid": "3ee456e3-a10c-40a2-8ed0-728e23e6b998", "comment": "Malware payload (Mirai)", "value": "722b7a20f62d598dcd47e1cc53f3f06adf4268b9e9dc91dc7701e50b67548acd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680895621, "uuid": "7e6f61cb-9480-46b1-8119-883fae8ef682", "comment": "Malware payload (Mirai)", "value": "d2a47c2557dcd057dc91bf2e4ec6acb2ae867511", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680895621, "uuid": "49b822f7-d9da-4275-841c-c2a7fefdd094", "comment": "Malware payload (Mirai)", "value": "6c9994a596f3e240d835dabaacdc036611ff959da12dcaa2830058e26d0a6fe5d4b5da67c8d71167f6a3264d99c54d0e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680895621, "uuid": "bab552c9-52d0-4a77-9219-060858e0e00e", "value": "T13A534B02B31C0E07D0A31AB0253F5BD197BEEAD022F4F684656F979A96B1E361181FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680895621, "uuid": "ee554b21-e286-4cc4-a1d1-2227acadb5db", "value": "768:SEE5hjcoCkhVRGfRnbmX7/mG1nhG5UmtTy5EM2D/p9OyDQvSFRMNYL6FV+tg6wWZ:+5HAdOmGyNtTAdeOyUaFRMNae+aTWCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680895621, "uuid": "3547c405-b7b6-4745-aeb8-28a008e95daa", "value": 62996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680895621, "uuid": "04c47a01-4bf7-4081-b884-6093c197d816", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680895621, "uuid": "7611f9b5-0a01-4da7-8d93-07abc27312f8", "value": "650b606272e86a86904162c190c31fb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d7b60fb-d56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680891007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680891007, "uuid": "d2d17fed-70ce-4583-bfc4-63fbf0f266a0", "comment": "Malware payload (Mirai)", "value": "56de9c07d4faa2da7d33045148c6784e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680891007, "uuid": "508e06ee-8007-4c6b-94b6-877efbd9f21a", "comment": "Malware payload (Mirai)", "value": "74fa125e69a9b56a55bef6c99721628d8d646e51bf9dd9f40491c2aa34f2b913", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680891007, "uuid": "c948a281-8d77-4fac-84ef-d7c0dfd56785", "comment": "Malware payload (Mirai)", "value": "95cf201a4df9825e2817247853773c3f8a8ac6d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680891007, "uuid": "3c3d5d0e-e069-42dc-9c61-e940687139e5", "comment": "Malware payload (Mirai)", "value": "2931861c85b1873378a757981d494c14c21d93a2b9de981de2ab5be78f8a88fe1972ac4f23b348cdf5c4a020fad2531a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680891007, "uuid": "8ac1c031-9d66-448f-80ff-42f37e1ea9e5", "value": "T1CD730856B8814B12C5D5127AFA2E128E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680891007, "uuid": "bcd42ed6-d518-434c-b47c-e17112c582ba", "value": "1536:2ln25xPBXk1wnnkL7+KE007I7RMqai90DIyiUNbsvHTGcV5GYIWo:7xpXCMkM/QTaFNbsvHqcVERR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680891007, "uuid": "300330fa-f085-4d8e-8730-b88c061d43ad", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680891007, "uuid": "8dd59e8a-0623-49b7-98f8-797844782ea8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680891007, "uuid": "8325a380-6e37-4a93-a0fb-5848aad7abc4", "value": "56de9c07d4faa2da7d33045148c6784e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "389d18ec-d518-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680853552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853552, "uuid": "7226804f-2c8b-4bd6-97e7-b5ccf1f1f363", "comment": "Malware payload (Mirai)", "value": "e0182d004ab4e0f78229bf0c811a4838", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853552, "uuid": "e73ce571-43db-404b-9e93-f9c347bc6625", "comment": "Malware payload (Mirai)", "value": "769a647ec3e54ad36b3c615ea8eb37abc555479977e971e4df323eb337e45855", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853552, "uuid": "f33f9a42-e806-4130-970a-9dc74e1836a7", "comment": "Malware payload (Mirai)", "value": "ca80eb029347fe53196d66547a7f9dc4e34f0cea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853552, "uuid": "37a57b61-0fb7-4fea-8237-5213624ca6d1", "comment": "Malware payload (Mirai)", "value": "2359c39295a1f95b8c80d0c0c7268dc037fe9b2ec0c152e947e358d206e2df91a1ff5e18ca3f5b69f9717844bcc2440c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680853552, "uuid": "0d8bdf7c-7e15-42df-9daa-074fff053fc7", "value": "T1E703F2344F13A0F6DD9295F44AE90B923EB8378DD1039C4A74E85B9F8E0789E78538E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680853552, "uuid": "719b6106-8d26-4852-be94-1f9dd7f436ac", "value": "768:Qu7xTPRyHgB8hO7eOL76ReUxmAZSWvxJNozj9UZGJgGlzDpbuR1J7zf:pTJyAgO7f6eEHlxnozugVJuB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680853552, "uuid": "2ad440aa-cdac-465b-b4bf-296acc94db05", "value": 40684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680853552, "uuid": "2b3007df-587c-4c08-89ea-6055ebc5b291", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680853552, "uuid": "16953181-1aca-4ad1-8fc9-7a93caed5af4", "value": "e0182d004ab4e0f78229bf0c811a4838", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fc33126-d567-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680887440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887440, "uuid": "18556958-df8c-4f1f-9395-9bf8628c1af1", "comment": "Malware payload (Mirai)", "value": "d4a4a9b71feb64adbaae24eebab28f46", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887440, "uuid": "4735298a-3dbe-4c07-ab80-76b6a06e6256", "comment": "Malware payload (Mirai)", "value": "78fb84080b0bf3a672cc58f4bb68390a253765e51564be2cab102156f4b366d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887440, "uuid": "af540012-c18f-4929-ae96-f5b7f312f8ff", "comment": "Malware payload (Mirai)", "value": "d0d1469a263db88479b98ed5bc053cc0dc7df287", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887440, "uuid": "387d6120-8823-4ddf-9a34-01d3c2f3c8f7", "comment": "Malware payload (Mirai)", "value": "3ba223f484d9a6204ebfa6561186f090e0b188edd6224ef28bb0b1d17c4ec3c51b5b25cf5e6f37646fe68e88d276d2a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887440, "uuid": "1fc1bd90-771d-4d4f-ab73-8ae194b91360", "value": "T122735C34A97E2F26C0C4A17E52F78750B2E5220F2AB4965D7CB20F4FFF24544A8562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887440, "uuid": "cc24d00e-32fb-4411-96bf-ebcfbb97acf5", "value": "1536:vsnCSemCLLWeKNJ+1kbOSYcpC636v/bcYSZjFFi:rS1+SYccv/gpFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680887440, "uuid": "ce1bc237-bc26-4c97-a7f8-e9d2187728b4", "value": 75388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680887440, "uuid": "a592a7a7-7c51-4a91-b1f0-d963e53b5af8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887440, "uuid": "2457f82a-64db-4e11-b217-d265b91f370f", "value": "d4a4a9b71feb64adbaae24eebab28f46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91fef005-d4e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1680829650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680829650, "uuid": "8ea0e254-17ac-41db-b07a-f74bbf2bad19", "comment": "Malware payload (DCRat)", "value": "d9d20e4adcaf382c442dfccf83acdc19", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680829650, "uuid": "40dc0255-2f8e-404b-bdc5-f2a66166f927", "comment": "Malware payload (DCRat)", "value": "79a51d23dad97ebd9efe6f8554dd4dde177c98f6028c596e4fd7566968440e96", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680829650, "uuid": "e1859eea-134d-49dd-be9d-aca7c70fca76", "comment": "Malware payload (DCRat)", "value": "9d69dd0ec4d6590bae7f22a3675d27cfdbc1cf09", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680829650, "uuid": "0263c680-2a4c-42bb-b149-cd268889fdad", "comment": "Malware payload (DCRat)", "value": "8f4f1a7eb1110dd4473b70455bbd87c3f01519c9f63e70686a7edcba3a9a409b3b480bc5923cf7b2e570605fa93952e4", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680829650, "uuid": "1f1a4c7b-0c3e-4cc1-b5a7-a15987511e24", "value": "T108A5AE90B9E9C0B2F4B218B603FDB7551A39BFA10A8DCDB7239D1A7E8F2F1425444D16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680829650, "uuid": "8c4b7247-2638-4806-b5c8-511f8c695e19", "value": "2dbdc947e0ec11df6856378b823a186d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680829650, "uuid": "bed251de-3666-4b0b-927b-bbdc9010939d", "value": "12288:iX7pMl8SUapiVmLs0OFyNowl2C34TaRrJPeqB:gVY8ULBOFyNoI2spB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680829650, "uuid": "dd7a55a3-7f19-438c-8dc5-5e04e4bd0dd5", "value": 2230688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680829650, "uuid": "4859f585-9ba8-416a-a1c1-b004e63a423d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680829650, "uuid": "4222e63d-c779-4e17-8007-54f2436ce8ab", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c547cc-d4dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680828361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828361, "uuid": "e7acb0d0-7e6c-472d-9fcc-5ef847976351", "comment": "Malware payload (Smoke Loader)", "value": "0350d0da45b8b061a9f9bca82c84abdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828361, "uuid": "e391dfcd-2126-4c2a-ad53-1a73df951b2c", "comment": "Malware payload (Smoke Loader)", "value": "79bf23030fea02cfbb782cc49e6e3ec436c4660432a4f27926395e6222581776", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828361, "uuid": "73fa5e5c-a1c4-4f26-a0ad-1e3ac02455c9", "comment": "Malware payload (Smoke Loader)", "value": "47df5d2fa6b4a1034d9e04edae51a98c34dacd4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828361, "uuid": "05820d5d-c972-45d0-9c8b-88ff97898612", "comment": "Malware payload (Smoke Loader)", "value": "33a2252644c3f72280940004019d7d0c1d3bf8f830f1df8ee055a1c9075487525703f1688c861ebab69694b0666bc63d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828361, "uuid": "88dca5e7-178e-460f-8de5-5b5d49242e62", "value": "T1C7645B0263E1A874E5224E338F1EF6F4A61EF8B0EF17FB5A26695A6F0D70171D162314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828361, "uuid": "835762cb-4f5b-47a2-96d5-170311f84afe", "value": "2b092cb2db51c3e3bb5667c747571bb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828361, "uuid": "08c54f54-c87b-4e19-84a2-ee61bb5cc72a", "value": "3072:dx4CWiqNOA/TY3k3eGriDLV9Tr6KSNfPHUA2gKxvhYQPNjQ5LAjy:bpA/CkunLex/lY5R1GUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680828361, "uuid": "21d74f62-f9ff-470b-99c7-c2e40cacdea4", "value": 308736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680828361, "uuid": "65539dc5-23fd-4535-ab34-c8abf14cc147", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828361, "uuid": "889e2d1f-4e81-4ecd-a4f6-3057081e48b1", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ffc0d2-d57c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680896492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896492, "uuid": "bbeb828c-70fc-44a3-bd5c-8befb7e54f21", "comment": "Malware payload", "value": "2d7b3d39aca876bbf5ef894387edf1cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896492, "uuid": "dd22bacb-294e-4d34-8261-882ec01f7d9f", "comment": "Malware payload", "value": "7aa46af9207696564c6a18fb0e835b5eab8f8e9392c92bc57ff8d71d3fddd55a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896492, "uuid": "f3df7ae5-f379-4cee-a48e-2b3781b5236b", "comment": "Malware payload", "value": "afa1529e70d8eb05b004ab55c28a39ce45cb98d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896492, "uuid": "b873cddc-4098-455c-bcc7-47b35fdd7b28", "comment": "Malware payload", "value": "1aa399b5a1b52bcae1a0c5efd9f4e948053925424f8b0dadffb185dfa9890b5d5ff441226873a9e889acccbc6a0afacb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896492, "uuid": "e7c30a56-b1c4-4c74-9ebd-ccd7029763c7", "value": "T10F232841B30E0A43E1A76FB46A3F17D6A399F95031E4A584264DEB4ED631C324ACEEC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896492, "uuid": "d469c1a6-f5fb-437e-8f76-a8f2969fce9c", "value": "768:8TsGnbO7kw1oylDiW9FxzZYjKfoPe13BFqKtaMmIv:6bO7kw1plfFpZoKAPel2KQMmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680896492, "uuid": "32e5ec00-ec62-4d29-800a-1c731fb97fb1", "value": 46516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680896492, "uuid": "459c80bc-6df9-4c59-8685-625510bb3327", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896492, "uuid": "b012b5e1-1c37-4e49-9dbe-ecf503b6fa91", "value": "2d7b3d39aca876bbf5ef894387edf1cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36041413-d56d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680890055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890055, "uuid": "df8018ca-34a9-4106-874c-d1db5d42a9ff", "comment": "Malware payload (Mirai)", "value": "d4aafac554e05141b65b6decbd3dc980", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890055, "uuid": "8eab3d1d-5fe3-47cc-92aa-fc1463c72565", "comment": "Malware payload (Mirai)", "value": "7c638c2843e2b957aaa9689337d503fbfc80393c357aaff730506ec143ed5826", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890055, "uuid": "6ba719fa-7200-49ab-9486-b0385397efb2", "comment": "Malware payload (Mirai)", "value": "f64709f188f37506cd075287d17ffe64bb81d371", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890055, "uuid": "083afc2f-4180-43a1-97e4-ca7e2928591c", "comment": "Malware payload (Mirai)", "value": "a364f7e420d06aece7237830dfffb059252e0a1a24f5e6e612efb40974cf9db8eb4a6296236a97c85777ce821c5f3fb7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890055, "uuid": "dbb50e41-3bd6-4de7-a638-5ede779d28e4", "value": "T1E1639E62C6163C54C15D8275B0A889797353A90880FB2FFA69D6DA6AC403FDCF18D7F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890055, "uuid": "8f7d1497-4ce0-4cb3-ac36-2fddd681f1ef", "value": "1536:U/6K164YXa1bMvmhOh/fcIfEbsd2kBwt2Km65D0kNjCddkCwbZnN:USlHKbgmhw/01sdtkJmjkNjpCwbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680890055, "uuid": "6fa1391f-2615-48c2-8acd-ca62bcb40e63", "value": 71024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680890055, "uuid": "5d68af9c-d2e2-4326-800f-645aa0a180fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890055, "uuid": "dc08b0ef-239c-4ecc-b6f7-53481da4928d", "value": "d4aafac554e05141b65b6decbd3dc980", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d84437d-d561-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680884913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680884913, "uuid": "54060f4d-ddf8-4870-83ee-24d611391568", "comment": "Malware payload (Mirai)", "value": "b9e0b36c8ad41dbcf2768c0c67cb181b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680884913, "uuid": "756ad598-15af-4336-83f1-b472263c3230", "comment": "Malware payload (Mirai)", "value": "7d4a23449751aae48d6a0cf3410d2b90e5bd0e0a4defe69a0368f8b2d205eec0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680884913, "uuid": "5179d0fc-d8d5-4a7b-8f9c-aec8e92f7bfa", "comment": "Malware payload (Mirai)", "value": "7453dcb74608947c474ae6784998969b1ecc9532", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680884913, "uuid": "adb2182e-a579-4ebb-a15b-02d5ba76a27f", "comment": "Malware payload (Mirai)", "value": "8e56f0fd4d9bba6b3ec90999a9cc75ad124e4f8161b157241bf4e9712ddbe8efe35ccea48bf082465e8f247056ef38f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680884913, "uuid": "377adb1f-9afd-4580-baba-97f5b81fe7ac", "value": "T199E33A56FB804F13C0D61776BAAF4249332397A493EB730699187FB43F8679A0E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680884913, "uuid": "92f7b0ee-1e02-436c-87ca-1abc5a194f26", "value": "3072:QVlbPFiIHhoCajbeCn85hyyeacItxQwbZnIQXi0yM/954IC:QVlbd1GCajbeCn8fyyDLQwRIQXiBM/9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680884913, "uuid": "63d4e3fa-9ad2-4067-8049-82db92247f48", "value": 154960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680884913, "uuid": "565c6415-1c62-4ad0-8bd1-97e5cd647b33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680884913, "uuid": "f007d4b1-44e5-41a5-b06d-a347ebe01eed", "value": "b9e0b36c8ad41dbcf2768c0c67cb181b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9294dc8-d516-11ed-88f6-42010a9c006e", "comment": "Malware payload (PennyWise)", "timestamp": 1680852935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680852935, "uuid": "e5605b6c-2698-4c3f-89d7-12c1cebb1c90", "comment": "Malware payload (PennyWise)", "value": "3a0e66d32a4925c10140a31151ebf802", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PennyWise", "colour": "#4CC31C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680852935, "uuid": "8a5e0e45-fc51-4400-9a48-42545afa61f3", "comment": "Malware payload (PennyWise)", "value": "7dbae43207a9d07f769366cf3ffa71fa7fad855a9a83b018223bba4d7ca4b89c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PennyWise", "colour": "#4CC31C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680852935, "uuid": "17974155-7f5f-4fd6-b028-76a3ec1c931d", "comment": "Malware payload (PennyWise)", "value": "13e0723d9a32090f6cb78082f43583154842d9b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PennyWise", "colour": "#4CC31C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680852935, "uuid": "f5c41018-0afd-4019-b083-265790e36af5", "comment": "Malware payload (PennyWise)", "value": "8676e21536be09167dfb6d74ca6d67614201cb84d09d508f3549147f2a2a0688904ea1137eb3c8f8a33eac8e17650691", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PennyWise", "colour": "#4CC31C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680852935, "uuid": "d63131d0-1585-44f7-8e33-2f49e5dadc73", "value": "T197B308BC2248BD85C7ECB3BAE862101A737DE15FA813E747D8F3A5B611073C549B2592", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680852935, "uuid": "b8e3d2d7-bc50-4c5e-94e4-5ede91362f41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680852935, "uuid": "9c685b55-6322-40ce-ae8d-24ababe65c51", "value": "3072:SfzzbUYJE0SGeKoIFzb2kKMuU1gVq8akcRPYNbM+6uHWiWk:+LUYJ+KoIF0GksMQ+Hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680852935, "uuid": "647c205f-0045-4988-b24e-2b7b7b5845c3", "value": 112128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680852935, "uuid": "355a3e85-aff9-4d4d-9d8d-9e48923350f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680852935, "uuid": "b7ef9ff3-0447-445a-b2b9-d554bf4f9ba4", "value": "Installer crack.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec11d38-d589-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680902203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680902203, "uuid": "4664a0e3-1567-4277-86cc-9f7343c5190b", "comment": "Malware payload", "value": "a20c862aee6c35614e1bade90e3645d2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680902203, "uuid": "14948c9a-80d0-4ec3-a0ce-76204a95b168", "comment": "Malware payload", "value": "7f4f2ba2347cd4e83db8bfcd3c57849011ce6508b2f10cb367caff3d0626fba7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680902203, "uuid": "2dded0c6-fb6b-4ef2-8a27-c862a28b4b23", "comment": "Malware payload", "value": "97ba116c999c99e8ffe70a27f013ef648ad425d4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680902203, "uuid": "b75e0934-821d-4612-a15a-7700d413898c", "comment": "Malware payload", "value": "7cc7e5cbd377c8c5ece6582081809d4162c933263584b9ffa745faaae4728f6cef6a87ede4bf6788e14d6f3bcc39503d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680902203, "uuid": "4dcc1368-ebbc-4895-a6e6-47d5687609b7", "value": "T18B24B4F8B8A7D9D4F50B9C8065ACFDA20D3139F3A9C90E21032D65049FE9E956F4858F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680902203, "uuid": "bb856e37-3848-4b7d-8eef-aeb935fbe7c8", "value": "6144:pIJhgDkagggc1dReKtulYJjNbZiDGWWlYJd:pwhpc1dReKtJHiP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680902203, "uuid": "c22bf0b5-19e5-4662-b05d-e8cb994b04c8", "value": 225688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680902203, "uuid": "3f2403c1-5940-4f45-8728-584de4b5e7e8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680902203, "uuid": "16a635fe-0332-4e70-a9e1-2c703f919a1e", "value": "x.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea25413-d56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680890955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890955, "uuid": "f2b65264-ad1c-4609-af0f-fa5f7f464690", "comment": "Malware payload (Mirai)", "value": "b7a10a74e516b2812e20e237576c31d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890955, "uuid": "eacb4cd3-1f81-4b7c-bf8e-a92912d504cc", "comment": "Malware payload (Mirai)", "value": "7f625285e5bcbee876424b3e2739f3a0f1edb613d03419ad620cdbf777132d36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890955, "uuid": "a0d8af44-e847-4f65-8493-9031572b62a1", "comment": "Malware payload (Mirai)", "value": "031cd3627175c6acdade74f7a17525642a1694d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890955, "uuid": "75747704-7404-48fa-89bb-244da01890c3", "comment": "Malware payload (Mirai)", "value": "17717a3b4cc50f082738b5be02c23ec9a2e52a12207a0a22f6e93038e49fce640ec0ca5cccbd53e0fb51cbabcd8423a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890955, "uuid": "d6859cde-51be-4227-9c63-022012051bde", "value": "T12C635A31BA761E17C0C5903A21F74B25B6F543CE25A8C62E7DB21E8EFF20A406547AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890955, "uuid": "cd88acd3-6978-4f75-a065-8783f4e41291", "value": "1536:Yhbd83ulnDRfXyWLIom58Puh75e1tgVwbZn2n:E/JchVDVwbZn2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680890955, "uuid": "f8f3a510-f09e-4f83-a308-7fedce38c972", "value": 70472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680890955, "uuid": "deff6311-ff19-4d9d-becd-203d2e3dc7b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890955, "uuid": "5fafb1b2-09cb-45cc-8b0a-1c5c4edf7ce9", "value": "b7a10a74e516b2812e20e237576c31d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11bb00a6-d57c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680896436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896436, "uuid": "ab6b62de-9760-4cfa-934c-fb3f04517701", "comment": "Malware payload", "value": "f2f3ae996b2b207ab2bcdc6525206a8e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896436, "uuid": "74cbeaaf-8817-435a-87dd-b1fda6320990", "comment": "Malware payload", "value": "846050a6722da2e6369a4f93e3bf58ea1f9ec4339e92290a1481da4b61d1b086", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896436, "uuid": "c4ae8e4a-4e79-4770-82ef-38f18238cea1", "comment": "Malware payload", "value": "62a6a6c256cb617055482b1c85ff03dceade9979", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896436, "uuid": "45775702-d1a2-4426-be5f-38a558bf9bd3", "comment": "Malware payload", "value": "1ca1affd2f2a599d80fe5f5c4a1f36341b0237adf5113ed42e24315d3321d2810b74e3e93382327db91e99578c1ac773", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896436, "uuid": "bfd42762-4994-43b1-9e31-a73cd0af0536", "value": "T1B653C85E6E618FECF7ACC33447B799216359338633E09689E29CD6105F6024D681FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896436, "uuid": "1732ebfa-31a7-4106-a298-6809d799b8f8", "value": "1536:lq5RThRNhRhR/RuhRF25t0QQ0oaeHkncHnK:0trQ0ouncq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680896436, "uuid": "55fe3e4b-69aa-4498-95b8-802589d8defc", "value": 61292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680896436, "uuid": "4e8b70e0-9830-467e-b2f1-f8dc2b56b055", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896436, "uuid": "d4036ab6-190e-4982-b76a-784374a39fbc", "value": "f2f3ae996b2b207ab2bcdc6525206a8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371f89c4-d510-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680850113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680850113, "uuid": "a392e9bb-438c-4bb4-8a65-77331fdfc81e", "comment": "Malware payload", "value": "b3c324094c112c90fafbe06c70106665", "object_relation": "md5", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "diigbiej5g-cn", "colour": "#793FDB", "exportable": true, "hide_tag": false }, { "name": "ewtrtc-top", "colour": "#92AF94", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680850113, "uuid": "45e89781-1cf3-47e8-af2a-7196c5141943", "comment": "Malware payload", "value": "84abd1b53262c8002a07b05c22e53488b42166254b3c2affedc55e750ba38281", "object_relation": "sha256", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "diigbiej5g-cn", "colour": "#793FDB", "exportable": true, "hide_tag": false }, { "name": "ewtrtc-top", "colour": "#92AF94", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680850113, "uuid": "2fa0e7a7-b1c1-42a8-8490-b76c938fc456", "comment": "Malware payload", "value": "47a2847afb0e8e563be8c4b5c84d82ef85c98363", "object_relation": "sha1", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "diigbiej5g-cn", "colour": "#793FDB", "exportable": true, "hide_tag": false }, { "name": "ewtrtc-top", "colour": "#92AF94", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680850113, "uuid": "26b4ab28-a8d8-42b9-90bb-df7e390dcad2", "comment": "Malware payload", "value": "dd98b960d272f02552e662f9632b4b1adb2629a338e6b356642dc2380cc6ae3e9207814c08e00695d9ac4af09097b15a", "object_relation": "sha3-384", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "diigbiej5g-cn", "colour": "#793FDB", "exportable": true, "hide_tag": false }, { "name": "ewtrtc-top", "colour": "#92AF94", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680850113, "uuid": "5c5231e1-caed-4858-90e2-4b8eb9ea78c7", "value": "T1A811C010625EBD6C1A27F2C3B6B441903FD70840C44D39219B485C0E9F76AAA86EF9B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680850113, "uuid": "6b07fff0-94ea-44ec-a54d-8cbceb279341", "value": "24:hlXI2hH0WbNR8piBlOigEB11fXXfD/ucDa2AsamxaHn:hlXI2l/bNypGlOzEB11fHfDBGVmAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680850113, "uuid": "4c24c72e-6946-4873-a748-ab23d22db6f5", "value": 924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680850113, "uuid": "b684b4a6-92d2-4be9-af91-ca8b3babe019", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680850113, "uuid": "54f34e39-3b4d-45a3-b012-2503b681a2d1", "value": "client32.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ced74a-d563-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680885867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680885867, "uuid": "00d132b2-e281-4021-a003-91010995ef21", "comment": "Malware payload", "value": "460800965585cd8c6a160d6d31827ef6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680885867, "uuid": "1bd7b0a6-67c0-4878-bb98-634c458fbcc4", "comment": "Malware payload", "value": "8769ff283012a133af3c1b8f2c79595e1862fccba7e7cdd9595301ede76fd3a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680885867, "uuid": "ebd6531a-81b8-49e2-9858-0355c6e4ed6d", "comment": "Malware payload", "value": "eadd6b2d94873de11532034b7c1353e7c170c6c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680885867, "uuid": "9713724b-a774-4cd4-80bb-852e1042f8e1", "comment": "Malware payload", "value": "3fe6ba81427b134b3f0f36f10c056a8c97f717ac36d42428ff51b02639ec826a948e123a372116c3786b0f04569cc400", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680885867, "uuid": "7299d57e-6bc1-4db5-8824-4344d4ed9dba", "value": "T1A3820701AA83D8F0EA1015B22163DF35BEB9F9BA205BDB07D760DC3BE421991D71726C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680885867, "uuid": "e35ab626-eb3f-44df-bcc3-4e9dcc15d37e", "value": "384:fLyx4MrFYT05/0uueAwXOSXLsKfii63+mAzAiq70Ch:uRF+qMvkfiic+mtv70Ch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680885867, "uuid": "2ba10096-187f-47cf-ae94-2b7a8980821f", "value": 17768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680885867, "uuid": "665c47e3-bdc1-40f1-9425-11a34e22adb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680885867, "uuid": "04d4f41c-c4d3-4314-9674-7fa4453a72ec", "value": "condi.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38feb3d4-d57c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680896502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896502, "uuid": "3d78234f-2ebd-4bcf-84d5-b23ac51a563f", "comment": "Malware payload", "value": "7b6cbfcabb46fbc9bd6c3a8b863afa09", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896502, "uuid": "4e1444b0-e78d-4ecd-a1b4-92ffb4a738cd", "comment": "Malware payload", "value": "8973788a86eacd431d42ff622559b9654cd7ef42c6c26ac6289283a5203f30ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896502, "uuid": "9c49c624-3d81-41f5-b743-04926dbd3ae0", "comment": "Malware payload", "value": "c8ded421b8c3c53dc7ff3998471fe41673cbef30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896502, "uuid": "726bc703-52af-4dfa-99d8-c82dffa7ba63", "comment": "Malware payload", "value": "184ff607277e8534cfc4aed1477824baebc925992485881c8912783d1db13703e287c74641b0cdd883845ac585e50a4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896502, "uuid": "755e49b4-b68b-44d2-9cbb-f878dbaf6b04", "value": "T186C33A01D5508B27C2D2277AB79F825D73332B6897DB33119A247FB82BC1B9D1E3A521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896502, "uuid": "767a73c4-f836-4cd7-b13d-ba7dca345286", "value": "1536:RgnO/l0KwpaDsY1M5uiPrbZtvWhAwjg50rwlYypDmLaiaujqbmwsQOW8fXG4N:eaGDbZtvWh/gcUdpDtuebm3QOWsXG4N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680896502, "uuid": "ec5286ab-c0f7-4a99-a996-7fb1f193caee", "value": 119507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680896502, "uuid": "4bbc1a2a-6f8a-46a6-ab83-89a17e73ac96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896502, "uuid": "9aa4487c-8027-4f36-9115-a7eeef4a5460", "value": "7b6cbfcabb46fbc9bd6c3a8b863afa09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "322985ae-d57a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680895632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680895632, "uuid": "761d5558-364b-48d9-913c-818a2e6862cb", "comment": "Malware payload", "value": "7f1121ca1d0b804c9daad920fdb48908", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680895632, "uuid": "2788eaa5-3b95-4cdd-8b58-d19b3bc35672", "comment": "Malware payload", "value": "8a73f90ac7731ff9471012bd24c59d11dbf14c05babb7d57604c6214335e2391", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680895632, "uuid": "e0b42894-e5dc-4479-ae7c-b5539d44c15d", "comment": "Malware payload", "value": "fb8c4fbed4c4a860cc65a04fe9ea7a679bd385f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680895632, "uuid": "6397a609-c266-4d22-ac8c-2c626443854c", "comment": "Malware payload", "value": "fef54416da63de76a01bd17cb73f45cc871f0b52d3722a0afb3271f748cc53d3dcb9dd9cfeacb19d40087a26d738d70c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680895632, "uuid": "a2d6e185-b724-4244-95b4-156ad60c2f77", "value": "T165C3C517AB61DEB7D81FCE3306AA4501108DE14652E97B6FB2B4CA6CE74B84F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680895632, "uuid": "c2482553-9f44-4e05-a207-bab2b50ba9c3", "value": "1536:Y/eTSqoVbv27X/T9MVmpZx36b059MvJiXC1oymc0L24OdiaF/+gUmkigFxfC7cgQ:YgoqT9t5moacLuieUmkigFxfKcgnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680895632, "uuid": "cc619eae-bde4-4094-aae2-6da01c07a321", "value": 121966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680895632, "uuid": "abd0a18b-4bc6-4226-829a-601a402491bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680895632, "uuid": "11b65106-3759-4530-b9be-c98a8353ce8b", "value": "7f1121ca1d0b804c9daad920fdb48908", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db359b1-d589-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680902174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680902174, "uuid": "4c893723-07f0-43bc-a1d6-0c591a4bab47", "comment": "Malware payload", "value": "d04c40b337e256cc052a125ab25b1ae4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680902174, "uuid": "7d832953-19a9-4ae4-b179-13abb3ecca67", "comment": "Malware payload", "value": "8d758e075926e1e009666200329eb7689da5b140cdc213e76835963eaa7cff2f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680902174, "uuid": "b7ff9d12-b7f7-49eb-9a30-bccf34d6d041", "comment": "Malware payload", "value": "98ae4c90d50c28ca38274e75917ef1651ec430c8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680902174, "uuid": "8c775fd2-93c5-486f-bea5-ae9a5aa12b28", "comment": "Malware payload", "value": "927b5032203b41cb2611a80bc1d76c7ea1a4f029d5630631960f65a59c306cb8b70854d56fdc7a330338ddbc426ba5a3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680902174, "uuid": "8815c6b4-90b9-4afe-90bc-c6ba54111309", "value": "T1FC632B736217FCCA776F2E84E8003A640C9C796F1BADC948FEC906A855DA510EF69C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680902174, "uuid": "9a372a7f-4557-4fb1-aec2-7660ad8fd087", "value": "1536:jWCqPM7wb2Xe1KXcsBJM++tc7aSeoUHWnRavISk5gyf6PFtAiu2bQ:jWCqPM7wb2Xe1KXcV+kLSRa1igsy8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680902174, "uuid": "ba16a0c4-98df-4012-9945-941740b28c98", "value": 72444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680902174, "uuid": "5be2b011-b7ae-4bc2-b658-040e8b80af95", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680902174, "uuid": "c1c49ccd-308f-4141-bd2a-aac0d361ca88", "value": "ax.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35b76c1e-d57a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680895638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680895638, "uuid": "38391713-daa0-4546-b830-8b745c2cabd8", "comment": "Malware payload", "value": "cefbb891d3b5653d010c3f1fa4538255", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680895638, "uuid": "b783bfca-c60e-46ba-8d21-ad6a5c7f097f", "comment": "Malware payload", "value": "8d90ed9c36fbb5e2849c69d77f4d588279697da6a9e3c65769db7624abda46c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680895638, "uuid": "fd3d67a2-93df-405c-816c-1adb887be5c2", "comment": "Malware payload", "value": "75d5d62fc1c5c5c6479b4934a98a65af90460deb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680895638, "uuid": "603f4c91-771c-4d51-9a68-85975335674f", "comment": "Malware payload", "value": "d2652956bd52e2fb6b91c89a3847312339afb656c811b99e887ddcea84f87e8e1bebd2c36f3f4e668613fbef364add01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680895638, "uuid": "3d503123-a689-4cf1-b8d8-1cc44516f044", "value": "T165C3962A7E12BFFEE168863107F35F70839521A236A19386F26CDB585E7128D1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680895638, "uuid": "52005796-6da4-43d3-b0a3-09ac87c4c3c0", "value": "1536:W7jO1TP6jquDXASiSjuR2rK5ZuN4HrzPe3mreBz+7JJLhJUmkigFxfC7cgnQ:RR6N4HrzZoy7JJLhJUmkigFxfKcgnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680895638, "uuid": "5e589d51-de14-47b4-acef-be2f0b3ad85b", "value": 121854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680895638, "uuid": "1284a720-096e-4bdd-90fc-f3940d11e77e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680895638, "uuid": "ffb055e4-48b8-49ca-80ab-1daa37156cb9", "value": "cefbb891d3b5653d010c3f1fa4538255", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6da57bad-d56a-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1680888860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888860, "uuid": "b2dea0d0-7ebe-4605-8e02-4885d244a461", "comment": "Malware payload (njrat)", "value": "af1df10419e9286c734b7d470cb4c07b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888860, "uuid": "bfd4ff34-603c-40bc-a579-afc6b0692660", "comment": "Malware payload (njrat)", "value": "8dbc87b4b51a4138bc834ce54b429d4267250e953ef68e345ead7311017450a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888860, "uuid": "79db8fe3-3af8-4246-adbc-032246cbcc0c", "comment": "Malware payload (njrat)", "value": "bd1aa6e0c3cbcfdad94174df925aba467dae05c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888860, "uuid": "60bb8454-7ab8-44fd-90de-ed6da8f33caf", "comment": "Malware payload (njrat)", "value": "48a0612a0ef873976e1b9578be9c478a5ae4276b63596c49fc2fbd5f0ebc7f0be394acf505ca16a817ad4465603a26b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888860, "uuid": "1f746880-74ae-4131-829b-161dd1953737", "value": "T1E8E2F9467BB58216C6BC1AF88CB313114772E3878472EB6F5CDC48CA4B676E04645EEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888860, "uuid": "b9d9783d-6602-40a1-b1ab-97ce203dd761", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888860, "uuid": "f947b257-d903-42c6-ba98-6a5a92611c98", "value": "384:w0bUe5XB4e0XGOD5IQgYbr9pWWTltTUFQqz9jObb3:1T9BuVdIQVbJrFb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680888860, "uuid": "a822df96-f893-4851-891e-404c61d85cbf", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680888860, "uuid": "6fd03178-6dfa-4d6f-b93b-c472a1cb621c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888860, "uuid": "d8f248eb-652f-410e-903a-f8992201e228", "value": "x9r5muaSSKvD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275f8ea5-d57c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680896473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896473, "uuid": "1d2df59f-c1b5-4318-97d0-ad610df5c5a6", "comment": "Malware payload", "value": "1f63535fc290a1ae1deeed1cf4590eec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896473, "uuid": "92db7605-f89c-404c-96fb-a6da96cb086c", "comment": "Malware payload", "value": "8e681aa45c520fb1eff741b89ef3f0f91f7380434ec393ace44f97ffc3338d94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896473, "uuid": "61ce9c4c-953a-4d64-802b-a1ee72be4052", "comment": "Malware payload", "value": "d8b4f1dfcb701b5645226271a5d58e2c3b1a9739", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896473, "uuid": "1a2b7276-1647-4ee5-87d5-8add988f73f4", "comment": "Malware payload", "value": "2a5af3a397faee336419ad32f83e3fc9fd79132a9c60ac195be7964332eaf4e4f6ae1469c622d9a1e08be7b8569096c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896473, "uuid": "1367f395-1e3e-416c-a300-bdb45b571e93", "value": "T1F4A31A41F9418727C2D237BAE7DF439D77365664A7D733016A386EB42BC5B8C2A3A120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896473, "uuid": "309e70f9-793e-42b9-9f79-1fc8250c61be", "value": "1536:v1rThJkHYdjfvrekyc+CWMxtOoyKXPdI1p4LM4cYmRiqQ4b/XAhhIQ:nJQYQkVWMRXPS1pKM41mRiqQ4bvAhhIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680896473, "uuid": "c3d6d431-d909-4307-86ac-940e7b0e2972", "value": 97955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680896473, "uuid": "98e2dbb3-73dc-49b4-bb87-c510b580cd02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896473, "uuid": "1a549142-2ae5-4ac3-9f2e-e9c6c08ca8d5", "value": "1f63535fc290a1ae1deeed1cf4590eec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478ab548-d590-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680905117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680905117, "uuid": "7ed49ccd-9be0-42a3-9620-f2aa3b20e921", "comment": "Malware payload (Amadey)", "value": "4b8a2ca2c5c007e8e915d1716194933d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680905117, "uuid": "78d5e61a-8d85-499e-be71-022a685d639d", "comment": "Malware payload (Amadey)", "value": "8f8b341230323b995c1cde1d534031092bfddb56411dac43d155e5366681e1c7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680905117, "uuid": "dc920399-5ac5-44fb-a402-1729a8a6c9e1", "comment": "Malware payload (Amadey)", "value": "eaf6bbb82054ec30411806eafd927e2dfe2828a6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680905117, "uuid": "7df9fa6c-917f-4183-82bc-c6c4c4a7d7f5", "comment": "Malware payload (Amadey)", "value": "094dc1147b50a8bde5dcb8f6058a841d7edb274dc3f2c377dc1666bea748a0e8c1895a3d5db6c0e425c4bdb867095683", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680905117, "uuid": "9f68e453-ad8d-48ab-9798-ed58660139c1", "value": "T18CC533227F92C0FBDA4501348D402FF9A1F9D3D81B1446937344E75EAF78992E426EAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680905117, "uuid": "a3356655-2acd-4bf1-9e06-7f5bc7d5db23", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680905117, "uuid": "957d9a51-a2a9-4960-bd91-d7a3f53179f6", "value": "49152:xcBwPkZVi7iKiF8cUvFyPn+pmtDLgqVaNo1z8ESEwJ84vLRaBtIl9mTMCbsrHH:xSri7ixZUvFyP+EtPfVAo1QEJCvLUBsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680905117, "uuid": "eea15282-9d35-4399-85d2-7ccf463fc22f", "value": 2676643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680905117, "uuid": "1710bd8a-95e1-4b92-8760-6d3534d6d33e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680905117, "uuid": "365b96f2-270b-4ebd-9064-edd997d9f3e9", "value": "8F8B341230323B995C1CDE1D534031092BFDDB56411DA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a39125eb-d573-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680892816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680892816, "uuid": "992f0681-345f-4b5c-9482-031ae7b81e29", "comment": "Malware payload (Amadey)", "value": "559cf06ce5ce9ead8e24bb84b7eb21a6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680892816, "uuid": "823b707b-695a-45ba-b627-c1ab5fb712f2", "comment": "Malware payload (Amadey)", "value": "8fa30d9005a35179117c2e7dfe4613d0fa8ee9dbcd19bc1b5df42fdd28f7c1b5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680892816, "uuid": "f325c235-be4a-4b70-8d3b-bb23b245394e", "comment": "Malware payload (Amadey)", "value": "ba79d03204134f54fe5b2d4deba94241f6a8d20c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680892816, "uuid": "cb5e65c1-dc75-49b6-b026-c2d2a2f1f1c1", "comment": "Malware payload (Amadey)", "value": "7f8933378a0983527bfff435c91f9197c61b7717d78510ff6c49eb93bbd1d1f790946d9e60b453d5d918551396aec2c1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680892816, "uuid": "ca028669-953c-492f-80d5-154ff5a4ae22", "value": "T1BF14CE017AD6C0B2C8578574782DD2F4297FBC929B85C68733583F6F2D723819BAA316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680892816, "uuid": "9ed5e733-0bcf-49d6-9e26-aca2263aa1e4", "value": "25a1b270f58163554bc7d2d96c00089d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680892816, "uuid": "65997b39-78f9-40ae-b9e9-391a23ddbb2a", "value": "3072:mHbAvFWp4TtwF0FfZ/eBsaFXRliyBkIxbXt0vgPqOuoq5mlKYT:2AQ2TxGsaFXRliyBNd0KqOrlLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680892816, "uuid": "ad5585df-e023-4eab-ab57-3281fa28597d", "value": 195072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680892816, "uuid": "6c9b37bb-eac1-496d-8b4b-90f58177d052", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680892816, "uuid": "d1355f1d-e483-4483-bf93-2f2987865ffa", "value": "559cf06ce5ce9ead8e24bb84b7eb21a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e8f0ddb-d567-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680887465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887465, "uuid": "fd6350a6-7dd8-4c1a-a317-d28cfd3b381e", "comment": "Malware payload (Mirai)", "value": "025b2acff145bb78db6a023de2393eed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887465, "uuid": "04f15e10-5eb4-4977-b44c-172b6907a7d6", "comment": "Malware payload (Mirai)", "value": "8fa99f05df1e34a604e6ea1dede699330a3dd81d007369d87af2db81709d7aad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887465, "uuid": "c2f7de0d-9a8d-4930-a1ed-ddbfa338f6f2", "comment": "Malware payload (Mirai)", "value": "d9537fa0516c047c86600bd2b90d382ba4d50418", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887465, "uuid": "04aab4d5-1a7a-4e6e-8754-442a44ddd05a", "comment": "Malware payload (Mirai)", "value": "ae7a54cdbc674828b1695542294f00291690d0a7e8ba40856a18aa5f068e5feab7f244ef57775f33050e592a72ddae90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887465, "uuid": "8c65b142-6320-4319-a977-b61a15e405fa", "value": "T18193800AAF611FF7E89EDC374AD92B0524DD511A20AD7B39B930D818F25B30F19E3865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887465, "uuid": "1cef2d9b-c0e3-4d93-a489-90e3abd401c5", "value": "1536:NYCYxrXP40ODyPwHRQ9PlzTRfyToNoZqIi:qCYxrKDy46N1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680887465, "uuid": "ab47dc2c-138c-4cf2-bba0-89b2813351ec", "value": 92100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680887465, "uuid": "e10604c9-3792-4c42-82db-60f9725c5479", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887465, "uuid": "aae7e49c-13a9-4029-b44a-88f287b8b1ce", "value": "025b2acff145bb78db6a023de2393eed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "148b78ec-d567-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680887422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887422, "uuid": "db67f6cf-e615-4731-a5d3-656840aa25d8", "comment": "Malware payload (Gafgyt)", "value": "d587481d05074876529303d32018fea7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887422, "uuid": "0e0f4490-0609-421f-8858-db967fa2eee5", "comment": "Malware payload (Gafgyt)", "value": "90f45b56598f1a597e0a09fae715b4cd011660dc3e2c531d6c5c05977dc17ead", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887422, "uuid": "fee1a0bf-bbe6-46a2-b6fd-9be4cbbb3c86", "comment": "Malware payload (Gafgyt)", "value": "9ecdf7bad6052ee0e9eea4b04dec310bca2099dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887422, "uuid": "709ba209-ca6f-4d7a-ac37-42ccbf6ee682", "comment": "Malware payload (Gafgyt)", "value": "d847cba7449027f4e6d137f181948c1e9dc13955720dc0def7747e4a1f5bf62a4b51f92ed06f817d49a7d553cddbed82", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887422, "uuid": "97521dbf-e1ef-4948-84ae-be71cc1da2ef", "value": "T1A2041719B56AC1F7C9620FB10253B9ED0B6EBC355EBAED84F3187CB40AB14A57D1E204", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887422, "uuid": "32293c3a-7661-4f03-a9ab-ddd31beff2c1", "value": "3072:ehiDKwl4VnD1jhVbYIUNFlVdhQrD3JtmAeL4Z/yYSygPBsBsC:elwO0IUjndoHmAeL4Z/yYSygPBsBsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680887422, "uuid": "bc913e9f-8f6b-465c-8664-d83b4d1e7468", "value": 186264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680887422, "uuid": "6afa238c-faba-48e1-a1c4-62e52624eae4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887422, "uuid": "1b652b99-4c1d-400d-980a-85aee47cd304", "value": "d587481d05074876529303d32018fea7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21aded0a-d564-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680886155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680886155, "uuid": "ec18d8ce-2da8-464b-8859-93e6bf6bb801", "comment": "Malware payload", "value": "29e964f9e25c62e301d7facee9d16d4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680886155, "uuid": "10d02cc6-f260-4376-bad3-fda15ef46d0d", "comment": "Malware payload", "value": "917584fbedcb70af3a9612b80442e17657a604fc0515e14d8dc17d297c8c6902", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680886155, "uuid": "b27880b6-a62e-4e39-ba3c-62641b20f54a", "comment": "Malware payload", "value": "64c9e9db1363878291db4210506671bf5d2f6653", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680886155, "uuid": "6cb7c515-1d56-4a95-b787-03fa2fd98581", "comment": "Malware payload", "value": "c5340ca358dc5131abda6afa51c49443b4edda74c9e83e5a274cecf4b003a20a3b1b9c0a03759edba113e00c60435257", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680886155, "uuid": "30845173-c9c9-4687-b3fa-22110841914e", "value": "T10FE23A4EFD419F05D4E0627EFE6E124D33331B68E2EA7202AE149B252B89D5E0F76851", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680886155, "uuid": "181290ea-a48d-48f9-bb5f-765aee482c9b", "value": "768:W1nCQX1FCQtIcSZdtJdW8sCYVmQxie79IWLTdihy+VgkImseS:W1nlFCQO5Lc8sCcm8ie79IWPdih5Ts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680886155, "uuid": "966fa3a9-d67b-4ce2-ad42-6b0bd525235d", "value": 32384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680886155, "uuid": "e1736d14-3abf-4aae-9131-9600957ab060", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680886155, "uuid": "833d77c5-5f90-4abd-adab-125ab676a18c", "value": "condi.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47fb1b4c-d56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680890944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890944, "uuid": "087fa917-6ce3-482c-b91c-631871dc7347", "comment": "Malware payload (Mirai)", "value": "b1ecf02d8b02b79df0eba8bd7b559921", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890944, "uuid": "10a31a16-d62d-40c8-a607-fcc87f2eab62", "comment": "Malware payload (Mirai)", "value": "926e6615eeef169bb837a97e7cd13e88e162f2a55acaa2c7c7e1d99ed17e41b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890944, "uuid": "cc118691-3031-4403-95fa-a2ba5580bd3f", "comment": "Malware payload (Mirai)", "value": "3b9d81a677fd22d3eee8153445d2f099f78e888c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890944, "uuid": "7c84b25f-1d80-43d3-a40d-1a1c3acc036e", "comment": "Malware payload (Mirai)", "value": "1e08ffc38d048446097bbb387adccc1bf9ca393f710b849e6eb7d73d0d6d08fd88abb9f80691135adefbe5b97f5b3018", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890944, "uuid": "e09f094a-379b-4c05-b191-c642d6fbb018", "value": "T1F1733A45BD819A12CAC553BBFA2E01CD372653D8D2EF7203CD116F11B78A91F0EA7662", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890944, "uuid": "76e7e3a6-25d8-4021-a8b4-5aa67da7b464", "value": "1536:iF5BCWUo3CiQpOyuamjTDjDtznxTgZQD1L7K7RkNvmwbZnN:iFTCWUoZXTjpxTgZQD1s4mwbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680890944, "uuid": "6900fe0a-bbe8-4bff-8d66-55125bfe6d27", "value": 79712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680890944, "uuid": "cbe780a5-a3fe-4cec-bf93-4b7e8711e4e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890944, "uuid": "9243298e-3e52-40da-b016-32cdd8124513", "value": "b1ecf02d8b02b79df0eba8bd7b559921", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d09888d6-d569-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680888596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888596, "uuid": "3e2877ef-1195-4430-b5e1-94d1643e4bcf", "comment": "Malware payload (Mirai)", "value": "1fcb44b0c5ea801a816a42944170833f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888596, "uuid": "6db56966-7908-42db-a01d-782c68620072", "comment": "Malware payload (Mirai)", "value": "944e923428c85146eda3159b3e9cb9e9ea1a2837ff01c41350f1c9e1160e71e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888596, "uuid": "307ff51c-3164-4fb1-ad48-1bc283a8c819", "comment": "Malware payload (Mirai)", "value": "ca6dd8d99c9f429c13fd30630b58a697438132de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888596, "uuid": "3590e348-3bef-4a74-897b-1943ca7a668f", "comment": "Malware payload (Mirai)", "value": "7e638279d3b9f7fa8bb5476bd3551354115a0a3de61241b9e01a2e48ab7f0695de50602b3f578676643d71ff29ba00cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888596, "uuid": "6d45f8b8-cfd3-40f6-b670-9871db4669a5", "value": "T11B733943A58184FCC05ED1744B7B653AF46375BE1638F2EA63C8FF266C09E200E6E995", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888596, "uuid": "2afbb2a7-3988-4ab3-9f3d-7b929248551e", "value": "1536:IberHIpGnhQgfGB9P4TGbW4VzuED29v+PSBTwbZnh:qe7IpQ2RBbWWvD2YPSBTwbZnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680888596, "uuid": "9ab2a451-94eb-4ae6-8ad3-e9642b644cc4", "value": 76096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680888596, "uuid": "86288aa5-8502-4bbc-bd68-2068d5d90e3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888596, "uuid": "bafc1ed3-5e71-44d7-8510-2abfb597c9b8", "value": "skid.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef771aac-d546-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1680873616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680873616, "uuid": "60aad19a-031e-40d7-8f3d-910dd6011904", "comment": "Malware payload (TeamBot)", "value": "ae4a6a4c28659ee2e9b401c26035c123", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680873616, "uuid": "5e969426-d1e8-49e3-9092-cdf40ba7d493", "comment": "Malware payload (TeamBot)", "value": "9496a13453847f816afdb1e028c68fa6dcaba0fc3bfe925e6c68797d8779189c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680873616, "uuid": "c6ea7ffe-339e-4b48-9e71-11ef77c8977f", "comment": "Malware payload (TeamBot)", "value": "ce225faa16de7ffb221eaa9f1e120ff97d59c4b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680873616, "uuid": "8cc58bcb-6a4f-4312-8af0-f90e7b0913fb", "comment": "Malware payload (TeamBot)", "value": "76b8421d7b0ec6f6d32bc20c0135275422c44ddd255e460444477ef55b25efb884cbcaaccb9f32efaf64549956a152e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680873616, "uuid": "b79a4e59-e563-474b-8609-4a224e1fd6ee", "value": "T18B14CF217AA1F4B2C52B853429B1D6A0AB2FFD7157A182CB3F84177E0D316C19B3E356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680873616, "uuid": "81f1d6eb-edbf-4eb7-8ab4-93bf72169e69", "value": "15da9c7894302c146365c10904778942", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680873616, "uuid": "c90abf55-d1b0-42be-a509-bd066f07f91e", "value": "3072:d+8uEXWSWM2YMZ321roH+V63qwSw8Du9yu0WTaZcf5LRXL:QjSl2LgyVawSlunb5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680873616, "uuid": "86bc3752-3030-4c90-bdde-39c788f93a7f", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680873616, "uuid": "7769ed56-a8c5-4719-8f63-3a064ba8a603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680873616, "uuid": "a6f596f0-1c27-400e-8b60-760fe47d632f", "value": "ae4a6a4c28659ee2e9b401c26035c123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c5fca16-d57c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680896535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896535, "uuid": "6e0952c2-5556-49f2-bf5d-b0263326008f", "comment": "Malware payload", "value": "a3e1c17265994f8b1b6915e1df07b16b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896535, "uuid": "1ef3ffd3-126f-4312-83f5-6ccd36e176da", "comment": "Malware payload", "value": "94b34225c084dba7db19725bc2aad74bcf85b9d0990a2c31b665faa4f42ec39a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896535, "uuid": "3ec382e4-4a64-4654-b957-2edc22b44c02", "comment": "Malware payload", "value": "284793e01c409658aea009c74de3e379be8ced44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896535, "uuid": "327ac2b4-9f09-418a-9fa8-01746eb6c45c", "comment": "Malware payload", "value": "fb0715b1bb4fe808339f21961d2b567b8b8bdfd78b4db9c8584428d15d55b3fac68423336b3597ba5025e927523ce893", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896535, "uuid": "f716e7de-3440-4e75-9b9a-04e519e81116", "value": "T128A31A41ED418727C2D327BAE79F439D7B36566497D73301AA247EB42BC5BC82E3A120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896535, "uuid": "a76d05c1-881d-41e5-a96f-464424e53fcf", "value": "1536:/CirNJcuhcI28okpSzYW9a0BOjFvws+P4Ai95LUJxsN9GDbmCVrQAFW9LhZKQ:LJRcqiaHws+PtJxUkbmCVrQAFiLhZKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680896535, "uuid": "5f7701eb-1cb4-4d73-9fa7-e9e3461b4728", "value": 104533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680896535, "uuid": "a3087111-854e-4183-95c4-0c7885f32d8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896535, "uuid": "6892df21-e36c-4dbe-8ccf-bf4a8d90489d", "value": "a3e1c17265994f8b1b6915e1df07b16b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bf3425d-d4dc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680827788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680827788, "uuid": "fa582c7a-9c47-41e1-a314-32de1d021e03", "comment": "Malware payload (Amadey)", "value": "f1abc2710e8339818383da0339c45a94", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680827788, "uuid": "287b8da8-187d-432f-987e-ae386ed82695", "comment": "Malware payload (Amadey)", "value": "96dcd48025a774147c1445b357e4458d7f24a68f8e4d09a834633fdf5be2289d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680827788, "uuid": "9c8ab32b-5473-460a-b02d-8817d7a0a16c", "comment": "Malware payload (Amadey)", "value": "3be1798c81adf829e407190c31513c2a0d023be1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680827788, "uuid": "484ff787-96af-42ae-9cdd-ab195473c42e", "comment": "Malware payload (Amadey)", "value": "5d8ae334ffde4bd0b658e2c5434c141e223932d55651cdd6c5f83efbce1f8bd26183d075b6a08be1ad34dcea716791f4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680827788, "uuid": "a95aa381-dd2f-453e-9aef-1cf1e8c94012", "value": "T1C8152217A3DC8077E87627B088F207D70E3ABCA15C74978B26C65EAA18722D0E571777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680827788, "uuid": "ea826feb-f656-4d8c-b87e-60b4d5871d3d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680827788, "uuid": "089a9da9-1bdb-475e-9398-628d7e2f0725", "value": "24576:KyZEhLrjJ84Q2ie3DCtCCbJwrKuf00KdDDNP:RZcHjJzMem0CFw4BB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680827788, "uuid": "061d56b8-f94c-4142-8b9b-149701c1c6bd", "value": 891904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680827788, "uuid": "bfc0671e-fac7-406c-adac-d18ff2fb5eba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680827788, "uuid": "40931706-bab3-417b-b55a-98f1d4658a1e", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66497af6-d573-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680892713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680892713, "uuid": "f912c7ea-d989-401b-9bba-723bfdbe64b8", "comment": "Malware payload (Mirai)", "value": "3cb7ff85e64714043f14c0cc0c359b19", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680892713, "uuid": "a658e5c1-d83a-4a9e-bc21-5df079a72ace", "comment": "Malware payload (Mirai)", "value": "99af289aa283f6f7ad5ff17c5fa174b47c253807aa78a8c5738903445d286e45", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680892713, "uuid": "9f039da2-3213-47d7-95a5-12e6bdd74e95", "comment": "Malware payload (Mirai)", "value": "7e5cf7051a3235932b6e06493b884080da70b11d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680892713, "uuid": "fb6c1c4b-8da0-4dbd-9ec2-f89f7960d5c1", "comment": "Malware payload (Mirai)", "value": "2c5bf18fefb053b452682c171dbbb7bd458f24afe1a9117d7ba61395224beadee0c18f51045cce30e0473219bd55ad95", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680892713, "uuid": "4fdc736c-9107-4eaf-8461-7a6c533f4c80", "value": "T198632851BC819A23C6D1127BFA6E028D3B2613E8E3DF72179D225F2037C696B0D37A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680892713, "uuid": "bf71fa57-3278-4d65-843a-27423f298a57", "value": "1536:ONKlxkmiig51kRmO//kWUzr9iAsDwY8rNRuVAvvW9:ONDWzk139iAsDHaJvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680892713, "uuid": "d0deaf18-415e-437d-9b44-cb4a57645f78", "value": 66920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680892713, "uuid": "3521c602-c90a-439f-9970-fdd126fd904b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680892713, "uuid": "49765d55-a463-4aa4-9f33-eb24cc54082f", "value": "3cb7ff85e64714043f14c0cc0c359b19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec5fac0-d56d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680890069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890069, "uuid": "6d114e3a-6e51-4eda-8010-e618e6285dea", "comment": "Malware payload (Mirai)", "value": "495871f962562732599bed7cb05db158", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890069, "uuid": "92240336-e1d9-4158-9cc8-08112f77a5c2", "comment": "Malware payload (Mirai)", "value": "9a16f4f36746288b474aba50028ab35675a13ee08ccd06b62ecbd0e3984eeb6b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890069, "uuid": "37b848ca-dc34-4258-bf1d-cd21c7317d0e", "comment": "Malware payload (Mirai)", "value": "01c21782f5dc6b6295ad100be2615fee6f8b8ff5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890069, "uuid": "c6d5c9f9-7344-4946-81b1-95ef2bcaeddc", "comment": "Malware payload (Mirai)", "value": "c2dedbc02c814e602d3f45e2c89cadf531339b68e0fe8feaaf6ac0bf6b86e75680f12e3da23a71c0a774258bdb58d88b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890069, "uuid": "7bf8164b-c405-41d1-8a41-8d53bd16464e", "value": "T168F33B46EA818F13C0D61776BA9F424933239764D3EB73069D18BFB43F8669E0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890069, "uuid": "fed0f6fd-2d19-4e7f-9fed-616cbada71cd", "value": "3072:n9+zGkHs5tzMndaThoVXU4gk0mvKWHXwbZn5XGScBYM/9XcOS3:n49HStUdaThoVXUVk003wR5XGS0YM/9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680890069, "uuid": "1ec9f711-327c-429d-882d-862b7d5b8f88", "value": 165028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680890069, "uuid": "de0f44be-6ee0-4358-9d2a-5b90360afa29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890069, "uuid": "df7ca9fd-50a3-45f6-9583-a08b6f114dfb", "value": "495871f962562732599bed7cb05db158", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43793597-d56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680890936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890936, "uuid": "a5599b8d-6666-42fd-b8e1-b2ab0d03cff7", "comment": "Malware payload (Mirai)", "value": "beedaca4c21f7cc9e6d6c31f77386332", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890936, "uuid": "c7a1fa00-2bb6-4139-ab6f-ef348d63fc02", "comment": "Malware payload (Mirai)", "value": "9a1c07b391459065b0c0c90bb5dda34d1763e2201659df6bb1b23cc1a3c0ae1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890936, "uuid": "e6f4cfa7-71a7-46f9-8de3-d63b4a7520c6", "comment": "Malware payload (Mirai)", "value": "d293e47e8a9e3ae573342580cc244cdcf43ff3d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890936, "uuid": "804707f3-62c4-42a9-8757-954cb9fd4ddc", "comment": "Malware payload (Mirai)", "value": "8870d8607415802006b16d87d6bd4972af7363d9593b4d5ebc84c34277da4a9b71cf99dca469d5055c91b78c6e62fb51", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890936, "uuid": "59de2897-1538-4471-b724-ecfb4565d8d4", "value": "T178835B31BA352E27C0D4A57B22F74325B2F1538D24A8CA2E7D721E8EFF2464065572F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890936, "uuid": "3c4b0dd5-beac-4ce2-9510-20e5191dc18f", "value": "1536:KNuzrgwjqnpDHycpCyiOHZWhQMrzOc0wT5FBtSK9wbZn2wS:nr5YaO597wN7wbZn2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680890936, "uuid": "483b9fdf-a2a8-41c7-bc91-ead234d58f3f", "value": 80968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680890936, "uuid": "6185ee66-0977-4596-a974-2c71ee72f4d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890936, "uuid": "af4ac642-0ecb-4330-90ac-edd910cab289", "value": "beedaca4c21f7cc9e6d6c31f77386332", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12986eef-d59a-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1680909323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680909323, "uuid": "66b212ef-abcb-43b8-857d-b1a552fcc65e", "comment": "Malware payload (njrat)", "value": "aa9008b0ed8b546cda8832b3336686f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680909323, "uuid": "a4937891-049d-4201-84a4-0a74d7f8120b", "comment": "Malware payload (njrat)", "value": "9a46a795da4fd2fd7208928a0cdb9e9d82f080e8ca4712e3b79bd5e1aaab41e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680909323, "uuid": "692f576f-f94d-4cfe-adce-55acad0c960a", "comment": "Malware payload (njrat)", "value": "0dc76700a621c7db110011bf44b1a0d4ecafe2b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680909323, "uuid": "6df224ce-53aa-4f30-b7ce-a9cbb1ed5070", "comment": "Malware payload (njrat)", "value": "1e3073f955ed5f27d12224ead1b10b9804814f139177ec398fc55754081e3795db0cc4cca4eeeaa605ec9b1a626d939d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680909323, "uuid": "20afd1ba-085d-403a-9bd8-11a914b3dfd8", "value": "T1C0A21A4E3FBC8866C5BD177489B596204370A1870423EF2A8CC564DBAF73AD52D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680909323, "uuid": "437777c9-3040-4dc0-812c-b5ddf47afde5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680909323, "uuid": "7d15c582-a513-403d-a1d6-57f17fd800a4", "value": "384:0XMKyO5BkRahobh31yuKeMntw6lgV4AiQ5pzlmRvR6JZlbw8hqIusZzZjy:0saYaCb1KAiVRpcnux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680909323, "uuid": "b74584b9-276c-4d7b-a0f3-31cf6f0d2b19", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680909323, "uuid": "85afa6f7-6bd3-40a7-b810-0b4de48397c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680909323, "uuid": "aa9fcf4f-c20e-4679-8d19-731099084082", "value": "aa9008b0ed8b546cda8832b3336686f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "422da41c-d56d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680890075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890075, "uuid": "c51557a4-ce5c-4384-88a0-b3434756477e", "comment": "Malware payload (Mirai)", "value": "b9e7fee860dfc18237e350d4b82451ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890075, "uuid": "3e84042b-8ee1-485a-b9e0-e03eb324a008", "comment": "Malware payload (Mirai)", "value": "9b887fab02d739a93c6566b985a02b294e4a358071e9b0298521e403dfcf6990", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890075, "uuid": "2b4e91c2-85ee-41e2-948d-e9a43876e391", "comment": "Malware payload (Mirai)", "value": "87cb4305699009b2f7c2b6a3fbac88f10d072924", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890075, "uuid": "d4067ebb-bde0-44c0-9b9d-dde7798da629", "comment": "Malware payload (Mirai)", "value": "c5e382bb925ee8a6fa3e8dbd242aeec866b3597732d5d5ca37883e01c6d3b87c883b1b482ace2aa05b03b7931e4850e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890075, "uuid": "bd63a99f-0aa6-4905-85c4-d17d9b49e1aa", "value": "T1CA03F751BC829A77C2E1137AB6AE4A8D336163E8C2CF7217DD214B607AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890075, "uuid": "2c351c80-693d-4941-89b0-247b0cef5cae", "value": "768:AgA/wMCbXsG5f0OJnlUlcOlF5AdwAAb9XDWd2v+bAq77TEXoTO/NMwWK:AfWb8G5fblUlfbgeaUv+fExHWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680890075, "uuid": "b93bbd72-0949-46a7-932a-5b3481aff175", "value": 40752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680890075, "uuid": "11773771-498b-44d3-8227-6ee4f53d0364", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890075, "uuid": "0ea7410f-bebc-4194-aac7-69be4f93c8eb", "value": "b9e7fee860dfc18237e350d4b82451ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ca4a8fc-d56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680890979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890979, "uuid": "863ebb1a-2bdb-4c91-bf2f-17e470e5beaa", "comment": "Malware payload (Mirai)", "value": "d9bf4607836144c92136ca5c00bc995d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890979, "uuid": "e8a3188d-f327-449b-898d-489e4f1302bd", "comment": "Malware payload (Mirai)", "value": "9bcf95b9cd0853368497dab2b1438979a6a8797241af078aa45186e0f75ecb96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890979, "uuid": "751f0ce1-b0ac-47b5-82dd-86d48c58a59f", "comment": "Malware payload (Mirai)", "value": "db93b7cd01fafa46d0d56f6dcb6f0ac280e6c412", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890979, "uuid": "aca6d0c2-1890-49f3-9014-b354f921c171", "comment": "Malware payload (Mirai)", "value": "09acb51ea124ff17172562bc78df6dc98a02e90fb684a1051a972360eb0217d468f4cf8e27b16fb02f145c5ea08b16ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890979, "uuid": "01651c96-ab9e-4c79-b867-ac8eb588718a", "value": "T11B438D33DA0A2D14C14A863030788E757B53E1C842E67EBA59E5C2BAD443A9DF949FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890979, "uuid": "a7138b83-c7f3-4b09-b30c-cf8529d08990", "value": "1536:MjatoKHoQ9h3xgFYAkBwGLKNT5KBz747vsIlsCk/wbZnNw:8moKIQ9UFYrXuNcz74Psx/wbZnNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680890979, "uuid": "628f32ac-0310-4551-bb3f-78ff3c376287", "value": 60324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680890979, "uuid": "1bb79bd2-128a-4e2b-83d5-86c2e5b3bf9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890979, "uuid": "b07e21b2-5c22-473e-92e4-213ac9187420", "value": "d9bf4607836144c92136ca5c00bc995d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa04376-d56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680891002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680891002, "uuid": "9e16d3c0-b985-45cb-8b30-20366fe1dbb5", "comment": "Malware payload (Mirai)", "value": "e143d531e60a606aae9bd8520ec7de9d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680891002, "uuid": "5f2129e0-f82a-4207-af58-8b84dbe06958", "comment": "Malware payload (Mirai)", "value": "9ed3dbae23a109b73ff8e09e891941bc207dac4ded7b8630a9178c245195f5b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680891002, "uuid": "d0db46b5-9ad4-4d4c-b9b7-6d9fbc27d93f", "comment": "Malware payload (Mirai)", "value": "10b9d755b3bf1ec7514a5653cec8b6844f2fc808", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680891002, "uuid": "5c73df63-d7d8-4222-bbfb-ac9841e3064b", "comment": "Malware payload (Mirai)", "value": "7837ca76027576a0ccb5626506347c863a759baad2987502fe3701c8344bcb8aa966aaf149e49c25f915f0d4f4c4ca74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680891002, "uuid": "9febd5ae-898e-4e2f-b4d8-552a027554f6", "value": "T1DA83D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680891002, "uuid": "46709eab-5e2d-44e7-bc06-82be34b9b286", "value": "1536:iVLyu95Kf6kj752dCexuV/8UZlDwfkJ4MYfWV:iVLyMg7Fezxu5VD1eM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680891002, "uuid": "9aa1bb8f-f4f3-4a76-8c29-4d5ff76ec6e7", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680891002, "uuid": "09eee97f-8719-4f6e-bd22-54c73a1b8a22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680891002, "uuid": "79f48985-eae2-4c81-9e45-a4b5c7788fde", "value": "e143d531e60a606aae9bd8520ec7de9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45a4b5c-d581-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680898830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898830, "uuid": "2a12ac65-921f-42eb-95a6-3769ce07959a", "comment": "Malware payload (Mirai)", "value": "3192cc59547ccb5d099b0075e46ce9d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898830, "uuid": "676b46a9-0320-4af8-8826-4cf1faff86cb", "comment": "Malware payload (Mirai)", "value": "9f6f3f82b30dd32aa3364a4e53aecf28bc71e77ee1f55706187f71e9ac250949", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898830, "uuid": "7a1b77e9-863c-4b42-ba1d-a226380c0529", "comment": "Malware payload (Mirai)", "value": "9dae902e3a34dda2adce42fd345f8d9c44981596", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898830, "uuid": "aa040239-aa41-470a-9d6a-050d22a1a435", "comment": "Malware payload (Mirai)", "value": "2206505c10e829a55df2a0cbea1335e6b1d61e164f9b31ce229fe8f96c07dae83d6c474e1ace70d988a02947b2f24111", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680898830, "uuid": "28ac86de-7340-4373-b41d-141f82de491d", "value": "T1AC93B419BB611FF7D89FCD3746AC0B02388C958622A83BB67574D428F64B24F55E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680898830, "uuid": "4a6f6574-d3d7-4ef5-9048-f5f65809923a", "value": "1536:NUYh3Z42HG6+QdfqWnywY/hn5ZHpFBw3wJfwbZnL:NUYh3a2IzwY/55eIfwbZnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680898830, "uuid": "b99c1315-7dbc-47d0-9b21-5f137543f936", "value": 88844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680898830, "uuid": "426be03f-7cf9-42f0-847b-1a3ebf3caff3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680898830, "uuid": "bfd6a246-6173-482d-8733-fb818b62f1e3", "value": "3192cc59547ccb5d099b0075e46ce9d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be01f8aa-d581-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680898873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898873, "uuid": "53d20c02-d576-4be3-b6a7-03077605329c", "comment": "Malware payload (Mirai)", "value": "d93cd0c09912e94b88e9dcfeaa8042ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898873, "uuid": "cae0e29c-4934-4232-9d0c-a7740f63179d", "comment": "Malware payload (Mirai)", "value": "9fbde9ce796401e012c3fa77d3b4fe06ac7d0840111e1dbe48d5c4ecc84bdf7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898873, "uuid": "6427c6b9-8388-437f-b05c-c90070b0cec4", "comment": "Malware payload (Mirai)", "value": "47c1c8949daaee71e24110a71eaffc64a63e9fdd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898873, "uuid": "f2bcf779-1fb7-4668-a047-31915898f8df", "comment": "Malware payload (Mirai)", "value": "6478ba7bd5779c5724abcde2cb59beb1a1f1e5d77a948af4336645e547b2211ca5e779027cde662b8e9641c52593399e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680898873, "uuid": "c2322d3f-3250-46da-a9c6-52dab65383e6", "value": "T1FE635A32BA721E27C0D5503A21F74B15B6F153CE25A8C62E7DB21E8EFF24A406547AF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680898873, "uuid": "d4395811-9605-4d5c-8cbb-07a5fba46165", "value": "1536:Gaz5Bxzwnq3wuHFEwDe9fG575jItj8wbZn2H:FGNyyu5Vm8wbZn2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680898873, "uuid": "270218ef-3d96-4f1d-95d4-6db1ee79560e", "value": 70480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680898873, "uuid": "d5756558-3b4b-41bb-bccb-9c8b6db195a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680898873, "uuid": "82ab0d3b-68ae-4682-99bf-b0ff737d21fa", "value": "d93cd0c09912e94b88e9dcfeaa8042ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69438de8-d568-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680887993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887993, "uuid": "277d3b02-8e5a-4d97-83a1-da6628563b70", "comment": "Malware payload (Mirai)", "value": "ba79a70b60cc530afbe003939f23e05c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887993, "uuid": "21dc194b-4273-43ff-9c74-152e087641ca", "comment": "Malware payload (Mirai)", "value": "a0bcef95ae68cf55f6f3876cfab6e5962e93e1b7de1c695e718306acd59f87ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887993, "uuid": "6ec0253d-bb48-482f-96a0-31207eb4dcbe", "comment": "Malware payload (Mirai)", "value": "aacd6f862406353132c0262eda538c2dc5d88ef2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887993, "uuid": "261a307a-5eb1-4674-a04d-7d910d52f533", "comment": "Malware payload (Mirai)", "value": "a8ea6327cf0404b36ca7f8faeda058d71803a79e0f9d1ff33c4c0d51430c60396b46adf1a18853d5b2c4fdbc96f3afae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887993, "uuid": "a7e0b03a-2bc6-4bdc-8fcf-e9fce56df27c", "value": "T19B436CC4E743DCB2D8171631107BAF37BA72E6E81224E746E7A8A636EC51702D017E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887993, "uuid": "0c5676c7-b7b3-4a4c-ba48-1f63c79cf1af", "value": "1536:7sV4STUx6ghctVlOOPvUUw+NF4ygl8s0ih1Fr12BwbZnG:7Q4STUx98VldvUF+NFD48sFrnowbZnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680887993, "uuid": "d2ebf93b-9576-45ce-9ce7-9b0864ffd28d", "value": 59056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680887993, "uuid": "37ff4f28-e40f-4eab-9ce8-d4e1e6f8ae48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887993, "uuid": "344b69f3-4b65-4677-9d70-6c1e12586a2c", "value": "skid.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "003fd691-d567-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680887388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887388, "uuid": "b5b1d429-875f-4241-a61f-1373bae79e17", "comment": "Malware payload", "value": "815adb3b765851a3bf8353690ec0a2b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887388, "uuid": "c1c9736b-c0b9-42bc-a08d-da43f66685aa", "comment": "Malware payload", "value": "a0e2d7d15925f03267d724572876e51204cb28b9be118ac2b9fa9cdbcdca7c22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887388, "uuid": "332c4dbd-384f-444f-8bb6-b286f742af4e", "comment": "Malware payload", "value": "dfdcbfc4e15d7293088c8fdb38258c8a1b61ac50", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887388, "uuid": "2f8b788f-7363-42fb-ae17-37282a497d16", "comment": "Malware payload", "value": "667d3f64c780acc3af7e678b94feaf6e056b1d23bda39b9e2fd79b19541b4a76504154e79e5d8c1e16fb3824660cc3bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887388, "uuid": "1433504c-94d8-4f5d-93e7-5cee9180517f", "value": "T1C754600A6761CEB7D89FCE7B02DA812110CDA84A119DBB2B73B0E61DE75E58F80C7D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887388, "uuid": "990d502d-dc0f-4599-a594-b5cd1d627fff", "value": "6144:1np3YoaCBPsXDd0QublomT+rL6uYcGOkq8WEDv:X3YwcWJomT+rL6uYcGOkq8WEDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680887388, "uuid": "6671f7e2-8a6e-4c40-8a91-484206342110", "value": 288406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680887388, "uuid": "f947475d-a76a-4843-9dd1-f780e57453bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887388, "uuid": "2168087a-fe2b-4fde-9095-a5e8c6eee62b", "value": "815adb3b765851a3bf8353690ec0a2b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f966ec-d50d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680849014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680849014, "uuid": "743abb1b-6093-4c37-881f-d910d89d33ed", "comment": "Malware payload (AgentTesla)", "value": "1df5ecb9e9b7a2d7fb7b1fd2b4771162", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680849014, "uuid": "983c063c-34b4-40bb-b9ce-c414d50c21dc", "comment": "Malware payload (AgentTesla)", "value": "a49ecccd91988526d45088a50cb554ad8733ce0cea724da92f9a5f9366629945", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680849014, "uuid": "236fa384-872f-41e4-a49c-2e5303544446", "comment": "Malware payload (AgentTesla)", "value": "a41f81ae61d54d1bae3193c4ffe1e1201d9f467c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680849014, "uuid": "3008037d-0f10-4808-929c-7090b0183605", "comment": "Malware payload (AgentTesla)", "value": "13c81eef37efc5828df4d0b8425eb2dbb2d82f848b3a88c7d205941d723820afeb4a38022868148c9b756b5837b65b48", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680849014, "uuid": "e9b0f868-f2fe-4e50-b173-91209462a89f", "value": "T139E49DCA333070AEF85EA86E85192FD8DE3470571207E11357273694568F6FBBB1A1E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680849014, "uuid": "6121b9a4-53d0-490f-b64b-fcdc7786a638", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680849014, "uuid": "84ecb022-dbc0-46ac-8558-efef3d649cdb", "value": "12288:JMws/4Wj7tuE+HnL53VQAgCzGLZ1SPibT+rKCVqMmyyAQpPV1GW:4/4Ctt+HnL53GAzi0iPYVYFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680849014, "uuid": "781eb74a-0036-487c-9c26-1be87951758b", "value": 695808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680849014, "uuid": "331def47-75e7-401c-9b0e-c24a88880900", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680849014, "uuid": "0d0c9845-021a-493b-b1ca-7dc8e8d8b407", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b391e3a3-d581-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680898855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898855, "uuid": "e31f30d2-3b82-4ed6-9cbd-1c03e9197c41", "comment": "Malware payload (Mirai)", "value": "56ee2be925a502afaacc5af919283fcb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898855, "uuid": "fd00734f-ed17-44b2-b4a8-c7f3da654aa7", "comment": "Malware payload (Mirai)", "value": "a561c3336d2551be5157d5163c071c4b83a606ac6ac6da87bda8dbfab9fbe45a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898855, "uuid": "d284417e-527d-444f-9169-35bbf81eed7d", "comment": "Malware payload (Mirai)", "value": "dde6f2c4f550cea10c3fbc3172d611f18098561a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898855, "uuid": "dacf71b3-3f2d-4835-98d3-cbe1f80eb2f7", "comment": "Malware payload (Mirai)", "value": "599d8332b1c2ce6ed223b0849c4fec8cec025dbed364e46c0c2860500df39d9d65d6870731051b0c6a2f75800bf264bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680898855, "uuid": "a9ab5be1-89f8-41a7-966d-8bef775c1e3d", "value": "T140634A96F801ED7EFC0BD37B44470909B570E3E556A20B3763A7BDA3EC721A56816E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680898855, "uuid": "291b3524-8d21-493f-b7df-0b5617854074", "value": "1536:eT4OoNlZdls90L5J8Te03+ecDx4BTzbotduQgeTBnb4y:eT4OoNlZHi0L5rGcDGxzQgeTBnb4y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680898855, "uuid": "4049d15b-1bc2-4e01-bc15-f112e014fb06", "value": 71784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680898855, "uuid": "c12df850-15a8-4a25-a309-4c77be3c0843", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680898855, "uuid": "88946a5f-ae51-4b77-96dc-34f2d57d6e90", "value": "56ee2be925a502afaacc5af919283fcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d3511ae-d57c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680896509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896509, "uuid": "c50ff639-43a0-4092-9dda-1476a7b65e82", "comment": "Malware payload (Gafgyt)", "value": "c2621272e73786846e928fc29ba6f6f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896509, "uuid": "d04f2bb9-1b1f-41cf-949b-7d73d0dda464", "comment": "Malware payload (Gafgyt)", "value": "a967ff434df995c8a822168a23bd8a27c829d4f41c7352c66cd8e6facbd3ef68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896509, "uuid": "18f9beb4-491b-4c7d-9843-072ae0e61a10", "comment": "Malware payload (Gafgyt)", "value": "19cc3959e8ff36ec14521857698fc002bc6dca31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896509, "uuid": "675c8f49-a675-4baa-8483-6bd504cad1dd", "comment": "Malware payload (Gafgyt)", "value": "b87c7ce61d4c1c220ad4e63d7919ba5b141653b3d11e3fa92cdeb6c7298ab05a88a8f240ead4be83eebc97803c1437b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896509, "uuid": "83689535-5093-48a6-ac19-7fd042703002", "value": "T1A0F33A05E6408B57C1E2277AE7DB424933339B64A3DB33059938ABF43FC2B995E32516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896509, "uuid": "a85fd9ad-37ec-4be3-9e42-4cf1d24f5dff", "value": "3072:CuyamcedZX4hn6y1Kxf5nq3jM/9lFLMTmPwfvRQlfN:nyamcedN4P1Kd5nqzM/9lhSmPwfvalfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680896509, "uuid": "bcd3fce0-e9a6-4121-b1f9-2859e0ce8ec1", "value": 157540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680896509, "uuid": "247f12dc-d0a7-42ee-b8af-d433ab47d4d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896509, "uuid": "832609c4-1d89-452f-abba-169f64e9c5fb", "value": "c2621272e73786846e928fc29ba6f6f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e66e2b1-d56b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680889290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680889290, "uuid": "95c2ef6e-cd03-4437-99f9-44cb0b5f119f", "comment": "Malware payload (Rhadamanthys)", "value": "82dd0a918b03c13efce859c2d1962e78", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-POI345KOI678REPACK", "colour": "#D98090", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680889290, "uuid": "d97a5be8-6c7c-458c-bd78-607beca20244", "comment": "Malware payload (Rhadamanthys)", "value": "acce22b55567b5e15735d4274a8650043afccac5cb46ecad5b8f8ad3db1404ee", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-POI345KOI678REPACK", "colour": "#D98090", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680889290, "uuid": "8978d052-8843-4217-97f6-f7c6406ad4b7", "comment": "Malware payload (Rhadamanthys)", "value": "b33014032ef20c8d968b85c8575e33c6865d1bdb", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-POI345KOI678REPACK", "colour": "#D98090", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680889290, "uuid": "cb197a26-1597-4b9b-8fa6-5a74c59418fd", "comment": "Malware payload (Rhadamanthys)", "value": "4e37062226653e03b03ad95929f39884e2363b33f5b1395ddd1b8acae9f921670f13272651b375681a5df327a8bbc48d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-POI345KOI678REPACK", "colour": "#D98090", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680889290, "uuid": "a972d629-df13-4bda-9419-c69688c649a5", "value": "T1592733CDB3F6AE262940B33EA7583C4D653D0583CA6E9A1C98848155C97F68F9CCD83D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680889290, "uuid": "8c37bdbc-4a0c-4cd2-ab93-31fd4f69adc4", "value": "393216:eW69fXAi3qFG7xYRDWg+8HTDHjZRUGyaR/EhkB6MJBXoqHVn9Zc0GbD5QTr77XB6:zIXb3qFG7Wj+yj7zyOEhBgD1n9tJTrfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680889290, "uuid": "6f501192-55cd-4f55-94de-06a2eae20d97", "value": 21923580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680889290, "uuid": "1c40a1de-cb2c-4844-8193-c18351ce0939", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680889290, "uuid": "e50cc33f-d503-4d1c-88f4-169cf526924e", "value": "OnlineSetup By HxD.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea90d25-d559-11ed-88f6-42010a9c006e", "comment": "Malware payload (RustyStealer)", "timestamp": 1680881560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680881560, "uuid": "2c0ffe67-99f9-479c-9ce8-f07b62dfee5e", "comment": "Malware payload (RustyStealer)", "value": "f1efcbad09a17defc84facf7a345e1fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680881560, "uuid": "9030c65d-205d-40ca-9ba5-4e9db34f8a63", "comment": "Malware payload (RustyStealer)", "value": "added0ebd714ae007c3303cefaf7ca666421e158bb398e9c6b1b904405dc12a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680881560, "uuid": "82fcdeb7-9d5e-4cde-9440-2274bcf90f18", "comment": "Malware payload (RustyStealer)", "value": "944de58dd737f40627a4f3c7cd41b8885ccaa235", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680881560, "uuid": "9ae71240-54d6-409e-ad39-6837517297c2", "comment": "Malware payload (RustyStealer)", "value": "be6a406c688f7a64810475dface763207be0773e05a8c36641a9cd8b9744f98d8d516e1fdcc0decf1517a29c46892bf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680881560, "uuid": "bea2fef8-22af-4b3c-9835-90a3583f9c48", "value": "T128E47D267E4864ADE755C47442A2C2F366717CB50B21AAEB11D4BE3B7F396F02E3C244", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680881560, "uuid": "348b1f03-aef7-4d29-80e3-16f09d91ec23", "value": "6b2ff4dad6d75fecba4fb307daaaf355", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680881560, "uuid": "17cf84d7-b27e-453b-9fda-a97452f27ab1", "value": "6144:5Orv+iIn7FBQFBCPgW7YgvjpQx3ICCiolzkKhOx08vF2EFCTwRTg/bl36VCiVW2i:5eG7ZYRgvK9IGomhhbY+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680881560, "uuid": "b38c9f0e-6a7d-47c3-82f2-bef4c0f4e6f0", "value": 671104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680881560, "uuid": "23490714-ab33-4fc3-bcf1-912545a80f48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680881560, "uuid": "56e2ea45-2bc1-498e-abaa-e10e28a30347", "value": "added0ebd714ae007c3303cefaf7ca666421e158bb398e9c6b1b904405dc12a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "670268fb-d56f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680890996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890996, "uuid": "ab6a0fe1-6873-4239-8e57-437e8900349d", "comment": "Malware payload", "value": "adc032737954a3ad667146faa11a27b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890996, "uuid": "7ff90214-cba1-4238-9530-8f4b4699cd4a", "comment": "Malware payload", "value": "ae4bd1794c1856f1aadb11dda88bd6d72424dd3f7c679a7e6078df7f6a0d37c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890996, "uuid": "3f59da14-4dbd-459f-a8f3-52a563bc8c4f", "comment": "Malware payload", "value": "5c3fa16ea45e29a4965b155c0550ab4889c9062a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890996, "uuid": "5732110a-24c0-412a-bfe6-9c5828208c0d", "comment": "Malware payload", "value": "5d981bde4a2fec16f267cdb6784102e20dec85ae451f9d7a9bd6e64c60967c4bae9694ea330382a9d0b1fa7c83fae0f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890996, "uuid": "d54836cc-681e-4ac7-8742-eee933fd83d9", "value": "T1DE54846A3E11AF7EE4E9877447F34AB08389749126A2EB55E36CEB185F302CD144F790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890996, "uuid": "797d0f90-6a57-4012-ba3f-5fd8b967043e", "value": "6144:+tYan5XIwfFNdbZhr1mT+rL6uYcGOkq8WEDv:QnVvzr1mT+rL6uYcGOkq8WEDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680890996, "uuid": "a9a3652f-4c74-4e25-bf4d-e5463b74fcb6", "value": 288345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680890996, "uuid": "023e5c7a-cf6d-4d95-a5ab-e619df8e1a07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890996, "uuid": "c93f136b-6964-4a1a-bfc0-7e4a3de5b939", "value": "adc032737954a3ad667146faa11a27b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d82376a-d542-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680871653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680871653, "uuid": "490e8582-9c24-49d5-811e-95da2a6fcfc5", "comment": "Malware payload (AgentTesla)", "value": "2ee09f0b0b1097a9df837183bc06ef38", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680871653, "uuid": "4f1bd88a-a016-495d-b990-d654cba751c7", "comment": "Malware payload (AgentTesla)", "value": "ae64fb90225d89fc47da4f9759073771ec29788c66d87982c6dac4443d68a21f", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680871653, "uuid": "cbf10a2d-9ee6-4dbb-b07a-0b8f204a5fb9", "comment": "Malware payload (AgentTesla)", "value": "ca5e665707a2c84fe598b9b1afacac091474df95", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680871653, "uuid": "a268eaef-0952-4d01-84da-3868ff2ce4a5", "comment": "Malware payload (AgentTesla)", "value": "0c5850edcda9d2460ef833fc5c592334ccc0055d2beec64f4173eb989af6cfe86e0c8fb992a8471f7d5370da9c14c709", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680871653, "uuid": "f0ade742-157e-4654-9dde-bb8b435861da", "value": "T1A7F47DD42AD68BC0D037B130F059CBF2C3D6152AE099DBE1389B5989E1D2E451CFA9F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680871653, "uuid": "2be575f9-d4ef-4c12-a0e4-f743e839aa24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680871653, "uuid": "7703bf74-a7d0-4fb3-a009-7f8b0ea457df", "value": "12288:H2iNeqFROJt03tpEzYZXq/5uEN1GJ5q98g5ECZfQMOZyVgh2eV:H1jROC/qKJc5EClQMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680871653, "uuid": "8aff275c-ba78-429b-b12d-5b1c46e1aca4", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680871653, "uuid": "19be77c9-2aa5-4663-b131-4083cf4e045a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680871653, "uuid": "de371271-84f0-4fab-983a-f660fd0f91e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3be123-d56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680890949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890949, "uuid": "c2295f2d-2859-459e-ad65-fc144fb09865", "comment": "Malware payload (Mirai)", "value": "a4d35d1da45d381a088777376afc3279", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890949, "uuid": "120a4d68-b4f8-4d14-890c-08e452864b66", "comment": "Malware payload (Mirai)", "value": "ae8bffb7742c575cf29481e84dbf8cba81212572ad68102892f147f41e759089", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890949, "uuid": "ad033b4e-0331-4ae3-bbfd-b71fce9e716f", "comment": "Malware payload (Mirai)", "value": "d8dda03cfea5881a4ea2c76ed87ec6c9483d30ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890949, "uuid": "663de44c-8de6-4416-b34c-79b0fd4e5515", "comment": "Malware payload (Mirai)", "value": "d358f38fb13be370e0be15f294f8282d8c85b27d928debdfb74088a38b5f5c533774f23f163289f7e7b47720886a1e90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890949, "uuid": "d165089a-1307-4ff4-8c2c-b60c853fc9aa", "value": "T1EE83B40A7E218FADF79D823547F74E21B75823C527E1D285E1ACE9015EA024E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890949, "uuid": "a265780a-bf40-4297-826f-9afe8d7cae53", "value": "1536:/hX8g7Kjc2OGary0NMlONZO/78benUHcwbZnrQr:/hX8k4c2OGahNMlONZO/78PHcwbZnr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680890949, "uuid": "fdb8d9f5-4688-4cf2-be9f-396ad39db411", "value": 85676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680890949, "uuid": "74febb14-6fc1-4e6d-84b0-90b7932d9bbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890949, "uuid": "27cd88c4-5c09-47b0-ab80-616061ef67d0", "value": "a4d35d1da45d381a088777376afc3279", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39915e27-d56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680890920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890920, "uuid": "5c42932c-4eef-471c-8783-f8b90fec6530", "comment": "Malware payload (Mirai)", "value": "65ab4737781011fc97f16c7c88760418", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890920, "uuid": "63026d27-7eff-4a26-bd98-c3ee701fe9b5", "comment": "Malware payload (Mirai)", "value": "b3fb2e3d5b391151af18917a8848d07a82f2d52dfa3bfb819436c398ffb7bf06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890920, "uuid": "61743046-1bf5-45bd-bc76-782c405d4cbc", "comment": "Malware payload (Mirai)", "value": "980dc53e18d35636b7f8b31be60634339ea7454b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890920, "uuid": "076bde73-1ed0-45f8-a14d-137a6b47570c", "comment": "Malware payload (Mirai)", "value": "57446294b2d6b4dbb1f876533303d8ff4b86262cbd1127b5e69f82291cc11bfb494aba4c3d687f5089bad5b759bc11fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890920, "uuid": "5bb79e5c-1031-4318-bf12-6b6c48bae91b", "value": "T17483095AF9814F12C5C612BAFA1E018D371357F8E3DFB2239D106F20B7CA92B0E66955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890920, "uuid": "a6b539f0-e4d9-4845-8c31-3f9233b3fb9f", "value": "1536:7Fn+MUXoKg9Niy2I2SJ9C7h0KWXKGmaP1S04I9ie2ecWKzH9u7d5TYoswbZnJZ:JU4Kf4D2+KK1maP2e3KzH9u7dNBswbZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680890920, "uuid": "e2a69789-ac32-4880-b61c-00918d772f9a", "value": 83256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680890920, "uuid": "f5c4689d-c5df-46e5-abe2-52fc1f9bcd18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890920, "uuid": "96ed173c-19ec-42e2-b8e7-3ab82e80014c", "value": "65ab4737781011fc97f16c7c88760418", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce24fc1c-d4eb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680834475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680834475, "uuid": "92a44c31-ea33-415d-9962-7c9cb73e688b", "comment": "Malware payload", "value": "6adc822b09a994dcfa3d6ed3cd45c5e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680834475, "uuid": "a2cb83a0-db9e-4455-b356-31ad1c9cf358", "comment": "Malware payload", "value": "b4fe1256955d9f131e8d885da7637bf7bbc5690cb3c7ba4f5de6505dec25f2b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680834475, "uuid": "6923929b-1135-422d-89a0-5674275beba6", "comment": "Malware payload", "value": "fb036bc91396764a91c273d051d2d91bf2d1f3a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680834475, "uuid": "11089778-aa7a-407f-b1cd-318062891430", "comment": "Malware payload", "value": "0fc71526b881e14fe7e1820597253c72055dbf7587ce688bba4d1d58177bdf4b8addd5e942a0b87ea6b7c3b91682a2b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680834475, "uuid": "ee69dbf6-53e3-4e6a-9a0e-5c77e24a1b51", "value": "T1E9A3124AFF358D0ADB1008B727DA9E8EDC6D7B6B46CBB4B86DC2948F57900C97853205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680834475, "uuid": "a1f1532e-83ee-4267-b680-66ce5ccb4627", "value": "1536:pxpJNlEYvXndUt/afLuZmVelu9eoCtcCCzNbC4RWC0CQFW3RLlNCzgb0OmfP4:phNlHuBafLeBtfCzpta8xlBIO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680834475, "uuid": "301c7a34-fdc4-4172-b7bc-656235b2c7c6", "value": 100800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680834475, "uuid": "e3e6b1f6-97b1-40bf-92e0-ac45bbacf64d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680834475, "uuid": "56e39656-1e97-4138-8c32-0c68abab858f", "value": "SecuriteInfo.com.Heur.20230407022726686571533", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f41847-d56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680890961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890961, "uuid": "499176f5-0999-4987-b0ab-c3b9102437cb", "comment": "Malware payload (Mirai)", "value": "998e7df31e33113f476b1f2ac6c50163", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890961, "uuid": "9f0b533f-72ee-4162-8a52-d784ee7a859f", "comment": "Malware payload (Mirai)", "value": "b5a3199862ff0ee312d693a395ee0ebfa9f74eac567d2ff0314530d763b84d26", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890961, "uuid": "9f6983e3-c525-4232-9862-19afd4c848c0", "comment": "Malware payload (Mirai)", "value": "ffd4cc1dac91a22dafe24b3c9811ce0291cdd303", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890961, "uuid": "e8f15291-b3cf-4b04-9424-b6ee8b73676f", "comment": "Malware payload (Mirai)", "value": "85015e5086dfc1b4588cba54d088ac760cb0fef21499c70198cc2a242cdbda36866d168b081e3955867d8bc081a45566", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890961, "uuid": "80c42f25-1029-486e-9933-c07b92015c83", "value": "T158633A95F9815A13C6C602B7FA6E428C3B2553E8D2DF7203DD216F217AC781B0DABE51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890961, "uuid": "22d4f025-d089-4a5e-a4a5-2a8b3ca2ef26", "value": "1536:knforS4GNJ86hGLW1QUQuAxkGOaytxdvy3wbZnN:knTbhGcQPxkGExy3wbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680890961, "uuid": "b0127551-43c8-4f00-997c-7f0cdbab2d99", "value": 70972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680890961, "uuid": "ce155da4-6173-46bd-9a48-b27016dba5c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890961, "uuid": "397cebbe-6721-42c6-9111-5d50e1299f4f", "value": "998e7df31e33113f476b1f2ac6c50163", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff513160-d4f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1680837564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680837564, "uuid": "6d5e8992-3e31-457b-ac2e-406db0a5e266", "comment": "Malware payload (AsyncRAT)", "value": "93ecb2ed33e8e4e5542ebb4f8e9a1bf9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680837564, "uuid": "32820f49-d221-49c9-a65b-c267b5ddd03a", "comment": "Malware payload (AsyncRAT)", "value": "b605abc87533cdc19417cb5d77523786566abea6d3c50f9726cb50e572a72a6d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680837564, "uuid": "14220b00-049e-42f4-bcb2-12628d384d36", "comment": "Malware payload (AsyncRAT)", "value": "30c57eab55baa2745a351aa2595588ba82f97fc0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680837564, "uuid": "bc62f540-4264-47f9-85f2-cf78be13e88d", "comment": "Malware payload (AsyncRAT)", "value": "f09a179512bdd1c653fd71572bd5af85c2abe1cd5fe469e999286e20c6b77c40670e4409af0770f4fe258af8d0c53b6f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680837564, "uuid": "c02798a0-fe23-4541-a627-17b75fae5577", "value": "T140232B003BE8822BF2BE4F789DF26205457AF2A36603D54E1CC451975B13FC69A526FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680837564, "uuid": "40845bcc-f4d9-4843-b17f-76bc9ea0ec1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680837564, "uuid": "a771679f-928a-4cb5-b9ff-e99b6391ce96", "value": "768:7uHIZT9xqj6WUs32jmo2qrnKjGKG6PIyzjbFgX3iDINRDcRKn3Wg/FBDZLx:7uHIZT9Mw2SKYDy3bCXSDwR8XGLdLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680837564, "uuid": "c1067145-7c94-4ae2-ba06-f00669d89a0e", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680837564, "uuid": "6e2c23eb-bfd1-4567-b811-4b28929adc11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680837564, "uuid": "55585848-5150-47b7-a4e7-f29f84bedb44", "value": "xswQ1YZvEfsm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea9e47b-d56b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680889345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680889345, "uuid": "9834bbc5-cb35-4a50-b7c5-5efac5aea9e7", "comment": "Malware payload", "value": "116903327ed5dae3a221102cb095137f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680889345, "uuid": "35edffca-3ae7-473a-be00-a8f5d20f7e76", "comment": "Malware payload", "value": "b61e0195c49b3f81930c1817fd807e9bee8e50bcac22702603f7b24c6d2fde87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680889345, "uuid": "5bf350d7-a1cf-4324-9f08-65856a631604", "comment": "Malware payload", "value": "baf20c7705b151b0d8c5a995f048ca2ff574ff1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680889345, "uuid": "d1099b73-a908-45b5-9135-6fcfa3576e3d", "comment": "Malware payload", "value": "b0101a8a8814307b5136cb429966853d83163e54fff07745b61af20282efc15554b9b99f2b8fadf5854b2f9c0b11abc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680889345, "uuid": "9cdd8390-2993-40a0-9ca8-b0eba775444a", "value": "T16C03E1F7F01EF574D06BBAB256080084FDB7AB52F1110F7B4895A59A48FB201E271BE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680889345, "uuid": "f4a263fa-ad41-4c37-afcc-5557beafe698", "value": "768:pSSPi994ynW7HH6FRp9WD7GCH+s9RluonGtyfYb1cHfkOF0pRgAKP:vPi/W7HEjmlXuo6rb1cHDeFKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680889345, "uuid": "50fca4d0-e3aa-40ab-9ea8-998bd9414216", "value": 38920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680889345, "uuid": "4e0365df-11cb-4a6f-afd4-26ab5e119487", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680889345, "uuid": "d69677d5-fd68-4739-bf79-12afac8c9961", "value": "fuckjewishpeople.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae536d1d-d585-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1680900565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680900565, "uuid": "3089e612-704c-415a-a67c-58ef45c08a8a", "comment": "Malware payload (AsyncRAT)", "value": "e4a06fb8fdf8c6718e8022c2536485b9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680900565, "uuid": "fc333864-f39d-4c9d-aae9-e4d0bf61e83d", "comment": "Malware payload (AsyncRAT)", "value": "b735bb302538dbe4ebc1f368578f7661cf981867a56e0393f87724a108be4038", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680900565, "uuid": "9d5b9b23-42c8-4653-a362-8ea80db25ac3", "comment": "Malware payload (AsyncRAT)", "value": "458e933fa52e4814f2cf1beafff12671d0ae1dcb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680900565, "uuid": "18b1a21e-dd91-416c-b585-f538441385f8", "comment": "Malware payload (AsyncRAT)", "value": "ab529838c084a808042ce4393dc6c053922b26a70c91f56253934d11bbc81389a9736cfb2b9fab75601ad71545aef5bb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680900565, "uuid": "b5d01e2f-84be-4d9b-929d-e4df8a228dc4", "value": "T1A8231B003BE8822BF2BE4F789DF26145457AF2673603D58D2CC451DB5613FC69A42AEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680900565, "uuid": "8db4aa6a-d387-4c59-9d40-745ede3ca25a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680900565, "uuid": "59e2a6de-c0b5-441c-964c-1d592102b557", "value": "768:7uHIZT9xqj6WUs32jmo2qrnKjGKG6PIyzjbFgX3iW0vS1ArIsdvKXBDZLx:7uHIZT9Mw2SKYDy3bCXSpKe3dvKRdLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680900565, "uuid": "827da320-c589-48c5-83b7-aa819eb33494", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680900565, "uuid": "1b885f35-d1c3-4169-a9cb-cf94d1e500b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680900565, "uuid": "5688b3fe-b5b6-4f35-9b1c-16881178cc37", "value": "xNeBbYlZtq9X.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4554e662-d56d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680890080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890080, "uuid": "ebb1b8eb-152b-42af-9007-ad7fe3c7b5c0", "comment": "Malware payload (Mirai)", "value": "fa928af6842dbeb197c5d3bed13d1f7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890080, "uuid": "fbc5ff05-1b81-4926-90d4-01f3be36107b", "comment": "Malware payload (Mirai)", "value": "b9b2321a6733a146fd346cb3573e91b805024dfba67c9c5b27072fe5429238e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890080, "uuid": "65a438fd-6bd0-47fd-bf64-f5f22c0de7b7", "comment": "Malware payload (Mirai)", "value": "b6f9306f3b4465aeabedfb5c3b454c6d7d3112ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890080, "uuid": "f157c48e-5c17-40bf-9ee6-1ed5bbc55987", "comment": "Malware payload (Mirai)", "value": "d8d78262fcc64e9b6dd00731d320fe9356e0c7f5c16ac72254e93f65911e3c0e3ce6e77651bed170846964f54cce1382", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890080, "uuid": "93d9f6ac-7c68-4de6-b3aa-68386e706b39", "value": "T100539EA5C4AC9D98C6264678F614C839AB23A00C62A33DF6DA57C656941FDFCF01C7F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890080, "uuid": "13394141-c4c4-4557-8a30-b9c44f3049f9", "value": "1536:K/ue90IlCalyZyuhx+vACs2U/SO/Sfs3zO/QSwtPlCXzi:KGejAGyZyuhxaU/Sjf+iYdtPl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680890080, "uuid": "447d7bab-c3c8-49c1-a345-4ead3cb6f751", "value": 66368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680890080, "uuid": "cce7467c-216e-4cbf-9500-cd892c76f7b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890080, "uuid": "65d37119-54f6-4232-b210-a0087113af50", "value": "fa928af6842dbeb197c5d3bed13d1f7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd8d5de1-d4eb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680834474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680834474, "uuid": "7fb93f8f-5692-4bf8-8760-c7d5e37c32d8", "comment": "Malware payload", "value": "377d80d96c0caf40590c07161e56f123", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680834474, "uuid": "269a1d00-68f0-4314-b366-28fda1e3c1db", "comment": "Malware payload", "value": "bc4542faf0811ac4bc64843c1ddcb97d877c4bbf08d3367375aba4722b763f4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680834474, "uuid": "895432bf-012a-40ca-b4d3-419c4662881b", "comment": "Malware payload", "value": "dc68d2de3b3eaef1add25e56acab888be4f70c63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680834474, "uuid": "f69ee3dc-bc87-4c45-8a73-5c4d1420df17", "comment": "Malware payload", "value": "7d363d04c50de404d40ae82df36547b6373e223a0b16560664a89db5628e3b63507c753446c87134017fa4a732034820", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680834474, "uuid": "1dfe30ca-a1be-44c7-b07a-80d196c2cfb0", "value": "T12D434C227AE1C832D6A242305A7CD6115B7EBC335B78C44737881B8E5E712D1FA36797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680834474, "uuid": "6b77e1f4-6849-4347-8d55-47412c72a77f", "value": "b0a27ad0d5f8ae3c1f704e67e39e15e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680834474, "uuid": "e959abd4-2f64-4179-8e5e-ca4695613a3b", "value": "768:Dcf9htXeCsHtocKYGKqy7C0AKbYB8EVFIXAgJ1273dcbLNKDW0AEeWackc:wfpXgtocKYGrzuATtR6cl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680834474, "uuid": "119c5741-f683-415e-a6a6-e98197fa1d22", "value": 60416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680834474, "uuid": "6a7bdbe2-16c0-45c4-b853-46dc8209030e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680834474, "uuid": "d264fa53-d833-49d3-b922-721b4df020c9", "value": "SecuriteInfo.com.Variant.Babar.170415.6225.15767", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9603d2be-d583-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1680899665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680899665, "uuid": "faa3677a-b413-41dd-b1a3-52248cf95332", "comment": "Malware payload (AsyncRAT)", "value": "500461bcff51cbcb62c2e94e4fb0a659", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680899665, "uuid": "439b8aea-474f-418e-80fe-5937d0507561", "comment": "Malware payload (AsyncRAT)", "value": "bcbe838e8b415855b5f9a68943cb0743a542c4ab5f2ce20d6128288a28bdfbbd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680899665, "uuid": "e920be8e-d175-4af8-959e-e4e303202037", "comment": "Malware payload (AsyncRAT)", "value": "fa222fc14044f7a8e0d53562a9b05b9925e3a948", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680899665, "uuid": "241ad8b2-a6bf-4274-b6f8-59e087ac2d29", "comment": "Malware payload (AsyncRAT)", "value": "df14a607417b3bb83d07cee59fe42c272e8fd7fdc8d967b14cfddd5e3cbb0dc45dd9e6b21957162f8f3f0e286ef1e1ee", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680899665, "uuid": "887c72b3-71ab-4507-8752-620c8d19cc24", "value": "T19D231B003BE9822BF1BE4FB89DF26105457AE6A73603D9492CC441DB5713FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680899665, "uuid": "7a950627-714a-42be-b4e7-adf1ded94fa4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680899665, "uuid": "019d18c3-fbca-41b8-b565-386618e02886", "value": "768:7uHIZT9xqj6WUs32jmo2qrnKjGKG6PIyzjbFgX3igqfpL3BfWBDZLx:7uHIZT9Mw2SKYDy3bCXSgqfNBf4dLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680899665, "uuid": "e9158061-1b13-4387-82e2-a4c1e6174c7d", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680899665, "uuid": "6c1eb722-640a-4815-91cb-81aac9bfc68c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680899665, "uuid": "7ee81037-0eca-45ed-9ecb-dd6239fa422d", "value": "x7qX1tvj7xH4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a37cd0c5-d4e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1680830538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680830538, "uuid": "e104641a-0a54-47f0-b028-2ad301d0368e", "comment": "Malware payload (Vidar)", "value": "c4d79fe113303f1d0a0c3d94bcfab3b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680830538, "uuid": "b2b425e0-2656-4307-aa16-f961f7a939c6", "comment": "Malware payload (Vidar)", "value": "bccd81dfc84e37c77d12fc1a145b6854962eee72ac1b73013473022562c04d27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680830538, "uuid": "331e823b-d572-4fea-9cc1-c780006f87f2", "comment": "Malware payload (Vidar)", "value": "6da98fb848f741fb4822c70b5a32299b07fe7ff4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680830538, "uuid": "7778d630-96db-4dda-8292-9f5e3cc342b7", "comment": "Malware payload (Vidar)", "value": "29352e6ed0ba485b3c4a1f21553f8d38dbefe3d4ec5371f2d3b759986645e89df0668e4d937ec27857b0a4b915ee3042", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680830538, "uuid": "3d0bc5cc-234a-4297-876a-27cac5bd6f1d", "value": "T15AA4C04331DA2021D472D3FB80F2F25E12EE696133ED29DB36D8E05F5D191612AACD6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680830538, "uuid": "edfceba4-f9b3-4547-b7f0-e68fc6b73b53", "value": "a0e60cc838fd0f681073acc8737e4ec0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680830538, "uuid": "81d8d462-80bd-415f-8678-0f2367693366", "value": "6144:Q6RW4BEjBMxsNixbVvPxx7GcJac212xorx+gp4FWDpnuUgMavx7tedqpW9:QKW4VsNiLvZLw2usgp4FWD9gNfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680830538, "uuid": "938eb5b2-f005-4239-967b-e57fa22ec727", "value": 453120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680830538, "uuid": "e36083b4-3786-4573-921e-06106554ca49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680830538, "uuid": "ee0136ad-9e90-439b-9b42-30ce5940e577", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "520c66e6-d517-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680853165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853165, "uuid": "0b6dfd33-0725-4633-952b-15ab25c5538c", "comment": "Malware payload (AgentTesla)", "value": "3687c8aa868dd4e9c268626cf9b73756", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853165, "uuid": "f9de38d4-f49b-419c-8a16-3871c12ac98f", "comment": "Malware payload (AgentTesla)", "value": "bce31f0f29a6a35285ec19a24a2da1e725a2cb7ed520f85027e49413dfd42142", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853165, "uuid": "bb928bf6-3a22-4044-8136-c3eaec8ae487", "comment": "Malware payload (AgentTesla)", "value": "3882dd18869b3e6bca2b05ce20115b571695145c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853165, "uuid": "2eaf4732-2753-4895-ac46-a93dba42aaf5", "comment": "Malware payload (AgentTesla)", "value": "e2b297c7172ae3dfa19ffd5a56c05b3c91da3c3e50530afee0c9cc1ce104623b55b0dce69a410d58ebcf6841d6f53460", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680853165, "uuid": "f701adcb-043a-4f0d-924a-1e9f5c94ed86", "value": "T165C423D9CC9CE5BE5D2F31BEED28918870B132B3C4835CB2C7657FA4892501B16766C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680853165, "uuid": "b451758a-7ef6-4e3a-85ef-3f29a8c35279", "value": "12288:GYY8M6gkntjsruMLRYqizskqo3FzsSv/19RekXH6Yq:GYY8M6g+RX3GSvFek36Yq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680853165, "uuid": "d2c98596-6a84-46c9-b702-d19ccd0e30a8", "value": 559852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680853165, "uuid": "1b7869da-c49b-4504-ba63-1c5ace67f9c6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680853165, "uuid": "8837c0e7-9962-44a3-b990-b612d4da53f1", "value": "FedEx_AWB_771672479790.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2838de41-d570-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680891320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680891320, "uuid": "6abd4362-04b9-46da-bab7-24a2f3c20de7", "comment": "Malware payload (Amadey)", "value": "86a2514bb713457254af7ec04fcce8fc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680891320, "uuid": "eed38c53-4f26-4792-8890-c4a3f50b7868", "comment": "Malware payload (Amadey)", "value": "bcf5d05c181b2d0e44574d11913c2306901bb40b7328cf16224e749719148e46", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680891320, "uuid": "e91555c7-ae1d-416d-bf0d-38d51ff8e269", "comment": "Malware payload (Amadey)", "value": "402df098d66a07c9a3025ed5dbe8012b6c21b086", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680891320, "uuid": "cfd92e3b-7972-44b0-a56e-0e6aa7ecd77d", "comment": "Malware payload (Amadey)", "value": "b6f7d404418dd47075854a7a654c219c0f4d7e42b7ecdfac4ff0e54e6c71b9b9ecec136e4cc3fe9235178edffeec23d3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680891320, "uuid": "7b0e18e9-0e0b-4975-b3a6-2db28546f68f", "value": "T14F14BF11BAD5C4B3C81345784824C6F8793EBC539B95869B33987FAB3C313D166AA723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680891320, "uuid": "90cd929b-433d-4cc2-8e20-463f4033b22d", "value": "25a1b270f58163554bc7d2d96c00089d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680891320, "uuid": "91847413-1ff7-4282-acac-427297eaf00e", "value": "3072:gobA/GmrjNX8YkwJDkRdgBFFzOm4Rc553EO1+prYxzvsAq5mdFEiT:3A9rj7qwCm4RWq7CdF7T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680891320, "uuid": "31650542-6fcb-4d96-82ac-70427d3dd83a", "value": 194560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680891320, "uuid": "6ecea196-6e61-41a5-8b44-3f35f7b2ff9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680891320, "uuid": "c5919d44-b67b-426f-b809-8eaa21a6ce5b", "value": "86a2514bb713457254af7ec04fcce8fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26afc206-d564-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680886164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680886164, "uuid": "ce70d75a-b1b0-4619-a132-d198f41190d0", "comment": "Malware payload", "value": "e0dbabbdfb964e94881a6af82a74e0b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680886164, "uuid": "f68c15d9-20e6-40c0-ad2f-ec158a2d8937", "comment": "Malware payload", "value": "be5b7678ca03a70b75085b7725f2b332492253fe6582ddec166ba5557afe8392", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680886164, "uuid": "b9f8a901-5a76-4b13-9732-6cd5825df12a", "comment": "Malware payload", "value": "81b0b1f25c0c695a9fcf2fa632fa512a56a3d0e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680886164, "uuid": "125e5033-b8ec-4c97-89c6-8777ac14f7e0", "comment": "Malware payload", "value": "78d2b5ac58540d3ca6ad02f3c9391971be61dba638fafcfeb3fe0018075ac445e942ca3c51e0d8c8545a0321512f98c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680886164, "uuid": "f6bf01d0-1428-4f57-9494-7edfbb6f3c92", "value": "T18FC2425E2E225FECF718853956B34F70935973D622E5EB84E26CE8000F7424E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680886164, "uuid": "e3dab507-63ea-4167-8cd4-549bb597392b", "value": "384:BUnpy6uHas2ZLahgWHAp9nwJqH2PHV/63NHWZM6r6L8Ph1xgNgAGhrMS30cpq:CnpQ3AzyD/6dWZdOibD3nEcpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680886164, "uuid": "aa2d63e4-dd5a-41a5-9c2e-d36f33271578", "value": 26636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680886164, "uuid": "b8e590f6-f921-4ee6-b286-33db670ea21e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680886164, "uuid": "00c6f854-8566-4f4d-a4f8-8a0408fe788c", "value": "condi.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10ae66d8-d567-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680887415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887415, "uuid": "7a80a87a-9191-4a10-bfb7-58b038a97f3b", "comment": "Malware payload (Gafgyt)", "value": "e5f985302a0d61fd62785a2f00da2a48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887415, "uuid": "e49957a2-e620-4599-b538-2ca78cf9113b", "comment": "Malware payload (Gafgyt)", "value": "bfcb9f4d42734a68b1c7699781275d0fe8ccd2bfa2c294df39751818e24f9c1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887415, "uuid": "add5b9f1-a0a4-41f0-8071-0da7f2f93ce8", "comment": "Malware payload (Gafgyt)", "value": "78654dd228d01ead589e77b037ab7ad3aee67dab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680887415, "uuid": "ebe1ec90-3b2c-42dd-882d-8b10ec081bc1", "comment": "Malware payload (Gafgyt)", "value": "4c50c4cecc068e534cf66d54648010fda63e0f1148ce3e41845dfbb8652a222d810676a0023f133b79b9c0bc6e3328cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887415, "uuid": "59c63164-32ab-4318-b893-eae58a449c21", "value": "T141F38409D9A02733E2D23EBEF7A581CE72290FD86B573382C52D3AF45795BEA4535060", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887415, "uuid": "7146ec9d-0a16-4015-aa68-f8d5fac73d43", "value": "3072:QhTZuEQtEc4RKTpiA6LwiEFeXgZdTTap5VO8UUHMjVa1ypk5uo97SaQ1/gUjwS+D:QM7H3HD5aDhCL1dSQmOym4Q5LXKoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680887415, "uuid": "b8133af3-4b7c-45de-8bbc-0cbae39c9099", "value": 163418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680887415, "uuid": "df72d39f-bd08-4f5c-b9ab-9d382d5fef64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680887415, "uuid": "787f5c0f-41f4-43c2-a640-6bb7be762cf2", "value": "e5f985302a0d61fd62785a2f00da2a48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467b0600-d542-11ed-88f6-42010a9c006e", "comment": "Malware payload (Socelars)", "timestamp": 1680871614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680871614, "uuid": "cd4427ab-777a-429d-a39b-ff8663b1a4d4", "comment": "Malware payload (Socelars)", "value": "718b37ff4d5bf6125f5a75dcb42fcb0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680871614, "uuid": "30ef652f-61da-4eac-b7f6-05a00dea5564", "comment": "Malware payload (Socelars)", "value": "c5e13bcb74327c185715e29b32e3e9f9b1e1b2cf03c91685a930c909dffbc1a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680871614, "uuid": "0e1cab5b-4a34-42a4-8b15-6e47534e5c98", "comment": "Malware payload (Socelars)", "value": "80da44caf2d7f654ebc77de223e2f1176f01c5ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680871614, "uuid": "834e661b-affa-496b-82b1-875b80d07ffd", "comment": "Malware payload (Socelars)", "value": "e6e849289083f8e37e2917e0da31615b32c626ebb02b2bcec60464b445173e20c8b8ceae3fbdae4d1b5b308471547bcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680871614, "uuid": "4318a73d-28d5-4f49-8af5-11dcb5392572", "value": "T11A658D21F7C26032E8E310B745FF66BE9D3C6A114708A4D7D3C81C999B615E27A3B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680871614, "uuid": "5d0ce2a5-015f-4485-a897-099ea348ae1c", "value": "b1e867ef87efb215fbaa4877aa8fac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680871614, "uuid": "c86e03b4-153a-49ef-b82b-9636c6e0ad18", "value": "24576:0GU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dRXU5hTST:/pEUIvU0N9jkpjweXt77k5Rm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680871614, "uuid": "d52b34de-387d-4c6a-b123-81a0653877ec", "value": 1511936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680871614, "uuid": "f5d28728-6bdc-49ab-be41-c229fdaea260", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680871614, "uuid": "3ce95616-d5e4-45fe-9756-36049645050a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d8ed639-d542-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680871680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680871680, "uuid": "b7a549b3-01dd-4107-8e88-b2975f23c03d", "comment": "Malware payload (Formbook)", "value": "7af40e9fbf9f324ea0a2db18268e592c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680871680, "uuid": "b419733b-f6f0-4423-bc0b-548e0d6ce520", "comment": "Malware payload (Formbook)", "value": "caf7ce820152ced9c7e32dcb331899c2dd5ab092c7207f5994a4ef866d247197", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680871680, "uuid": "d6fbe958-3ddb-4dee-81e8-c47e28411ba5", "comment": "Malware payload (Formbook)", "value": "49fa548e22d4206e7e6faeac24a78bd1a1e257f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680871680, "uuid": "4fc74295-507a-4221-b042-87a9ee3734dc", "comment": "Malware payload (Formbook)", "value": "b3c6a864343f2ba8f7a28eff82db7564b8fc046541cf4fccf4ea8aaeac478d90fa36c77cedc1b4a64c5f4c41aac01a88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680871680, "uuid": "f333fb77-758e-4bed-9400-fd8a6d8a2b40", "value": "T100D4F10EBD01110EDD658A3788735BD61EB36D3D4AF45A1213B9BE5F58332C67AAC283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680871680, "uuid": "3a3f2ebf-e445-4bec-8f93-0ba039e9e336", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680871680, "uuid": "561e5112-60ac-43c5-b1fa-c43ebbd95b96", "value": "12288:hh+G1b16PHKV5S4RPnbU2I4IlfRChEa+CeKdG:hh+G1b16fghRbUIhEjsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680871680, "uuid": "2790bf4d-83d6-4a64-867c-bcc0a89761f6", "value": 628328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680871680, "uuid": "585021aa-c2f4-434b-97d0-456f4c237512", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680871680, "uuid": "6ac24794-57ce-46b0-81cd-68aa9f054905", "value": "AWB Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f50cd3f2-d58b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680903260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680903260, "uuid": "8e788300-3219-4546-a7df-0cc7e03bba5e", "comment": "Malware payload", "value": "635ae064cee24c2b11dd5c6671c5948e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680903260, "uuid": "39878508-936c-4b42-9b23-03e5601f46c1", "comment": "Malware payload", "value": "cbf4097f1a5b14a71b61e08879fa933dbd963e65468adedc0a20d2e66d6236cc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680903260, "uuid": "6bd83cd9-8636-4b5b-a176-ea1cf56446c6", "comment": "Malware payload", "value": "203a3c822c374df101c42f3463d3ffba8253b19d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680903260, "uuid": "5cc846cd-5035-4f3c-91f9-580f8b00b370", "comment": "Malware payload", "value": "1ebde728c58ab7e1c08c86290e9d87869566bf02641b34da99b4678bda610211b444df27cacc676bb208e6f70de1afbc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680903260, "uuid": "f47eb521-4518-4830-ac20-5de90b1482cb", "value": "T173624BD537F19236CDAC93729AA353851F70D611BA03AF5B1C68812C1C53B9C7E81F62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680903260, "uuid": "1457ae44-0d9f-49dd-81fb-ffdd5310dc81", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680903260, "uuid": "cfb10a8f-357d-45c8-8bd0-975a9442cd5f", "value": "192:btQQLP3EEM8LTf0R648B6WIkQWc2z1LtJMRzm81PhYrkGvG6R9Fq7Z0i2aQAg:buQLPM83MR648AWIWhMhsVJWuZa/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680903260, "uuid": "193a19f0-7762-4a0e-9d11-b9565d5a59fb", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680903260, "uuid": "d79b14c4-bd27-4c83-b132-bdee3a799dc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680903260, "uuid": "2835e9d1-b06b-4bff-8d88-4b09fb875cf5", "value": "hook.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49930e02-d542-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680871619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680871619, "uuid": "364c92bf-1a9a-4fe7-a6ad-a86ae0b09835", "comment": "Malware payload (Rhadamanthys)", "value": "4c29fe2ea61a781337705ce03e9ac517", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680871619, "uuid": "29fc2958-e447-4f11-9414-5d4072848aa4", "comment": "Malware payload (Rhadamanthys)", "value": "cc0d20bf23690dede04b43d1e445cd3c274aa5d9e5347e31668a8c544c4fa738", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680871619, "uuid": "b62254de-05c1-4723-a33e-44504fb9f421", "comment": "Malware payload (Rhadamanthys)", "value": "45bdcf9be91d2b66c71d447565a5c4a28727e460", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680871619, "uuid": "86db8f12-e890-4d0b-a3f1-f12464bd67fe", "comment": "Malware payload (Rhadamanthys)", "value": "463bd0cae172c52255404e441d445df21520a9a327e588a8215726bc814ff8d7be4d31f88ff49dd19634cfe72dfc6e30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680871619, "uuid": "3683df3c-c085-41b7-be21-170de449be6f", "value": "T1AA44E051BB91C872D56587385820C1F87F3EBC639A5B824733587FAF39732C25BAA211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680871619, "uuid": "f4eb6e66-f6b4-4dea-8dbf-b9e2268e05b1", "value": "5b250269b3029bf9f1db422179f30d8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680871619, "uuid": "6ddd87cb-6905-407a-8007-1cabb69c70f4", "value": "3072:UobAo6mU8F96GCizjWRHLZ9X6woXrNifTGpfDU0IJOUuOA7J2zmYkUrLqhi5WfYg:hAtmndCQ6Xq5Xpo6pfgtEOAN8KjAT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680871619, "uuid": "e865453d-b858-4027-9dec-05042580f382", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680871619, "uuid": "0d1b9159-dafa-4e44-8601-0ae88a9e879f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680871619, "uuid": "304d9951-76da-4d13-806e-2cc2cce5d1b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06afa7b0-d575-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680893411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680893411, "uuid": "5bdd0ed2-bb54-4506-b199-edd75059f9ac", "comment": "Malware payload", "value": "0b4e39c6dfe34e6b276ea4ff65db3b52", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680893411, "uuid": "eaa8ebb8-86c5-40b0-839a-b271577adf30", "comment": "Malware payload", "value": "cd017897d5ba451c1cef28c1fe77373c0e870139abb8f77c8574c7f8afbc8117", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680893411, "uuid": "755f8d57-7013-46da-8336-dac76abf29f0", "comment": "Malware payload", "value": "a6e2bd844ab3a1fcce962d11c093e4a576bd1213", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680893411, "uuid": "e58f8db6-8462-443f-a664-f3e7abb44461", "comment": "Malware payload", "value": "75cbbe3775e66146c50edab1372197c87a276191080352a151c4a9bc5ba7c9ebb121d5c9d5128aa69cfb045bc8d427f5", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680893411, "uuid": "5013b457-a2c1-454d-9bef-4c459deaf521", "value": "T1AB4633CEAFA8415FD6BCC175CA6CF1F0AD9CCA02D876795998226B410EC6F801C39ED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680893411, "uuid": "5517fba0-bf06-46e6-acfc-adaa1b59706f", "value": "98304:xR8wPiSLINsHI2xIYgtEwFoa65W8cdNnW7j7aXa2b0vAxmTmrE3iRpZOBPfMZ6yk:xZPiSDIWINnI5W8cdNWP7a4ABzP03MNk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680893411, "uuid": "b6cd0773-97b8-4445-b2bc-65c2abaa5279", "value": 5766539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680893411, "uuid": "3cffaf51-5fe3-4f77-85b4-ea4258e22a49", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680893411, "uuid": "65831304-82aa-4f0b-beeb-10364c02f757", "value": "New_Soft.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e8ce1e-d51a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680854326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680854326, "uuid": "68bd7e0e-930c-41b6-8b35-daf2fb34b4c1", "comment": "Malware payload (Mirai)", "value": "e9295c07348be8f12e498de2a446dbc3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680854326, "uuid": "9a242e26-4e91-4aed-9d4a-1c1bb8453f8f", "comment": "Malware payload (Mirai)", "value": "cd765f3bde7e9ee7d093a18a9b79305bf195f1de970ac35468dd813fd5af0c8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680854326, "uuid": "0873aea3-23d2-4bb3-aeab-f32b27e0857f", "comment": "Malware payload (Mirai)", "value": "c8abaaa8f74fcce6c807f9f8b2fb0ef0984c9273", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680854326, "uuid": "70cbec35-d496-4fdb-94c8-a4c8942609fd", "comment": "Malware payload (Mirai)", "value": "a7aed68e522bc2578ceb261120a31a51545dc4b36c6a30efa54f333ca5629d67d928983be36de4cfc67a35536239bcba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680854326, "uuid": "d069ae70-4570-4911-95d5-e7ad630824d5", "value": "T1A4E2E182B19BE4B3DDB02DBBDADCC78F8698B3B5B1D62A62070D1A54D1C340A157D287", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680854326, "uuid": "ec696e88-271b-468e-ae7c-aee090be4a3a", "value": "768:kSqCUy5QkHhIBDQjDXnuT3iPdpuqxLouBu8E0hkUYoKY/SQ9is3Uozs8:XqC520hIpKq3iuSoau8EHUY1Y/SQ9fz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680854326, "uuid": "6c0e7fd9-c94f-4062-97f5-f2bc321d5616", "value": 33552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680854326, "uuid": "64795fc4-24f5-494a-9a29-a08fdeaf5814", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680854326, "uuid": "b49f660e-96cc-44de-baf2-0ea97bed2f43", "value": "e9295c07348be8f12e498de2a446dbc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af23dc28-d581-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680898848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898848, "uuid": "d84b90d7-10b8-4d76-a6f0-5966f869d6e5", "comment": "Malware payload (Mirai)", "value": "edb26222020436057354837afde3b2e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898848, "uuid": "fc872dc7-2700-414e-ba20-d097eeae48be", "comment": "Malware payload (Mirai)", "value": "cd78dfef85e3aa0931d1d5c2f19279b8d6fa40c8b4d45aeab59d0d6553747760", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898848, "uuid": "8960615e-c77e-4fb7-8449-c859876dfc35", "comment": "Malware payload (Mirai)", "value": "9a9422c14f32172ea856141b4e93f58430732c33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680898848, "uuid": "a097fe26-74fb-48ee-aef2-5ab4acb95088", "comment": "Malware payload (Mirai)", "value": "0ed578dcf9b5edc6d49b416a4ac07cd8f37633b5675fe150346689c4e4f1817303f264e4334d234dcbabc7bb1e60e6d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680898848, "uuid": "423b1f35-9026-4924-8194-dc2e5d268fa6", "value": "T170438D33DA0A2D14C14A867030788E757B13E1C842E67EBA59E5C2BAD443A9DF949FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680898848, "uuid": "cbb09ba1-d745-4e79-963b-bacc8f808e57", "value": "1536:MjatoKHoQWh3xgFYaTyKNT5KBz747vsIlsCkCwbZnNw:8moKIQWUFYg1Ncz74PsxCwbZnNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680898848, "uuid": "31d329a1-5a62-491c-8698-3da11ca2ca82", "value": 60324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680898848, "uuid": "bdec7918-3deb-4998-aa53-be8129300c4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680898848, "uuid": "25429aa1-7823-4900-bce4-1dc0363db339", "value": "edb26222020436057354837afde3b2e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb5a966-d4dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680828170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828170, "uuid": "aeaf9839-356d-4fc7-9703-7122bd0fa4de", "comment": "Malware payload (RedLineStealer)", "value": "6f312c81692117a54789255e1c358418", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828170, "uuid": "56519a3d-89ad-4095-94c3-8184dddfbebd", "comment": "Malware payload (RedLineStealer)", "value": "cdf38e09c40648db5be922ef405b0e17a9ef780199dc700e8eeb888b9a7c8105", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828170, "uuid": "9e4a9159-124c-4551-ba18-c5b00d7a57e0", "comment": "Malware payload (RedLineStealer)", "value": "5e3feca55e8f2a1364e72a80cf46d1c6137ae828", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828170, "uuid": "1e010a2c-8abc-4643-9a58-d7c252662568", "comment": "Malware payload (RedLineStealer)", "value": "5b434db79e244a6038a996fb5e8d11ae9d5bf7d7835ed8e3b8d9a696287c65f3b80c26c70f65884a74c99871a05c44b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828170, "uuid": "18abfd65-1e25-4aeb-b084-39de04a3e42b", "value": "T19F152301FBD8C1B3EDB613702CF606970E36BE525C7492872A459D096AB25E07DB2B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828170, "uuid": "4996c9c5-f96a-4b17-bfb1-7e12108bc058", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828170, "uuid": "17b11ed1-3151-4344-a344-a2a83071081b", "value": "24576:xyrs98XfIu+Qd+QOyXenNmrCCHVPMaXOiHLGavyGwlrc:kg6Qu+EzXe8GC1PpOirF9wlr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680828170, "uuid": "fc0ea91d-1b68-467e-887f-5e56caffc62d", "value": 890368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680828170, "uuid": "1e59d0bf-f58d-453f-a3c3-02894977d409", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828170, "uuid": "fa115c28-15b7-478f-83e4-b3b0324b199e", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b9922a-d559-11ed-88f6-42010a9c006e", "comment": "Malware payload (RustyStealer)", "timestamp": 1680881463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680881463, "uuid": "1235266a-3601-42c1-beec-e92a02109dce", "comment": "Malware payload (RustyStealer)", "value": "c46d00046a6f943063f0702f4d2fc03d", "object_relation": "md5", "Tag": [ { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680881463, "uuid": "cdc17761-ee3d-4fad-b44f-eec215985b69", "comment": "Malware payload (RustyStealer)", "value": "cf1d6d3e7df0d864332ded117b7707e89209dba2987632a57d3080f1c98adc31", "object_relation": "sha256", "Tag": [ { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680881463, "uuid": "46827499-b1d4-4ec6-bb62-d22d31827a5a", "comment": "Malware payload (RustyStealer)", "value": "c25b8f8a937453a1152c0bd827369dbc678a184c", "object_relation": "sha1", "Tag": [ { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680881463, "uuid": "909817df-1ec4-4eb4-9414-14c7ebd0a82c", "comment": "Malware payload (RustyStealer)", "value": "98e129090e47412c9b25fc9e64405d9674d252b6c4f7aa3397a38ac7b08da9f0baa455c7f3310f67a732a1b6cd3939c8", "object_relation": "sha3-384", "Tag": [ { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680881463, "uuid": "0c244e2d-2b20-43e0-94d4-91c452dbbc69", "value": "T11B44230785326201B72C97AE394D1AF09D76BCE99B31730178586B24F8D6CB6463D63F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680881463, "uuid": "0c8d8bc6-beb9-4565-a06f-6aa9c703047a", "value": "6144:GBhoUCa7ESEZsHIdQ6tje++voBhECDo55Y5DE7u0vEHdtcaET:Gn+YIi6t0JbU5A5+oaET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680881463, "uuid": "3a16ee4c-162c-44ba-8786-55a5370766df", "value": 268130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680881463, "uuid": "218985ec-816c-46cd-a861-e55d43e61b49", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680881463, "uuid": "81b1a44a-1b48-414e-8f4c-bc18d33224db", "value": "9957250456.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5fe0ef4-d575-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680893705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680893705, "uuid": "69011ee9-3f05-4fd2-bb1f-d85b43d411ae", "comment": "Malware payload", "value": "a10675853651d550cac032abfb87bc09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680893705, "uuid": "c55ea428-a1a7-4ce4-85a7-c5c3071f60d3", "comment": "Malware payload", "value": "cf61b53357dabec1a1cf431d60a64a76cda84ecbbc1210f3efc22635f10ea23b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680893705, "uuid": "1513404e-b331-49e7-9325-ca647e26a96f", "comment": "Malware payload", "value": "beaa4a66109957f1a8a9955e77cbbd9eae500c52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680893705, "uuid": "86fb1880-1138-44dd-b47a-fce92eefb56e", "comment": "Malware payload", "value": "0e9847c1bceb2027466d183f877881636d129df8a66f612308aaeb23a8d80cedcde6d45025db5aeb74a103b4a6c618b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680893705, "uuid": "4ce41e13-3127-4819-8cff-7b3a4690cc37", "value": "T12435196B62A1A322DFD1093109EF87A2552DB7650913EAB7D3D1CE5E0B331318F2D6B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680893705, "uuid": "e3ed7b47-85aa-4fad-8a92-a37ea6a8fc8e", "value": "2dbdc947e0ec11df6856378b823a186d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680893705, "uuid": "59fc920d-f3b7-4a7b-8721-2dc2fd70fe5a", "value": "3072:PjWa6IsjUizbce5EzcPvuvarlK3yrhn4qJ6OAg0FujDlhVrGksgcuI3ej4m2usXH:7uUjPYPvxK3yV5AOxrVsbJP6s1eMiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680893705, "uuid": "117acb4b-5ff5-4e57-a1e2-b4489f18c423", "value": 1137664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680893705, "uuid": "f4e6e1cd-fd17-4a0d-9aa3-5afd73b20a68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680893705, "uuid": "9e8717ab-f67e-4b46-9ed4-dec8c432a664", "value": "Injector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0016ad1b-d51a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680854316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680854316, "uuid": "ae57b112-4c0a-4273-9a46-2965ed67b9c4", "comment": "Malware payload (Mirai)", "value": "1b4803d6fc268fbe5b43a81a60478073", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680854316, "uuid": "e9cb9ed8-334b-4e97-95e9-8f3e08d0af5a", "comment": "Malware payload (Mirai)", "value": "d234402482448d90fed52120a3dbffbbcf6a291b176956cb82131c3e692eebc6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680854316, "uuid": "04b65753-1de6-4530-b239-2ce1a4cf9b07", "comment": "Malware payload (Mirai)", "value": "5ae590a70c25186e9f777987e42059ab00f79edd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680854316, "uuid": "f4bfb169-016b-4a4a-9e9d-c435bd187f14", "comment": "Malware payload (Mirai)", "value": "7320c5a4f5a65a1ccb11bd11b5635d52f6bf1bf93d91b19b52f21d538c35e6a9c5d17a89443c0420b118a640857dfc4f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680854316, "uuid": "3d531302-396d-429e-b48b-f882e7d33d0d", "value": "T187136C61C9B85C8CE25C46BC75389E3D8723DA15AB072EF9425BC766A013ACCF65D3B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680854316, "uuid": "6cead94c-b519-4052-b33d-1790b1045293", "value": "768:E/2JGDxYsn385LsTAaTsxoYKp/fCuRR4ovHsUf6WLC1Q1vi:E/IIS4YhagbeXvHsBWLC1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680854316, "uuid": "c87bc3a1-ca04-4c29-901d-a6a9849e0047", "value": 43216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680854316, "uuid": "dd44cd01-aae4-4a31-83cc-4d3014d861e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680854316, "uuid": "7907e2e3-a759-4178-875d-f888f55cf114", "value": "1b4803d6fc268fbe5b43a81a60478073", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e27242-d542-11ed-88f6-42010a9c006e", "comment": "Malware payload (LgoogLoader)", "timestamp": 1680871616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680871616, "uuid": "b6f50f68-c3e2-4dab-9313-6eeea95782ed", "comment": "Malware payload (LgoogLoader)", "value": "2a8afce850ccf1416adc7da786b96405", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680871616, "uuid": "ebad3d8e-7138-411b-b7dc-7e0958d64268", "comment": "Malware payload (LgoogLoader)", "value": "d46cf0613b59437667abb20d4ed18e57204ce8e271056fca9fa0ad751969a70a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680871616, "uuid": "3a033ff4-8917-4a04-959d-5244caadb1b8", "comment": "Malware payload (LgoogLoader)", "value": "e561f1a6b1dcedc8d5cc7e1f150ca4bfb575e6e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680871616, "uuid": "78e89f61-bca1-4670-9d4a-89d0f94ac21a", "comment": "Malware payload (LgoogLoader)", "value": "bf26a0bf14ef9aa2d0fd72fa9ef1891ea8d030be27b6c676ae3426ccf28fdaf9e22a6b06a9480400a723aafa0db1fcbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680871616, "uuid": "7b135ccf-3efa-4490-b4bc-15673e1d6ee9", "value": "T11715122292D18437D0E223705DFA7A27157CFCF01AB8A7EF614504AEADA16C9D87436F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680871616, "uuid": "08d11e06-0023-4821-b9c3-aa30b466bd52", "value": "2339ac77bf9371500ebbf86df3a10d43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680871616, "uuid": "cc1b38a0-1fca-4d17-8136-0ffb901da4d3", "value": "24576:If0PzQtzrAxflvEedY/VEfyFQXFwrHgc4K4vZPL:YqQtrKfaGY6fyOK6K4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680871616, "uuid": "2aff6fad-637b-4ae8-b5b4-31c32a562eb3", "value": 901120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680871616, "uuid": "26cafa6c-4445-426e-9624-9d890ebc61a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680871616, "uuid": "870eb645-cc2b-4ff0-9dac-1473f32b2571", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44da8f3e-d542-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680871611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680871611, "uuid": "c9a19ac6-ea4b-449f-8cf9-2ae113b98aed", "comment": "Malware payload (Formbook)", "value": "6b29baee718bf525e5667d91b4d22146", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680871611, "uuid": "592712d7-2bf0-4150-8918-375db2856714", "comment": "Malware payload (Formbook)", "value": "d546617fa87ea382d7d36b61fa9a69e447bcc69f9bb366f52f3c1df3ebf9254f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680871611, "uuid": "3c23b162-b708-4e7a-b3f2-0982d839ad8e", "comment": "Malware payload (Formbook)", "value": "7566e8154ddc87881618ad498c05485895e55760", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680871611, "uuid": "ee56eda8-3319-43ef-826d-abcc961b6a87", "comment": "Malware payload (Formbook)", "value": "f7f778857dfb42f69ee6b0766d1ee6cfd629d5d18142777d18e80c7ad58731c4207001801678adc5864fe65b2d14ac34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680871611, "uuid": "2b73e844-849d-406b-b989-4f34661a4557", "value": "T1145412886964D5A7C4E30F7226B90D9BBFE2CC352108C75B1740DF0E7573A91EC1ABA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680871611, "uuid": "bdc19f29-5ca7-4d0d-ac2b-55cff6696314", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680871611, "uuid": "85eba0d6-1140-46f2-80ad-a84650b58345", "value": "6144:/Ya6FjA+FjlEZLtDJBD7zUBta6E6lf2xe1tY9:/Y3sKEfDJh7zUn4Y1tq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680871611, "uuid": "4ce44e77-4fab-4995-8772-b46c041e9b7c", "value": 280350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680871611, "uuid": "dfea98b6-d986-490b-858c-f3c702807692", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680871611, "uuid": "c64f352c-ffdd-4164-8673-ce00143de651", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c2cb5f-d518-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680853527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853527, "uuid": "4a610d27-4cca-4ed6-b8c9-943259d8b549", "comment": "Malware payload (Mirai)", "value": "3e2f481d4d7abd20d28ff1a527ab3040", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853527, "uuid": "a171d34e-fa86-48ef-b2d3-cf7bfc6975b5", "comment": "Malware payload (Mirai)", "value": "d5810e1faffaf281c0940564c7633de2d02b6905cedf395ba9dda4bcbee24034", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853527, "uuid": "3d6cdd5f-86ba-4da9-a78b-3ecb9e67bdb9", "comment": "Malware payload (Mirai)", "value": "e91bc700a303c33838401eaede2e50e5ad158882", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853527, "uuid": "f6446a9b-b03b-4322-86d9-c48868b256f7", "comment": "Malware payload (Mirai)", "value": "fb460fe35b30bed4af01ae39dcd78388a9cf3218b1dfcefb25d2fc561653f006b5107c410576253c5f0c235d397915f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680853527, "uuid": "e010cbd6-3866-4a7e-b91a-d463372cfc2d", "value": "T16A6302777A0CF160A4F1CCBBE554508773D7B03CF3B7792324954DA298105A5BAA0A5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680853527, "uuid": "28deea3b-c38d-419a-98e1-aeaf7a1430ea", "value": "1536:XlSvNASW5McqPzoeqwznOeV1sjIWLOcyDkB68LCGV+SjYyOTT1x:1K3WVqPMeqwieVCsv4NLLcXlx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680853527, "uuid": "982ac39e-3964-453f-b154-75f57d395527", "value": 70572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680853527, "uuid": "51d924a2-8085-4a3a-bda6-b16dab8dbbdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680853527, "uuid": "5146e807-e0b3-49eb-83f3-df2b1e13461b", "value": "3e2f481d4d7abd20d28ff1a527ab3040", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353ee12e-d561-11ed-88f6-42010a9c006e", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1680884900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680884900, "uuid": "4314d071-a9c8-4e68-8b7d-b6a984ffd93d", "comment": "Malware payload (RaccoonStealer)", "value": "e85d4d1cd98eece23c1e73ad7fe1d9bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680884900, "uuid": "ab49b3ec-6ec0-4d8c-a628-79d821dc1bc3", "comment": "Malware payload (RaccoonStealer)", "value": "d58a832f0f2ad0d394c07aefb0dd7ea8b925b10322e508496788a76ee864523a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680884900, "uuid": "6380cf36-ca80-4802-bbbe-cde736045f63", "comment": "Malware payload (RaccoonStealer)", "value": "3127a23e50a7cbe2c61e45ede953be7ff780261b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680884900, "uuid": "e99c197b-b2a8-4395-84ec-c8bcd65ec58f", "comment": "Malware payload (RaccoonStealer)", "value": "9c83fda54bbc17a9709d2a2ccb78f370f8b9fa9b060bca41c0efdb28ab0060e3d2731f0a0cacf371f4b04544fc710048", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680884900, "uuid": "e1863341-0058-4dd4-b91f-30c0ac9d2147", "value": "T15556236762A50069E4E9CC391837BDB931F5032B57C3FC3C59EF6DC626168A4B702A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680884900, "uuid": "9f267e1f-2a6e-4bc1-b0c9-b1ced188a330", "value": "895e5e6e037e9108574fb94ed614d804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680884900, "uuid": "fe2729bf-704a-469f-896f-ff02560cc17f", "value": "196608:5yfZfA9nKaDlaPXWKHra8/fus59xQdLjuV:2JqnrZAXjHe8/fb59xQVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680884900, "uuid": "77f0687f-1f9b-4483-a8e2-b79aa49d0117", "value": 6310912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680884900, "uuid": "69fc7302-c72f-4431-bf76-3d6a3ab37040", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680884900, "uuid": "4ae69c8a-c8e2-4045-954b-0f891c8fa1b0", "value": "e85d4d1cd98eece23c1e73ad7fe1d9bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b833a1a2-d568-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680888126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888126, "uuid": "5fe3f44c-cee4-4158-bf92-b785e1582fca", "comment": "Malware payload (Mirai)", "value": "20f6896ed846f702561b32f7b17a4e9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888126, "uuid": "b844783c-ca0a-430b-9b40-4c021140beb2", "comment": "Malware payload (Mirai)", "value": "d598b266f46244725559e3eabd6fc06df15fed523bb47f566dcee3d9cbfa6427", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888126, "uuid": "34a00271-8b30-4f4b-8939-09b4385b3faa", "comment": "Malware payload (Mirai)", "value": "693e2136accbc824c964bc213e8e45f3a27b7685", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888126, "uuid": "129b1931-d91d-4e99-9770-7e4b39de8dde", "comment": "Malware payload (Mirai)", "value": "058897e0ea359894a96a0d33a8a47103c7a20398b1955534da5762701b216386e60c5330b6cfbe8a93c5831f58c0dd39", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888126, "uuid": "7a833a42-38b4-4a73-a1a1-3e823f95cd73", "value": "T101534B0277684F07FAE61AF4243F1BE483BEED8025E4B588690FC7424635E374999E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888126, "uuid": "386f5ebc-b32e-4ad9-a73b-f18f5d4de425", "value": "768:Sr5Eg6nb5usRVQq8WTUqYhcBJcIGsllk5M9Bv6GG4TlW2c5sjgi+DDiZ/vRBbsVf:2KbpuqJlzk5xGpJgbDOZ/vRuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680888126, "uuid": "e40925cd-bcba-45dd-af9b-c0e15e1ad1f2", "value": 66468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680888126, "uuid": "c0815c56-adf0-408e-871a-51bdab621139", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888126, "uuid": "c3120c22-6244-4cee-a043-056e6c333aa3", "value": "20f6896ed846f702561b32f7b17a4e9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3313587b-d52f-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1680863421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680863421, "uuid": "f48235cb-99bf-4acc-a935-340fcb0c3f1b", "comment": "Malware payload (CryptBot)", "value": "4c845a5d9a6939e82ebb8035fd66cfa9", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680863421, "uuid": "84b321a4-1c01-4d1f-9654-ff43e055effe", "comment": "Malware payload (CryptBot)", "value": "d70046ddee32d343d86ba2b892343a61360aa7b980e5c12f0fc6fd5c8ef5259c", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680863421, "uuid": "8ba13790-f31e-4fd1-af66-0aab31c59869", "comment": "Malware payload (CryptBot)", "value": "f90920eafa7021467b9bbf3838d2b409dbef07d8", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680863421, "uuid": "2affdff7-dfba-43d5-a6e2-8f496ddfc060", "comment": "Malware payload (CryptBot)", "value": "e5ae0b194f7790c66e94120b482d0517080f97ce007e7f42043450115b9b13f08f94e036e1909e7d69e23de9fef7c8f3", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680863421, "uuid": "681502a6-9102-4b49-bf6c-8f9457ba1637", "value": "T14A6623B262EC15CCF5E2C83DC527F9C971F24E565681A8B870EB3BC11832392A92DD57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680863421, "uuid": "cafdf9de-4e8d-44b5-b43f-f9c50d17e05a", "value": "36d75ecd818f0c5cde41f4ee2b1e9296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680863421, "uuid": "e2dc43ab-b8fe-4093-81bc-4e57bb885cfd", "value": "98304:XeDSL2Ifrprq2Q53WsBz8y5VK5Rtt3MJdpWlNrym198IFG++R6k7j3xxyRh9z/dl:XSSL2I1Yhz8xLzQpwsOnFkRbv3LyXi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680863421, "uuid": "7fb2868f-0f36-4097-8998-109c69025f58", "value": 7079936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680863421, "uuid": "49d24881-28cf-4600-b681-4cf7f3be865e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680863421, "uuid": "0cabfbb8-16e9-49c7-ab28-c7b7d3bc9ddf", "value": "4c845a5d9a6939e82ebb8035fd66cfa9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3878a596-d52a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680861283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680861283, "uuid": "fa6b9b44-adf6-4fcc-adbd-492b5f828cf0", "comment": "Malware payload", "value": "953aefab518ca53f2a77ae25f1ae499f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680861283, "uuid": "19b9c3e3-4387-4153-9658-aba2dded61b3", "comment": "Malware payload", "value": "d76171d55d2419e05fec0ef8ad901dc8ae7b87dc7e8da92046d86c55c80ee678", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680861283, "uuid": "bcb9650a-7646-4f6b-a956-4d50be6c1263", "comment": "Malware payload", "value": "b0d49d9819dd96df3e95298d7f8241994f3ea286", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680861283, "uuid": "691eca77-573e-479b-a876-63d227ceac0a", "comment": "Malware payload", "value": "d2237b5b9c5938e0d7e4b55312726a320cd84ee29d09cb7213a99960c2cbebc005ed83fe609ce5d90a8c21e4b580e793", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680861283, "uuid": "3871b4fc-b3c2-4e57-8d1c-d71c53b50caa", "value": "T1BB233B02B7FE1608F1F32B9C597A15650A3BBE65593AD26C00BC654D4FF3E408DA1BA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680861283, "uuid": "1b867ca1-7a2b-4403-a3c8-756dc910d052", "value": "768:44b5F/+kVY4VPJX969w6uRSqFBeWpq4b5F/+kVY4VPQ:44b5F/+kVY4VPJN69w6uRSqFBeWpq4bI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680861283, "uuid": "5ac10a83-91d6-406b-8939-98bd4f0be9c0", "value": 47856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680861283, "uuid": "5dc11d8c-b658-478a-986a-88b4f631d140", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680861283, "uuid": "fe82c936-14c5-4259-8bbd-cb0473706be1", "value": "642fe81ca3183.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60d24e4f-d572-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680892274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680892274, "uuid": "cb5ee46f-bbd9-4c26-9bee-6d769938242d", "comment": "Malware payload (Gafgyt)", "value": "b5bf5ff93d2902f9a9a180ef41d73fa6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680892274, "uuid": "7a2b9807-adcf-4e21-a75e-18f2859028dc", "comment": "Malware payload (Gafgyt)", "value": "d79eeda24c5397fed1705207cdaa35ac6b89dcb7ccf981baac75c0c4bc346fee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680892274, "uuid": "05981725-6b68-46dc-8e3b-3a8df20b34a4", "comment": "Malware payload (Gafgyt)", "value": "4ffff3c040a5c06a7cc800db61d278c372ed53fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680892274, "uuid": "146be6af-495d-407c-95b8-3183e1ade088", "comment": "Malware payload (Gafgyt)", "value": "743644b3bb2a2d078756db2d2b6fb1810d0c5a66703a2e1ed66787395f4d77b21c2ccd19b54fc2c12f7b453e9533b004", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680892274, "uuid": "fcf5d2cd-93fb-4700-8858-17e8cb9baa8d", "value": "T15C935C23A661CA7BC08757F42BE7D5619823B4790B33320A73D4BDA96B19CC96E5E301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680892274, "uuid": "b0a1b2c4-a02a-4c7a-b570-7b642eabff2f", "value": "1536:oQ7gq+66XdChtAFThWVuDPRvCb4tWcSp3czMmoIGuOVjeDlOrQ:omgxXdOtA5JDPdjAcSZcYmrGuOVyDlOc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680892274, "uuid": "04313252-d868-41f3-a5ef-b5f02f2d2b38", "value": 93129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680892274, "uuid": "ac58174f-d255-4025-a0a1-b9656241d85d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680892274, "uuid": "068c261d-b4e5-48a5-bae3-c7be3acc01ae", "value": "pXdN91.x68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b099eef8-d52b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680861914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680861914, "uuid": "44a8cc1a-c9dd-4265-8012-08d623e86e8e", "comment": "Malware payload (Loki)", "value": "6e4d81651eb4d1c25d298a0a5f4e2d34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680861914, "uuid": "e969c202-8066-4387-810a-0356ee68f3ae", "comment": "Malware payload (Loki)", "value": "d9d968c6c6b73cf0cbeba16fa598259be05b5c0cd049b10a87b616b1c7ed500e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680861914, "uuid": "714dc64d-a58a-457a-9cb2-773ac61fe3f8", "comment": "Malware payload (Loki)", "value": "191eade4d46648d2804f3243b9c8c9f9c74aa8f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680861914, "uuid": "3b8432b8-df32-4d33-acf5-9d0e686d9c10", "comment": "Malware payload (Loki)", "value": "c014a653269b8cad7afe0f42e1639d8007b7a408e63fc1a7c1464cc3a50f13126556f50787a959e1e1cd758238d9d85d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680861914, "uuid": "679e9cbe-aa51-46c0-ad35-89b2dbd43b92", "value": "T10DE46CD42AD68BC4C037B131F05AC6F2C3D2152AE099DBE1389B5989E1D2E511CFA9FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680861914, "uuid": "4ba96afb-9c61-44bc-b7cf-984068316b7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680861914, "uuid": "63ea27e1-8805-439b-b7e6-5237dcb19a9e", "value": "12288:M2iNIFcM8Hg8Vl4vLVO+InEy9hT5dgL3GqCJXxE4q95wrayVgh2eV:M1e23Vl4ZO/Fn/03GJRksry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680861914, "uuid": "d63588ee-5290-4237-91f1-4c2a709080a0", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680861914, "uuid": "ede99fe4-d39c-49a1-bc49-d30603a2c227", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680861914, "uuid": "15f10301-5d41-41b4-a068-970f7b2d407c", "value": "DHL ReceiptAWB#2104582082.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f65bb2-d4dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680828293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828293, "uuid": "e75cac2f-a6c8-4e85-a317-1c8a3f37aeb1", "comment": "Malware payload (Amadey)", "value": "5ad76882c0029dd74bdc76ed4f7c224c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828293, "uuid": "7ca3a6c1-0a5f-4d9b-82b7-87fb6991a1b7", "comment": "Malware payload (Amadey)", "value": "da8a3d51df6b437bc08464a51697829ef89e43d63413867132486db9ddeff839", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828293, "uuid": "ca9fa964-7183-4742-b572-efe53b615bee", "comment": "Malware payload (Amadey)", "value": "f37b51c6801afe6ffbc7eda0d7e31f57d66e421e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680828293, "uuid": "ae477937-d3f6-4d27-bd0c-cf9903297e03", "comment": "Malware payload (Amadey)", "value": "63e1768fb4c49f166b6deeb1bcc2368efdbaa806d9a069a9452f5e34345863455bb38fc8c5f7ec4b13d101b369e8d8dc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828293, "uuid": "8268c21f-3442-4d2f-9840-a5932e6bc575", "value": "T197152317D9E84437CDB427316DF603D70E39BCA25EB9421B27992C1A59B3790A83272F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828293, "uuid": "7114365f-976f-4590-9068-0ce9c90d90bb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828293, "uuid": "d6d85935-ccee-41e1-9b6f-0bdfa9cbff0d", "value": "24576:lyroufBz/fh+xhbjaGt+F3CjmuWfk3pEd:Ar9JyRjaD3CjmJfq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680828293, "uuid": "731b38e3-5c8d-476b-a73c-c7b5b2d32970", "value": 891904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680828293, "uuid": "dbc51105-1e54-4451-bbf7-1b7f0d4faaa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680828293, "uuid": "6e0a6552-7662-49ff-80c9-2e9c5966ac27", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f411a31-d4dc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680827874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680827874, "uuid": "e770ce16-098d-4701-8349-d5ee59b206f9", "comment": "Malware payload (RedLineStealer)", "value": "12c4e5c4eae52aba6a8414fae92dd5a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680827874, "uuid": "75799333-774b-427d-b8ce-54fe33321853", "comment": "Malware payload (RedLineStealer)", "value": "db886da2fd595120ceeef59dd0866fafdb3d79c30d9bfabeaa8a1764fcc17794", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680827874, "uuid": "af029f01-780b-4351-8658-9e3fade6f01a", "comment": "Malware payload (RedLineStealer)", "value": "f545a119cfd768885b162b5e5e2ac2469db46318", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680827874, "uuid": "712b0ecb-04c4-4d8b-b6f7-d0bd672ec249", "comment": "Malware payload (RedLineStealer)", "value": "5d710066a72289dfde25fb316ccd0c065642949eb7aac7dc52969a39396ec5715740cea00fa2fe51d4af8a5bdda2b077", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680827874, "uuid": "5dbf3d98-0536-4bcd-b1f2-59a5bdf33e24", "value": "T193152381F7C881B2ECB513701DF70A831B36BCE14874D7573A8A5F6949722949A36B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680827874, "uuid": "0cf0c518-5aef-4086-96b4-53fea5a7e442", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680827874, "uuid": "9d395a2b-be92-46c2-80c6-943595a00d9c", "value": "24576:Kytbem+PMEjfckPeKRHYCaOFY0xsg9Pkam:RheBMEjcyeMjaOFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680827874, "uuid": "62508002-3112-4e34-aed1-a410fd2fed66", "value": 890880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680827874, "uuid": "1bd71a16-a2b6-465f-9672-21d00bdb412c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680827874, "uuid": "2029d436-37b9-4c57-a14b-60ab59a6c70b", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe0f223-d513-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680851497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680851497, "uuid": "7197f67f-fac1-467f-9a92-0b9f4b7aff22", "comment": "Malware payload", "value": "93a847201a9a2a9c85ce317cd8393c39", "object_relation": "md5", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "gsdgtruhu45-cn", "colour": "#6672E8", "exportable": true, "hide_tag": false }, { "name": "irejhg-fun", "colour": "#5699BB", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680851497, "uuid": "06e630bc-5178-41a4-a54a-5dad0d3da6a0", "comment": "Malware payload", "value": "db92484a386a2af7ef88c9bd2d3a535ae7e7b81af15c5e950c9015572547a20b", "object_relation": "sha256", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "gsdgtruhu45-cn", "colour": "#6672E8", "exportable": true, "hide_tag": false }, { "name": "irejhg-fun", "colour": "#5699BB", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680851497, "uuid": "baf3bb27-95c0-4667-96bc-a803f1bf2b3f", "comment": "Malware payload", "value": "9382ed828bb66ef92bfe3ff83e7d44bdfa8c0415", "object_relation": "sha1", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "gsdgtruhu45-cn", "colour": "#6672E8", "exportable": true, "hide_tag": false }, { "name": "irejhg-fun", "colour": "#5699BB", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680851497, "uuid": "4f59abbf-5056-466a-9ba4-d00ca2570e06", "comment": "Malware payload", "value": "1de0672724b3fcd002c272092a803ccc0cb9131f7530966b20ded828f160825c40bfe62c53f1f740a82e59cef10c9bd3", "object_relation": "sha3-384", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "gsdgtruhu45-cn", "colour": "#6672E8", "exportable": true, "hide_tag": false }, { "name": "irejhg-fun", "colour": "#5699BB", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680851497, "uuid": "87a779b5-e2ea-4116-a40c-2f44492cb091", "value": "T163110410224EBD6C0A17E2C3B6B440903FD70440C44D39118B485C0EDF76AAAC6EF9B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680851497, "uuid": "9e65b433-6ab3-4e3a-b4ed-ad1b5274f89f", "value": "24:wC3I2hH0WbNR8piBlOigEB11fXXfD/ucYa2AsamxaHn:73I2l/bNypGlOzEB11fHfDBBVmAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680851497, "uuid": "e286b332-77d7-4c78-a16c-c999039006fd", "value": 926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680851497, "uuid": "665bd8a0-bf3b-459d-9757-d12fabfda07a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680851497, "uuid": "e2bfcbe5-5b20-4b67-a2f3-9b9c2349e918", "value": "client32.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a6d2e8-d57c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680896523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896523, "uuid": "9ed73766-b468-483d-919a-f3585e31fc66", "comment": "Malware payload", "value": "29ca729c75bed907742bc8d5724c61fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896523, "uuid": "195d5469-1425-4642-abc7-170fad9a6093", "comment": "Malware payload", "value": "dcdca69aba18aa989d383a4c37d2e45623e39dd341481ba570d4e10c4adc4843", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896523, "uuid": "aa94cb11-3e6b-477d-9f12-6db07fb02dcf", "comment": "Malware payload", "value": "beebee069c4b49e0a595ac1b5a3bcae6266f7b0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896523, "uuid": "03d1b766-4c4b-4304-9d6b-72d1cc06e307", "comment": "Malware payload", "value": "b9113ff09ae1926d1c35a9300269eb986f486c9b37b3e0ffcd0cc0f3167a525d67b5c9743a36c62e1fb10b1edd56aadc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896523, "uuid": "42f99a76-68ca-473f-9d0e-155040b7eb2a", "value": "T10F231891BD80A662C5E415B7FA5F428D7B2613F8E1DA73139D159B303BDBCA90EBB001", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896523, "uuid": "a539ae97-f678-468d-b131-1f982652c89e", "value": "768:RfwDcWZX2CbGt28Mbg/9nGb1UOTYbzel0pbwzs+gbWdK+oBN0vvCqfnKups82M1R:dwJvGYng1s1l6zE8wYtWdrdvvHPRj1bQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680896523, "uuid": "80808648-2acf-49fe-9478-31a6a33332ae", "value": 47784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680896523, "uuid": "b5fb43c6-08dc-40eb-8204-968b622851e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896523, "uuid": "038b505a-0aae-46a0-bb38-b1230019955e", "value": "29ca729c75bed907742bc8d5724c61fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b344b990-d568-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680888117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888117, "uuid": "39819ceb-19ae-48df-8f84-d638f97c7b8a", "comment": "Malware payload (Mirai)", "value": "a18e52a6313a26f9a2c105db23ec14e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888117, "uuid": "8e85028c-daa7-434d-8562-fa4af6842a1d", "comment": "Malware payload (Mirai)", "value": "dffd2295f32b5fa2d3c4ffb7ec7267359b426d94f090c5fdb4b44c35a6a5b0cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888117, "uuid": "2926c0db-68b1-4447-b411-fb69840e3185", "comment": "Malware payload (Mirai)", "value": "3954dc35fe9db257afb94965251bfc2adf3f0465", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888117, "uuid": "1f3e2e16-4db4-4a6f-9a2e-c5e667307025", "comment": "Malware payload (Mirai)", "value": "55fc838c33098ca66fb106ccd4603a34cb13a2423295fcdb2cfa0ab4ba8b740e7012bf5c8bfc645d8c9f0ef5b4b84dba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888117, "uuid": "d074c047-79a9-4ac8-86f8-ca4453e5620b", "value": "T12513E792A8925E26C2E0237ABAAE51CD3360B7E8D1DF7217CC111F447BC951F0D6BB51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888117, "uuid": "55d163ed-6872-4779-b987-e19295bab5cd", "value": "768:io5+gbIgiwB/m/prWJA7T6p2EoWGarlBmMH8YQxzmYCtDt4RtrbblUyZHyLPN:i6EgLpm9XWGaBBmTYQxSYCmrbblD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680888117, "uuid": "27d52192-0a32-4154-b895-7f08f710e8bc", "value": 42252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680888117, "uuid": "b38004da-375a-4366-a632-89c2e6329aae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888117, "uuid": "3a087cf4-a3b7-4874-be66-598174421a2e", "value": "a18e52a6313a26f9a2c105db23ec14e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4504c6b3-d4e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1680831239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680831239, "uuid": "e41d7a2a-46f6-4dc0-a27c-18aaae64d2e2", "comment": "Malware payload (Vidar)", "value": "f94b813fa59f08121fa3f5621f450092", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680831239, "uuid": "61d56fa1-955d-4d26-99fc-f4976da44887", "comment": "Malware payload (Vidar)", "value": "e31e544efa2ec5206c6e96340a4d85282ac0dfce7f96134965c2f576a71d07d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680831239, "uuid": "5f4ded20-023f-42f5-9e6b-1551a771694d", "comment": "Malware payload (Vidar)", "value": "10220325973c102cf31190888cad4c6aa995bc13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680831239, "uuid": "a5d859b1-9a28-4bec-90d5-eae98eea8857", "comment": "Malware payload (Vidar)", "value": "f0fbb8ec22bb8539697b3e4b2a1df5c32c3db467d6efce64478314a06180b1972d6219ed76117f02a9ace4d3ec2c4218", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680831239, "uuid": "261fe61e-bbb3-4645-abe5-bb22925bf7d4", "value": "T10994E003B1A12429DACEC5FF04EBDBB99C7B6432A7B35289B29C5713451F05642BF1B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680831239, "uuid": "064176e0-595a-41f7-9041-6c38ab63814b", "value": "2ec1e43fddcd7fe383eaa8dbeb0dd6de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680831239, "uuid": "55320215-f931-4674-a53e-d326413a795c", "value": "12288:NQMTZrCyRcvQB6XIkmNT4zptM6v5bO0VFMgsHYX:NQMTXROuTOtM2VCgs4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680831239, "uuid": "35147ad9-5d18-417b-ad8b-6d0b7bc75505", "value": 441856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680831239, "uuid": "3bddf65a-0b46-466f-b403-a6233d4aabb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680831239, "uuid": "f4a5f0af-517c-49eb-a503-ead6a32710b5", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab09567f-d568-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680888104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888104, "uuid": "6a3aec07-1711-4a54-a49b-fa540a108369", "comment": "Malware payload (Mirai)", "value": "8fa4fdc2eab361f7bdd81d1d79a188b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888104, "uuid": "d5fcb5aa-7407-4d73-a0e3-2e7a4c9c23e0", "comment": "Malware payload (Mirai)", "value": "e33f9756de26788219c029444ded6800bbd81edefd9d1c5378f185817e236fe6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888104, "uuid": "76b1d8df-2abf-4a08-a9b4-a49d08053bb1", "comment": "Malware payload (Mirai)", "value": "7cf60af93b19dc0b8a33664d51c506f20649e759", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888104, "uuid": "951a5810-74c9-4181-ab6b-8022581d9f7c", "comment": "Malware payload (Mirai)", "value": "ec3720a2ceab84dd6dc7486ff10e4ee9c4a700d40f88e6f0927adee364b1710db314471c558f4e50ae5e490cd4cdc488", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888104, "uuid": "1be12321-dd7a-447f-a0a4-405baa5cb412", "value": "T138E34A42EA408E13C4D51B76FAEF41493322D765E3DB73078D185FB43F86A9E0E62A49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888104, "uuid": "316a7b60-aa96-4acf-b4f7-03f7b3f3de5b", "value": "3072:walgM69pe0QmlTvIUdt9mrsplDKZUQQBKXAVanXX+F8JyvSPhLZ85iBMR6yoC1QO:walgM69pe0QmlTvI8t9mrsplDKZUQQBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680888104, "uuid": "d05843f2-d2e1-4e5e-bfad-20211e14afd0", "value": 145189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680888104, "uuid": "0740a0c5-6000-4310-aeab-40546d29695a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888104, "uuid": "07694844-d304-4374-891e-f71fbee84066", "value": "8fa4fdc2eab361f7bdd81d1d79a188b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4b33035-d516-11ed-88f6-42010a9c006e", "comment": "Malware payload (PennyWise)", "timestamp": 1680852928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680852928, "uuid": "30f08326-b4b7-4c46-9ac6-4084ee41cd60", "comment": "Malware payload (PennyWise)", "value": "4e259e14008afabd79d8d08475a7a70d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PennyWise", "colour": "#4CC31C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680852928, "uuid": "a41259bc-ba33-4a86-b994-972280b4fd8c", "comment": "Malware payload (PennyWise)", "value": "e34e4d5a72dc6427ee8df5b9812cd59ba598b4a7450c54e3f425fa25ed5f5cdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PennyWise", "colour": "#4CC31C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680852928, "uuid": "c77c5fb5-0530-4bdb-b900-d35149ae3caa", "comment": "Malware payload (PennyWise)", "value": "e79c361d494f59b42fde34a7f7616545455a3cfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PennyWise", "colour": "#4CC31C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680852928, "uuid": "29088b6f-9103-43bd-9524-903f6eacc995", "comment": "Malware payload (PennyWise)", "value": "550d702ddf689b2fb9f40aea83caa794f89148a46879c3a56ca9438fc4e50610ce89b5f5113282164ffded6e4f3014f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PennyWise", "colour": "#4CC31C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680852928, "uuid": "83ff4de3-4efd-434b-9903-75a6bfb0bf98", "value": "T179B307BC524D8E85FEDDB2B4A8A31108FE78A61F8907DF419CC6A5FB29477C549320D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680852928, "uuid": "826d90b7-c220-4876-a7ba-7e716086dc5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680852928, "uuid": "b7bf38c1-081d-48b1-8307-ba45e9f084b8", "value": "3072:PYI+zN0CmA4W6jOu+4UILjQggZCBb5diWW:Af4WVARWZcbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680852928, "uuid": "f5fd57a7-a99b-44a1-9b3e-473a7dd2b0e9", "value": 113664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680852928, "uuid": "c5a71490-a711-470f-9c76-e8ef3e4cf9ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680852928, "uuid": "0a576f24-3ca8-489d-89c0-fc313a027838", "value": "PennyWise_@burgerkink_govno-cleaned.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e7a34f0-d568-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680888083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888083, "uuid": "655425a6-c701-4ce2-b955-41684f949852", "comment": "Malware payload (Mirai)", "value": "2ad7a4268118b6fb159c8c5acf21d8a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888083, "uuid": "1cb1943e-82ee-4904-b566-1da1555515ee", "comment": "Malware payload (Mirai)", "value": "e71a86aa5d1300d4eebc55f8de54fd74e882568260e18874c327bb7bcb3b5a93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888083, "uuid": "3e85eaf4-11ee-4b0a-80f8-76d76c07a3c4", "comment": "Malware payload (Mirai)", "value": "b5365c9e0df27b33722df3f464bd014ae20e73a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888083, "uuid": "258bfb61-39b5-4628-86a8-35c46102ffc3", "comment": "Malware payload (Mirai)", "value": "d23471a2d484ed3b752337cc8c137aaaf1964ae90ca83e907810066a8123e47a36b4775827f6aadf3dfc9b3d9a14bfbf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888083, "uuid": "c5b5ca93-d593-47aa-b777-d2163208c49a", "value": "T19D138E76C86D9DD4C2448A78A935CE781F63F104C2671EFA1E9A85A68043DFCFA093F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888083, "uuid": "8bce0ddd-276c-43fc-bbd4-4f6dc6ee8261", "value": "768:Xad0wtw3XyPp+leFMeyiKrKUnUAwkcNoZMCroZFkC7:XaewtwndMMFBUc4aMT3kC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680888083, "uuid": "e96f553a-9a95-4433-b75f-4bc5755e7fc2", "value": 42676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680888083, "uuid": "8e21c9fb-5445-47a4-b280-2d9a22c7c9bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888083, "uuid": "a05b0f24-183c-4a79-b0ee-6c5864c9d6d6", "value": "2ad7a4268118b6fb159c8c5acf21d8a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169e071e-d595-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680907182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680907182, "uuid": "aa15182e-6ae8-4697-bd44-a63cdca20b22", "comment": "Malware payload", "value": "8a950ce93135c908e3ed42a441ddeae5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680907182, "uuid": "b88b40ba-b3fe-493a-bc3f-1945e172bc29", "comment": "Malware payload", "value": "e82a94fd2f18b5c774b08d334e839ff0b7c29dd7108069bbf5768506e7277c2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680907182, "uuid": "ec54e663-cee5-4a5e-b0fc-ed117e75555e", "comment": "Malware payload", "value": "152dce27554479f737d284e641402b38c6719be3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680907182, "uuid": "ad4181de-c5c0-4fb8-af41-907fddbbb9b5", "comment": "Malware payload", "value": "faf63c3968496ccbffa0581c8c23e11e49e178ccb2d2dc121159fe4ee2d2a443cdfdb9e9127f226694d07f94c9ebe062", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680907182, "uuid": "074646cf-ca2b-4691-8f67-f2ba01b2158d", "value": "T1D6B2E03CA799AEE2C38D167D87129B287F04D5918BCCCBF20421046FDBDD9A28CB450B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680907182, "uuid": "df1d9a66-acd5-445a-99e5-a7991eaa51e6", "value": "b6c88715ed6b646facb7b41384504eed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680907182, "uuid": "ce12befe-37dd-4ab9-8692-77970d576b2e", "value": "384:qjD6bqVIy0xylC5LyGEbNqDmo8hIjS8tsjLR9ya5fJvwtpd2fEUgptMbzyMQB:qjDcqbYmGmymoBOzjNv5FupdYEHgb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680907182, "uuid": "acc5362a-4b4b-4426-bd36-aecbc8e7689a", "value": 25028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680907182, "uuid": "674f8156-b419-487e-9555-899b1de1b0ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680907182, "uuid": "ffa64efc-4cc1-4e21-acf7-4a8da2bebcd3", "value": "Server_Maker.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc71bf9d-d516-11ed-88f6-42010a9c006e", "comment": "Malware payload (PennyWise)", "timestamp": 1680852941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680852941, "uuid": "c9c84094-db10-4593-b92f-fa8be320b5e8", "comment": "Malware payload (PennyWise)", "value": "752d31929c995e060a7929b257c17b6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PennyWise", "colour": "#4CC31C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680852941, "uuid": "88044ab0-53a6-45e5-aedd-6e12dd18cd78", "comment": "Malware payload (PennyWise)", "value": "e8dd139f8a1e74fd81b834e30e5c651954d857cdf89a05b3d36c33f0315e4d72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PennyWise", "colour": "#4CC31C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680852941, "uuid": "f3ea856e-c19a-4faa-a6d6-b8a1d0de57c9", "comment": "Malware payload (PennyWise)", "value": "6b6f4c916de4d263d1f8c36ff6b3719a2cebbeec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PennyWise", "colour": "#4CC31C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680852941, "uuid": "5c21bd40-20ee-4e24-9a1a-d711ec0e4409", "comment": "Malware payload (PennyWise)", "value": "3aa74266cf55c8cda82b063904cceafb86fd74f2a312e0c489ee9a85e9747306bf197ecd1cc2fbe34469211ccda5fb88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PennyWise", "colour": "#4CC31C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680852941, "uuid": "2e1ff3fc-9fb1-4026-8d35-86e3dffa38cb", "value": "T1FDB316BD1648CEA5CAACB7B8E8B3211873B8E25F8817D743C9F695F815433C58972186", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680852941, "uuid": "a9f742b5-34a8-40de-8d28-e61f4897f3bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680852941, "uuid": "c9f7d93c-7cde-45a6-8c28-86f26858099e", "value": "3072:jtAmcKOFtNRlgSWKoIFkg2kKMuUrRRLakcRPY2I5wJr4sZrfbRF:RKFtNRfWKoIF5WksnZDb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680852941, "uuid": "3f331325-cf4a-4eb8-831b-56d35b09a92d", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680852941, "uuid": "04245258-9c02-4e5e-b421-c8cc714a34d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680852941, "uuid": "fccbb385-1fdf-4bf9-a962-1d2ae22f511e", "value": "Installer crack-cleaned1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1939c4b2-d517-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1680853070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853070, "uuid": "b45b83d6-b704-4422-a9e1-e7e4c1135854", "comment": "Malware payload (RemcosRAT)", "value": "65f572bece24603cdd9d94302f4be903", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853070, "uuid": "06f28ffd-ece8-465e-a685-d2409bdb4490", "comment": "Malware payload (RemcosRAT)", "value": "e9170f41f12cdfe6dc65d06ed06cc1fb839fc764067e19c777eeb74eff084044", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853070, "uuid": "5c2e393f-63e7-4a04-87af-2e6b11cad032", "comment": "Malware payload (RemcosRAT)", "value": "60f9899956a123c8273bc0d52d4479007260c369", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853070, "uuid": "ae4c0dbe-7719-401f-a8a0-cfa25d84737e", "comment": "Malware payload (RemcosRAT)", "value": "0348bb1a58a7cd2dac0c96d66b784bb3998c45251674089e07804749fc5844b6359a1319a6fd90eedce1d576e934edd4", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680853070, "uuid": "f36e12f2-dfae-4c53-9daa-25b1b63efb64", "value": "T1234533BE4C0E15FD2CB728F2938B2658529CB9365E0D178C717CEF03A36E5A6325681C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680853070, "uuid": "1d489c74-eacb-45fb-a97a-b9bc87713d52", "value": "24576:hesBv3+Y6jiBJ9TYJSpRCOoAvKXAiXRyoGH4SoQEj3LRd:Z++J9JgHAcAiXRd+4SoQEvRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680853070, "uuid": "7d4ee6a7-2cc6-4991-a883-697c42247789", "value": 1181443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680853070, "uuid": "f5370d20-c1f5-4dd5-b2a3-c9c8ac4053bf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680853070, "uuid": "7efc50b3-5e9d-46cb-890e-c4b6fed071a4", "value": "RFQ006119236.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b252e6e-d54b-11ed-88f6-42010a9c006e", "comment": "Malware payload (ModernLoader)", "timestamp": 1680875434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680875434, "uuid": "92065b62-10f3-4c4b-a372-6cebb2f17f4d", "comment": "Malware payload (ModernLoader)", "value": "d12ef7a8c6ecfad1f8d8507e9c610340", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ModernLoader", "colour": "#2CE23B", "exportable": true, "hide_tag": false }, { "name": "test2", "colour": "#50CE20", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680875434, "uuid": "c1b0fbc0-b6a9-428f-83e2-3998a8fc8748", "comment": "Malware payload (ModernLoader)", "value": "e9e8b9ee9e7586f386f0015813aff0288c230e8277353a3df75d11f7ce13d02e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ModernLoader", "colour": "#2CE23B", "exportable": true, "hide_tag": false }, { "name": "test2", "colour": "#50CE20", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680875434, "uuid": "f2ee3220-c713-4940-9efa-ea93ade3d5a9", "comment": "Malware payload (ModernLoader)", "value": "0423b5da1e0a889d6428f01b6b30107f8542686c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ModernLoader", "colour": "#2CE23B", "exportable": true, "hide_tag": false }, { "name": "test2", "colour": "#50CE20", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680875434, "uuid": "32ab35b1-635c-4fa7-a01c-79645a8f3b95", "comment": "Malware payload (ModernLoader)", "value": "39f37d03b9e88f73962cce58c19030d58e670e6232033ab8d3bdb3bfce4bf353937e4e30ee5d8cccb752c098342975db", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ModernLoader", "colour": "#2CE23B", "exportable": true, "hide_tag": false }, { "name": "test2", "colour": "#50CE20", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680875434, "uuid": "bfabd247-dbfb-4e64-9cdd-12e6399da8ee", "value": "T11923C28C69D3A458923FB67F630E9D54F0590B27054A0E87B87DD070EFB2664B392DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680875434, "uuid": "77dcb51e-ad56-496f-8759-909ba1c9a46d", "value": "768:ndEmCNkCPaEbFz7dQ939FriE7S9XOYQ6JSAAz+FvwnmVoMZ2ccg4dK4UdVbCfviO:ndE7uFriE7S9+YQ6JSAAz+FvwnmVoMZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680875434, "uuid": "e440e3a3-93c1-4a9e-b188-3e6f505f03d8", "value": 47486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680875434, "uuid": "9333a09c-e908-4b81-ae64-97f62192e119", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680875434, "uuid": "c06b20c0-9627-4a05-b5bc-1f4c0c6d88c6", "value": "information_7_apr-7289330.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c6fba4-d57a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680895643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680895643, "uuid": "71d096b7-64bd-46ec-86f0-3dd2af7b998f", "comment": "Malware payload", "value": "621cb3be6e5436af1225c9ce81bf191c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680895643, "uuid": "e92174ab-79e8-490f-a5d7-a62720beefce", "comment": "Malware payload", "value": "ea3d39570fa484cae2caf5849bc35b0080184dfa5fb858a98d72881095cb9365", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680895643, "uuid": "3dfc0a13-1c22-449d-8511-99179c2a2a2e", "comment": "Malware payload", "value": "a0e846df198329e9ebabdc1f1e2e49e3e033ebcf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680895643, "uuid": "673f60bc-1c85-4724-af30-b6751f14b9d8", "comment": "Malware payload", "value": "91af26adcbc072ea162185e7eb2c4ef463c5df2fd790cb707fe9f5fb990910d8a401a6ebf3e4c216994074427ca1f73f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680895643, "uuid": "c8d15955-1746-47fc-8610-ac4ed506f409", "value": "T1EDA32A37BB230F23C0C9547112E30331AAB5D75938BA5397BAD06DAC6F1AA8435277E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680895643, "uuid": "54c8daf1-c606-45d9-8946-7ca3c473dcca", "value": "1536:G6D5jKKtWKAr7NM5Oftit+lOQycmQHFqXjetRea4Q:Or7N83eOQycmQHFqXytRH4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680895643, "uuid": "198ad277-04de-49f0-afd0-1caa9b47c151", "value": 103381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680895643, "uuid": "6b3123ed-6905-4e65-b768-af2bcd3fd91b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680895643, "uuid": "8bb64561-a563-4ec5-aa68-9f7e87ca035a", "value": "621cb3be6e5436af1225c9ce81bf191c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9da0c5a8-d593-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680906549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680906549, "uuid": "f44ce413-4b51-4972-8e5e-ac9cad77e37e", "comment": "Malware payload", "value": "44b94e26c5c14ad91497bbaccb6c2c13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680906549, "uuid": "b67f73e8-27d0-4011-a975-b0337da7c345", "comment": "Malware payload", "value": "eb84a45b709c9c309172447a0cc3ac97409fc273710267dfa18e8d248756a051", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680906549, "uuid": "8ce754a8-c4f8-44d9-8d27-36d0a356cc44", "comment": "Malware payload", "value": "bbc7233ac875d5179400cedcb46816ad2efa0699", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680906549, "uuid": "c30be87a-a7b3-4e75-997e-2b4211cfc2c8", "comment": "Malware payload", "value": "484cd48fca2b3e0134c646dc75a1fbe9274b3fd4f2b422105a9db33eb4ab37131f5db6ab144fcc41a865a13e20fdf3b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680906549, "uuid": "fbf1b6f0-6c62-4714-aaef-8fb7a8a03ba4", "value": "T10BA4CF4837D2FF17C0518277F1311A80131AD1999B5BF381A4198E59AEEBBAAF1FD48C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680906549, "uuid": "b1a0a18a-878b-4ca0-b883-61ff59364f27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680906549, "uuid": "c7df6644-ad86-4aa3-a7af-dac470eda478", "value": "12288:+XZhJdtSOG3mTwaSvUH+aMWcxGbqjnkPN:+7fw7UH+aM5Djn6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680906549, "uuid": "223b3658-0d2c-439e-b19b-cf23ac2b1604", "value": 493673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680906549, "uuid": "deb32e65-7c9b-403d-a881-c741e5a5c9bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680906549, "uuid": "51a085d3-89b6-4ccb-b7db-e880f4de7e26", "value": "Homework_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20241874-d57c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680896461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896461, "uuid": "08044cd4-c3a0-4346-beb9-606b625b34bd", "comment": "Malware payload", "value": "d9cccd649d8b974130fc3f7c29cbde70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896461, "uuid": "a76fa586-8b2a-484b-8a05-fe6326b4c1a1", "comment": "Malware payload", "value": "ec3409a522a369603f29758d03aa917d2a3b90120a89b33839d97fbfd9ae3472", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896461, "uuid": "9a7780cb-d603-4582-983a-d1986f579157", "comment": "Malware payload", "value": "783b6654ddb1fab44e67efa3127a9b1d64aa048f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896461, "uuid": "6c51a391-c993-40f1-9a6b-3e3178353643", "comment": "Malware payload", "value": "4afe5272c25832731e9174afdbfdef839bef1d62d9c580886ad090305702b4e99d9fc5ebf0e8429366d339a929697e42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896461, "uuid": "8d1d6c1f-7271-4e60-9e78-e849444102fa", "value": "T1B0732956F9806B11D9D521BAFE0E014D339357BCE3EE72129D209B2537CAA6B0FB7502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896461, "uuid": "6ca2590d-a0ef-494e-895a-779e0a16fdd4", "value": "1536:6+ngAY5vqg5boL5bm25BtA5XSA5E7dftc+nA5CaeeSEY6jNillfiNKuBfEw8rY7J:TY5ig5kL5y25zA5iA5EFOkA5CaeeSEkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680896461, "uuid": "8376a750-cf16-4d74-b9aa-3a7b9a7f0ecc", "value": 77212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680896461, "uuid": "39c1c8c3-1ce7-4a1f-bc18-6a44c963848a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896461, "uuid": "edd45e03-d2fe-4f6b-896f-fb0a1a2e305b", "value": "d9cccd649d8b974130fc3f7c29cbde70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44d948a9-d518-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680853572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853572, "uuid": "ee252b93-6768-4c6f-87d4-b6d27e90a96e", "comment": "Malware payload (Mirai)", "value": "c2097612dc7ec8b97673b75977e81c85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853572, "uuid": "03b0307d-fded-4c19-8915-3fcdf9792f65", "comment": "Malware payload (Mirai)", "value": "ec4ce88e00a12587abeec5bdff376ca760a49646cd319fff89ae71117b4d2aae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853572, "uuid": "f5146263-5c8d-4b98-a660-a6bf3a6db818", "comment": "Malware payload (Mirai)", "value": "f327f9d5216c4b450c9313c07bbe58acbf08d3f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680853572, "uuid": "a692ed97-89af-4ef3-a0f1-d9a82e275b69", "comment": "Malware payload (Mirai)", "value": "ae9b0d882403e6d757d24147d3ed047f873854a720d1c57fbb13884f5e5cca105cce465ef9886a31d7436c3e0811052c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680853572, "uuid": "7ad0a6be-40c9-431f-a5da-ca39b0cce3d8", "value": "T10FE2E0F86308BDE0CEF83C35DFB697C26364423090EA37342D0A48796DB5A7A6751687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680853572, "uuid": "ba7e2f7c-4622-46e7-bbb6-a03b32491e60", "value": "768:BG6Qwn5q4Z+iQ8dIR2E7US/sHtfnJAJss3UozH:Gwn53Z+7Yq57UQctMpzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680853572, "uuid": "c7523152-4930-4be9-8d37-fdef1d1240c4", "value": 32000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680853572, "uuid": "4e08d256-ef9e-4dad-8bf6-1cf46e9bb1ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680853572, "uuid": "3375ae7d-6afa-4bc5-999f-7f25318e2f15", "value": "c2097612dc7ec8b97673b75977e81c85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "413be941-d57c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680896516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896516, "uuid": "20d54fce-57e3-45e6-93dc-b0cc594416cf", "comment": "Malware payload", "value": "d8c07079d97e12de763b47c39ed53a03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896516, "uuid": "e4835ff9-f9f3-4012-953a-fb1c31018c7a", "comment": "Malware payload", "value": "ed9f088ff261701f57827cce0febe576535e31ff40e6bfdefca4899aa23dd822", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896516, "uuid": "1cadaf20-b143-4f18-b2d4-abd16e4cd28c", "comment": "Malware payload", "value": "e33cd318101bc149e41e4ad14038621d780f9c73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680896516, "uuid": "5f76f651-73be-4264-87ec-7ef3302353fa", "comment": "Malware payload", "value": "5da2f04dfe737ced27b7cd2118aa840298bbfb42328b9585ed83a6973ca05cba4ddbb8e840b7ab6d7bace8d20072dfe8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896516, "uuid": "3061e5ba-48c2-423f-a569-0cd08b0a98c8", "value": "T15D53D616FF904FEBE85BCD3305AC8701399D685612B87B357A30C969F25E68F12E3894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896516, "uuid": "964edcf1-8603-4dc2-a28e-4bbb2de1455a", "value": "1536:ozcXv+9ccTWDlLAFjgp3LaODXwZYwVg04BQYs:owXv+9c3bDAEWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680896516, "uuid": "53af7ac9-ae85-4f1b-8c95-2c5cb01f4362", "value": 64252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680896516, "uuid": "2b499912-8048-47b0-a9f0-c474c9d33ff5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680896516, "uuid": "1355d4c0-25e6-46a1-899f-a6955b500d9a", "value": "d8c07079d97e12de763b47c39ed53a03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21637f3b-d55e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680883578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680883578, "uuid": "aa2c2dda-9323-42b4-8d05-62a3c54fcd05", "comment": "Malware payload (Mirai)", "value": "2298feea2ce25e4934e02dcda006a6e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680883578, "uuid": "2a8bca21-fe93-4ed0-9915-b173b08c4059", "comment": "Malware payload (Mirai)", "value": "ef7f1452dbb2c622f34af910c9cce65bc28b92b9b09bcb59380b066e319ab054", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680883578, "uuid": "361bcee4-4e56-4cba-bd54-1030cb83cee1", "comment": "Malware payload (Mirai)", "value": "b51d7af6efa3bcfff274c9e9bd07d388337b6e33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680883578, "uuid": "9e9572a1-84ca-4bfd-b798-2d9afaa41479", "comment": "Malware payload (Mirai)", "value": "1a6399b8c263a762cb742f0cd445c2ab8f7b4792ba7e6a521033e8eff70404d4862326d27b86fd5a5fa676d74d89d93d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680883578, "uuid": "5eee4ecb-61ac-41a7-9de9-bc7b4d795e89", "value": "T1015329C8A593F8F5DC140978307ABB66AEB3F13B7135E99BC3D82927A841702D10669D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680883578, "uuid": "ef0db593-06dc-445d-8291-eb154543d120", "value": "1536:IoRC9170vwHbQXZ5+qXDEuXi90dSW7V/DjObeFt6PuQ4Z6:PC917iwHbQXZ5+qXA594SWZ/XObeb6G7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680883578, "uuid": "934d0432-5307-4338-b11c-5a74c1604400", "value": 66136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680883578, "uuid": "9a65be4c-09dc-4340-8d5d-4928c9f4ca80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680883578, "uuid": "651c2848-515b-4cb2-a733-5b422d2f947c", "value": "loligang.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21fa69f9-d573-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680892598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680892598, "uuid": "5daba28c-e79b-4852-b25b-80ff66a74e4b", "comment": "Malware payload (Mirai)", "value": "2229ed48fe149ea744fba8ca791d8d7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680892598, "uuid": "e2cc6f3c-e325-4c6e-8814-617ca3759abb", "comment": "Malware payload (Mirai)", "value": "f3c4525bb3adefa5513497b17fee365bd9a100e4cb5b2ae1781f642feaf3ea81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680892598, "uuid": "33109b3e-de72-4149-84b5-a17f47a7edf3", "comment": "Malware payload (Mirai)", "value": "cc9f7f9579dede6c533cc34f65eba634c81d40b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680892598, "uuid": "dcac8346-13b6-4bd7-8c03-11ef17375d95", "comment": "Malware payload (Mirai)", "value": "ce05c575a047ed4589f992142212f341d2684bf3cd40edd870419a40cdcc6ea28b27aa7ee7457075792c84ca4dea6982", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680892598, "uuid": "871a1076-ab06-43e3-a2a1-1e613dd893d2", "value": "T18E134BC4D983E2F8FC1213380477F77ABB72A8AE1175CB93D758A435D6527109A27A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680892598, "uuid": "8ed381a9-6447-42d2-bbbb-f59a7da7b1c4", "value": "768:JcHCvheC99DnS3BjzjiIp6kAKgcKoLIC878SzYIJ:JcH0eC99DSRJpgKgcTLIp8SzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680892598, "uuid": "3d2de86c-1176-4de0-9ac1-5be1821c79e7", "value": 42544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680892598, "uuid": "e819bd61-2e6a-49d3-b84c-4262b5eeb872", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680892598, "uuid": "0fd2b394-7a53-491f-a652-2d6ea6b1c921", "value": "x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b1a44f-d575-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680893517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680893517, "uuid": "364e016c-3b6c-4ad2-9bcf-a979bc07b498", "comment": "Malware payload (Mirai)", "value": "a896db52fc2693e82037f5f9f459b3e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680893517, "uuid": "149fa56d-5b68-4b91-87a0-87a71799e8f7", "comment": "Malware payload (Mirai)", "value": "f3d60c6bba54e0a7f42b1056c17b70ca243a833c9b0824aff5a6405bfbaf29c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680893517, "uuid": "4ce5f9b4-0c2a-4084-93da-48dbc84a00bc", "comment": "Malware payload (Mirai)", "value": "2d35fe3ec40a048a8cb1b7800db2cf313820234a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680893517, "uuid": "da8369db-fd0a-47a3-b39f-44f645933c0b", "comment": "Malware payload (Mirai)", "value": "9e4ce1f078586e7592df78fc10df8845e787e317b79a32251cf3d25890dfc010585cea2307bd0a09b3c31a646328d5ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680893517, "uuid": "133389d8-2706-41f9-bda2-3454256054bd", "value": "T153438D37E96E1E74C04641B074748EB56F23B5C883972EB61AA9C2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680893517, "uuid": "d2a56e66-a726-4e1c-8079-ee938de0624f", "value": "1536:Vaa0brW/Od9hlCR3KEyKYXwKEpPDCMC2+WB:Vv0brWGd9X5E1YypPDL+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680893517, "uuid": "23f66c4f-8b86-4866-bb88-a5e6b83d1e3b", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680893517, "uuid": "42ba6194-3bd0-4425-b50c-fe0ae3be2716", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680893517, "uuid": "4f08c6ab-9e56-470d-aa29-9fef4e529933", "value": "a896db52fc2693e82037f5f9f459b3e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "563574b4-d56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680890968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890968, "uuid": "3851a015-eae0-49b9-a901-6cd76b78abfd", "comment": "Malware payload (Mirai)", "value": "2e91fff583e00c1e9f14ee52935d3ad6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890968, "uuid": "31233276-1a8b-4ccc-9fad-d6d6b3c376a8", "comment": "Malware payload (Mirai)", "value": "f70493b6c1432eaa169ffabc79e3cfd2618c4cb72e6c5391ee7169f932621700", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890968, "uuid": "b27d9227-3384-4177-8bfa-dd3d50fda6c4", "comment": "Malware payload (Mirai)", "value": "2b3fa5df1b9349226ce1e487fa9385cef1b0cafd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890968, "uuid": "95b80b0c-f400-4681-9807-5c03cc30ecb5", "comment": "Malware payload (Mirai)", "value": "a760b3b3983729d54050734d5e29ad468c7ba37336457d9517be8c4a515c23d120f52d27d96bae6eb2e273e6fee34475", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890968, "uuid": "ec84caee-6b1e-4b5e-88b0-c69ae560bcc4", "value": "T11D733945BD815A12C6C553B7FA2E01CD332563E8D2EF7213DD126F11B78AC2B0EA7662", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890968, "uuid": "114f3b90-c273-4029-8dca-847688ad95b5", "value": "1536:xe0l7Ckjo2WG5BNTfCPY5PJlHthtzLxR4j+vJNP7wcumnd0wbZnN:xXCkj13x5jtjxR4jCJ9BulwbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680890968, "uuid": "ab970424-b8a6-4f33-af14-fafe8f20411d", "value": 76648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680890968, "uuid": "ec18e357-7ea2-46a0-bb2a-d8a603cc8aae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890968, "uuid": "b6b5b3b0-c9f5-42d2-b2ae-32bab752ba8f", "value": "2e91fff583e00c1e9f14ee52935d3ad6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a49d06be-d568-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680888093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888093, "uuid": "de262ffa-8d41-4d3a-b2e9-3fcacfd37694", "comment": "Malware payload (Mirai)", "value": "e6212122ce3325acb4e769bfc7001336", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888093, "uuid": "0e0dbe9b-df35-4e3b-8844-14b0ac6024ce", "comment": "Malware payload (Mirai)", "value": "f88609520568415cf1da84571f08930092005be13da73d7eacdc6236d5d502fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888093, "uuid": "2f50d04e-2cfa-42c2-accb-1a87dc47b1d1", "comment": "Malware payload (Mirai)", "value": "00027ea835ccc42d81b3a93289de8f422f7905ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680888093, "uuid": "91519afa-48c9-4b64-948a-ba01427bb2cf", "comment": "Malware payload (Mirai)", "value": "709a8c7cdc77b391a986c49df806d32b20467be41e370ba401956fb40ca289c957894543ab557be9e197a1178a8679a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888093, "uuid": "b242e4b3-dfa0-40ea-9d97-297090a40e48", "value": "T1E16319817C80AA26C7D0177BFA9F108E3314ABD8E1DB73478C141F95769A81F0D6BB5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888093, "uuid": "633ee0ab-548f-4abd-81a1-f4fe69725944", "value": "1536:GbtexU5L9XouIRhb96pUQzXtwavaJ3V8OHxouJeZWDFI8dM:GbtexU0r8QCKw2Fba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680888093, "uuid": "f6563b25-c248-4337-9054-29bca37b54d6", "value": 71864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680888093, "uuid": "2977c51f-25f9-447f-b425-a6b42a6be4ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680888093, "uuid": "878d46ee-3954-4370-b77f-527761d6368a", "value": "e6212122ce3325acb4e769bfc7001336", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e21c9cb-d55d-11ed-88f6-42010a9c006e", "comment": "Malware payload (BitRAT)", "timestamp": 1680883223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680883223, "uuid": "e1254b62-5213-4638-908d-f003bfb3db12", "comment": "Malware payload (BitRAT)", "value": "d06ff0d18c5ad64074d9226b4e487fc6", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680883223, "uuid": "0431af35-c91e-411a-9b46-158a8811b93d", "comment": "Malware payload (BitRAT)", "value": "f90daaf2d996784d7979a080025c976a49da12c6afe7b1a8ec80c98d5293c665", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680883223, "uuid": "90e455cb-4cc7-489e-bbf1-b9177c499c60", "comment": "Malware payload (BitRAT)", "value": "c654e3653c433860310acbb7b328e809447294a5", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680883223, "uuid": "72520480-09d5-4f57-8517-f8fa66debf09", "comment": "Malware payload (BitRAT)", "value": "68ad6d72b0bf30bf96f32acec1a3d10e9d9e886c8b8ac94672dd391ee3674e1e4933a81d497122ec53448da116e1da9a", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680883223, "uuid": "7c72bd51-b432-4067-9c89-69201a08fd4c", "value": "T12A06CF02FA46C562D2170230E96E77BA053CF9354B2085C3B3946E6C59B66D17A3BF3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680883223, "uuid": "c604b4d5-235c-4e68-ad93-8ce0185a3292", "value": "71955ccbbcbb24efa9f89785e7cce225", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680883223, "uuid": "5452b365-4432-442d-ab32-4df4481c2fdf", "value": "98304:d77Pmq33rE/JDLPWZADUGer7B6iY74M/YmlwXVZ4FB:5+R/eZADUXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680883223, "uuid": "f20761a2-ccf1-411a-8e11-49dc5fdf2058", "value": 3943424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680883223, "uuid": "937dabc0-5e16-418e-9453-36e88ec573a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680883223, "uuid": "e6933407-942b-4e11-9389-774843684ba9", "value": "d06ff0d18c5ad64074d9226b4e487fc6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8cc0f8-d56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680890983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890983, "uuid": "21c59fc0-ae5e-45d6-853e-16c927c96ebe", "comment": "Malware payload (Mirai)", "value": "ca6f1d203ae091d41a8cb4a6eee05f42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890983, "uuid": "9683400c-2ccc-4b0b-96fd-f23c13247bf1", "comment": "Malware payload (Mirai)", "value": "fa0b84aae297a49e16d4978783b3a3c091a3f49c27035daed06f6ef21836945f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890983, "uuid": "63aa6914-7e5e-4d96-8420-e04671bb0be7", "comment": "Malware payload (Mirai)", "value": "2215c07ca146f8b7567bde79093a1a580bdeabc5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680890983, "uuid": "a85422af-cfb4-481d-a423-d3c7a15810fa", "comment": "Malware payload (Mirai)", "value": "641c4917b1cae5b431e433fed3ad52b5a5db85f6770304ffd752ef2934ea8231734aafc314364c3db012c7e3f2660b7e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890983, "uuid": "b130aec6-4fb5-4a79-b776-5d3d21220221", "value": "T108A3B40E2E218FADFB9D823547F74A21A65833C637E1D684D19CFA015E7034E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890983, "uuid": "8786f863-11f9-4c5b-b27a-df15993451bb", "value": "3072:eGroOBedgsrkCumeSo3qkD5eXkDj4kTWLwbZnrn:3hBezU3qkD5ikP4LwRrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680890983, "uuid": "63004d0e-7bd2-42f8-a64d-a3f2fe90038b", "value": 101184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680890983, "uuid": "278624ba-8175-48c1-a397-0f15af2c2fd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680890983, "uuid": "0777d65a-f49f-4a45-acaa-dea913804c61", "value": "ca6f1d203ae091d41a8cb4a6eee05f42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a305246a-d547-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680873917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680873917, "uuid": "ea9aea5a-f924-4892-a050-e19cf348d787", "comment": "Malware payload (Amadey)", "value": "d0dc0d8cd0dfec22ee626dcfe8eee098", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680873917, "uuid": "d413b55b-c46f-45af-a58b-b1ab59df30bd", "comment": "Malware payload (Amadey)", "value": "fd370634e5dd7cc964eb87d3465a1c087e2ab642844d986c256250380a92852c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680873917, "uuid": "bd03bf8d-cf90-4337-a351-f122ffb2f529", "comment": "Malware payload (Amadey)", "value": "ac2e4e5de2de557bbf738669e62684b3241b287f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680873917, "uuid": "333e0799-18b0-4e68-865c-dd4ea1e7c91e", "comment": "Malware payload (Amadey)", "value": "01842d52850c959628123d3ac62298022bb32dc86c6b6620b5cfd2c95b86fbbaf288554b6f77eefe9391a9c22559ca3a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680873917, "uuid": "23ce9e62-141e-48c4-a960-bd3df0a5e2f9", "value": "T13914CE11B9F4D0B7C96786705424D9F47AAEBCA3CB45854B33483F6B3C322916ABB25C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680873917, "uuid": "43929042-5842-4fd5-b1d4-658d20e5f57a", "value": "5b250269b3029bf9f1db422179f30d8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680873917, "uuid": "62e3dc3f-2de7-4935-8af0-d2458df1cf10", "value": "3072:NibAgkyqgmz+Ud1AM7NH0uDUmQpHDYGPzXmVi5WDuNT6:4A4qDnZ7aCfQpciSiNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680873917, "uuid": "b8ab17bd-ed66-4152-a6e1-6d2c30dd6960", "value": 195072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680873917, "uuid": "585283ed-b29e-4d9d-be1f-a396ae247c79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680873917, "uuid": "41f921f7-9e89-437b-9678-5c865e1478b9", "value": "fd370634e5dd7cc964eb87d3465a1c087e2ab642844d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ef2c01-d570-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1680891318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680891318, "uuid": "85cb8b63-4517-4cb0-81b5-7fb62f6cc136", "comment": "Malware payload (TeamBot)", "value": "fc45351cf24c36789924b65016ff7cff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680891318, "uuid": "e375a62c-699b-426f-8b70-79ccc31e3995", "comment": "Malware payload (TeamBot)", "value": "ffad0132d65d4321bb1724b02ad08715a004afb48e3a0a17efb1027d9ca66678", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680891318, "uuid": "a92d2604-f271-4807-ae7a-968dedb67d5f", "comment": "Malware payload (TeamBot)", "value": "51f69859a8e84480d5704aacfc6957446d48b73e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680891318, "uuid": "01183149-110d-40ef-a9a2-4b4784d958b0", "comment": "Malware payload (TeamBot)", "value": "b2eab5ce0992dbedb6f0dbf5db9d55e1b6b7e23f414036c574ba36c37868cdd14238aa0a1da84124cf38c5c287746152", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680891318, "uuid": "a9b8e61c-3fe3-453e-b825-3eae6249f246", "value": "T1E414BE11BA93E0A6D45388B45420C6B8793ABFA39B47D58B334C3F6F3D732821B56395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680891318, "uuid": "55cb4433-ba5d-413c-9d63-54f9470724a5", "value": "25a1b270f58163554bc7d2d96c00089d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680891318, "uuid": "238f1776-2d06-4f78-baf1-48565f5ac2de", "value": "3072:gSbAiv7xX/UdT1WLcNgOFxPjtlq5mYHT:xAGxvUdTnNgOXp4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680891318, "uuid": "432ee35a-6b26-4af1-9de5-2f87ce9d181c", "value": 194560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680891318, "uuid": "166d48e6-a6dc-438d-bcf7-2e7c4c445c88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680891318, "uuid": "701c340d-c745-4bb9-b664-b9fe52fa2eef", "value": "fc45351cf24c36789924b65016ff7cff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }